The CIPP/US (Certified Information Privacy Professional/United States Exam) is a top certification. It shows you know a lot about US privacy laws and practices. Passing this exam means you understand how to handle privacy well. This certification is very important for those in data privacy, compliance, and security. It shows you're serious about keeping information safe.
The CIPP/US has 90 questions and costs $550[1][2] (International Association of Privacy Professionals, verified Oct 17, 2026).
Numbers in brackets link to the official sources listed under Sources & last verified. Dates that have passed are removed automatically.
| Item | Detail | Source · Verified |
|---|---|---|
| Number of questions | 90 questions[1] | International Association of Privacy Professionals · Oct 15, 2026 |
| Passing score | 300 on IAPP's 100–500 scale[3] | International Association of Privacy Professionals · Oct 16, 2026 |
| Exam fee | USD550 standard exam price[2] | International Association of Privacy Professionals · Oct 17, 2026 |
| Retake policy | Minimum seven-day wait[4] | assets.contentstack.io · Oct 16, 2026 |
| Validity | Two-year certification term[5] | International Association of Privacy Professionals · Oct 19, 2026 |
| Delivery | Test center or online proctoring[2] | International Association of Privacy Professionals · Oct 17, 2026 |
| Score release | Immediately after completion[4] | assets.contentstack.io · Oct 16, 2026 |
| Registration deadline | Complete within one year of purchase[5] | International Association of Privacy Professionals · Oct 19, 2026 |
| Registration opens | Exam purchases available anytime[3] | International Association of Privacy Professionals · Oct 16, 2026 |
| Testing window | Year-round[3] | International Association of Privacy Professionals · Oct 16, 2026 |
According to International Association of Privacy Professionals, “The CIPP/US is a 2.5 hour exam composed of 90 items.”[1]
The content areas below are copied from the official CIPP/US content outline published by International Association of Privacy Professionals. The right-hand column shows which of our practice sets covers it.
| Official content area | Practice on this site |
|---|---|
| Domain I — The U.S. Privacy Environment[7] | CIPP/US Core Concepts & Fundamentals Practise how U.S. privacy law is organised, including the sources of law and the differences between sector-specific and general rules. |
| Domain II — Federal Privacy Laws[7] | CIPP/US Privacy Laws & Regulations Practise matching each federal statute to the data, the organisations and the individual rights it covers, since many questions turn on scope. |
| Domain III — Government and Court Access to Private-sector Information[7] | CIPP/US Enforcement & Regulatory Agencies Practise telling apart the legal process that lets government or litigants obtain private-sector data and what limits each one. |
| Domain IV — Workplace Privacy[7] | CIPP/US Workplace Privacy & Employee Monit... Practise employer duties around monitoring, medical information, background checks and employee records. |
| Domain V — State Privacy Laws[7] | CIPP/US Privacy Laws & Regulations Practise comparing state requirements, such as breach notification and consumer rights, and note where states differ from each other and from federal law. |
Prepare for the CIPP/US - Certified Information Privacy Professional/United States Exam exam with our free practice test modules. Each quiz covers key topics to help you pass on your first try.
These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.
Question: Why is training important in privacy program management?
Answer: C. To educate employees on data protection
Explanation:
The correct answer is that training exists to educate employees on data protection. People handle personal data every day, so a privacy program only works if staff understand their responsibilities, the organisation's policies and the risks involved.
Reducing server downtime is an IT availability goal, not what privacy training is for. Meeting contractual obligations can be a side benefit, because some contracts require training, but it is not the reason training matters to the program itself. Boosting sales is a commercial aim unrelated to privacy governance.
The rule to remember: policies on paper do not change behaviour. Training and awareness turn written rules into daily practice, which helps prevent incidents, supports compliance and builds a privacy-aware culture. When an exam asks why a program activity exists, choose the answer that links it to protecting personal data.
Question: An employee notifies their manager of a disability and requests a reasonable accommodation. Under the ADA, the employer's privacy obligation regarding this disclosure is to:
Answer: A. Keep the medical information confidential and share it only with those who have a specific need to know on a need-to-know basis
Explanation:
The correct answer is to keep the medical information confidential and share it only with people who have a specific need to know. The ADA treats medical information gathered during the accommodation process as confidential, so it is held separately and disclosed narrowly, for example to a supervisor who must carry out the accommodation.
Filing it with the EEOC within 30 days is wrong because there is no such duty on the employer. Disclosing it to HR and the entire team is wrong because it goes far beyond need to know. Keeping it in the general personnel file is wrong because medical records are normally stored apart from ordinary personnel records.
The rule to remember: employee medical data is confidential, stored separately, and shared only to the extent needed to act on it.
Question: Under the HIPAA Privacy Rule, patients have the right to do all of the following EXCEPT:
Answer: D. Prohibit all sharing of their PHI for treatment purposes
Explanation:
The correct answer is the option saying patients may prohibit all sharing of their PHI for treatment purposes, because the question asks for the right patients do not have. The HIPAA Privacy Rule lets covered entities use and disclose PHI for treatment, payment and healthcare operations without a separate authorization, so a patient cannot block treatment-related sharing outright.
The other options are real rights. Patients can request access to their PHI, can request an amendment to it, and can receive an accounting of certain disclosures.
The rule to remember: HIPAA gives patients access, amendment, accounting and similar controls, but it does not give an absolute veto over routine sharing needed for care. In EXCEPT questions, read the stem twice and look for the statement that is false.
Start with the official outline from IAPP and list the five content areas on this page. Take one practice set for each area and treat the result as a diagnosis, not a grade. Note every question you miss and write down the rule behind the right answer in your own words.
Next, read the matching official material for your weakest areas and return to the same set a few days later. If you get a question right only by guessing, count it as a miss. Spend extra time on federal statutes, because many questions depend on knowing which law applies to which organisation and which data.
Use the workplace and state-law sets to practise comparison. Make a short table of how the rules differ rather than memorising each one separately. Then mix topics so you are not relying on knowing which area a question comes from.
Before test day, do a timed session sized to the real exam: 90 items in 2.5 hours. Check the booking, proctoring and ID rules on the IAPP site, and decide whether you will test virtually or at a center. Keep in mind that our questions are written by us and are not real exam questions.
The CIPP/US exam checks if you know US privacy laws well. You need to understand laws like the Gramm-Leach-Bliley Act and the Health Insurance Portability and Accountability Act (HIPAA). Also, the Fair Credit Reporting Act and the EU's General Data Protection Regulation (GDPR) are important.
This exam tests your ability to work with these laws. You must know the main points of each law. This includes how data is collected, used, and stored. You also need to know the rights of individuals and what organizations must do.
The exam also looks at your skills in managing a privacy program. You need to know how to find and fix privacy risks. You must also set up controls and make sure everything follows the rules.
By showing you're good at these things, you can help companies deal with data privacy laws. You ensure they follow the rules and protect people's privacy rights.
To pass the CIPP/US certification exam, you need to know a lot about privacy. This includes how personal info is collected, used, stored, and thrown away. You must also follow all data privacy laws and rules.
Understanding the privacy life cycle is key. It covers getting, using, storing, and getting rid of personal info. Knowing the best ways to handle each step is very important.
Being able to find and fix privacy risks is a big part of the exam. You should know how to spot risks, figure out their impact, and come up with good solutions. It's also important to know how to handle data breaches and work with vendors.
The CIPP/US certification shows you know a lot about US privacy laws. It proves you can handle privacy well. It's a big deal in the field.
The exam tests your knowledge of US privacy laws. This includes the Gramm-Leach-Bliley Act and HIPAA. You also need to know about privacy management and risk assessment.
Start by learning about the privacy life cycle. This includes how information is collected and stored. You also need to know how to manage risks and create privacy policies.
Getting certified shows you're an expert in US privacy laws. It's a big plus for your career. It can lead to better jobs and higher pay.
The exam covers many US privacy laws. This includes the Gramm-Leach-Bliley Act and HIPAA. You need to know how these laws affect privacy management.
Risk assessment and mitigation are key parts of the exam. You need to show you can find and fix privacy risks. This keeps information safe and follows the law.
The CIPP/US focuses on US privacy laws. It's different from other certifications that cover more areas. It shows you really know US privacy rules.
The CIPP/US exam consists of 90 multiple-choice questions. Of these, 75 are scored, and 15 are unscored pre-test items used for future exam development. You are given 2.5 hours (150 minutes) to complete the test. Since you cannot distinguish between scored and unscored items, it is critical to answer every question to the best of your ability for the 2026 exam.
Yes, the CIPP/US test is considered challenging due to the vast amount of specific legal and regulatory information it covers. It requires not just memorization of laws like CCPA and HIPAA, but also the ability to apply these concepts to practical scenarios. However, with a dedicated study plan and extensive use of practice questions, passing is very achievable for candidates in 2026.
To pass on your first attempt, you must master the IAPP Body of Knowledge. Supplement the official textbook with high-quality practice tests to simulate exam conditions and identify your weak areas. Focus on understanding the application of laws, not just rote memorization. A consistent study schedule using our updated 2026 materials is the most reliable strategy for first-time success.
The standard CIPP/US exam cost for 2026 is $550 USD. However, the IAPP offers a significant discount for its members. Often, purchasing an IAPP membership along with the exam is more cost-effective than paying the non-member rate. Always verify current pricing on the official IAPP website, as they may offer promotional bundles or have regional price variations.
PracticeTestGeeks.com provides a comprehensive FREE CIPP/US practice test online. Our platform features hundreds of expert-written questions with detailed answer explanations that cover every domain of the official exam. This is the best way to gauge your readiness, practice your timing, and familiarize yourself with the question formats you will encounter on the official 2026 CIPP/US certification exam.
How we verify: editorial & fact-checking policy. Report an error: contact us.