The IAPP CIPM exam includes case studies — scenarios that describe a company and ask 3–5 questions about how you would respond as the privacy programme manager. The right answer is usually not the most legally conservative option. It is the operationally proportionate one. Most CIPM candidates lose the exam on case studies because they answer like a lawyer or an engineer rather than like a programme manager.
If you have been studying CIPM the same way you studied CIPP/E — memorising GDPR articles, drilling definitions — you are preparing for the wrong exam. CIPP/E tests what the law says. CIPM tests what you do with it.
The case study format is the clearest expression of that difference. It is also where unprepared candidates leak the most points. This guide covers what a CIPM case study actually looks like, the four distractor families you will meet, and the step-by-step technique for working through case study blocks on exam day.
What a CIPM Case Study Actually Looks Like
A case study on the CIPM is a short scenario — typically one or two paragraphs — describing a company and a privacy situation. The scenario specifies key facts: industry, size, maturity of the privacy programme, the particular problem being faced. You then answer three to five questions attached to the same scenario.
Example scenarios you might see:
- A mid-sized SaaS company that just acquired a smaller firm and is integrating its data practices
- A financial services firm experiencing a spike in data subject requests after a news event
- A healthcare organisation building a vendor risk programme from scratch after a regulator findings letter
- A global retailer conducting its annual privacy programme audit and getting conflicting findings
- A European subsidiary of a US parent re-evaluating transfer mechanisms after a Schrems-era enforcement action
The scenario matters. Every question in a case study block refers back to it, often implicitly. The organisation's size, industry, and maturity dictate what proportionate response looks like — and that is what the examiner is scoring.
Why Case Studies Are Hard
Standalone multiple-choice questions test discrete knowledge: do you know what a DPIA is? Case studies test applied judgment: given this organisation at this stage with this problem, what should the programme manager do first?
The hardness comes from the plausibility of wrong answers. On a knowledge question, three of four options are usually clearly wrong. On a case study question, all four options can look reasonable at first read. The examiner has designed them so that each option represents a defensible — but not quite correct — approach.
Your job is to pick the most correct one, which usually means recognising why the others are subtly off.
The 18 Case Studies in the Archuz CIPM Question Bank
The Archuz CIPM Question Bank contains 300 questions structured as three sets of 100. Across the three sets you will work through 18 case studies — six per set — covering the full range of scenarios a programme manager would face in practice.
- Set 1 — Foundation case studies: single-domain focus, lower complexity. Great for building the case-study mindset without being overwhelmed by cross-domain complexity.
- Set 2 — Cross-domain case studies: scenarios that touch two or three CIPM domains at once. These are where candidates learn to track multiple strands in a single scenario.
- Set 3 — Exam-condition case studies: designed to simulate the real exam. Set 3 is intended as your full 100-question mock, including six case studies you have not seen before, under timed conditions.
CIPM case studies trip up candidates who only practiced standalone questions.
BoK v4.2.0 changed what's tested. Older prep materials are preparing you for a slightly different exam.
Get the Complete Pack →This progression matters. Starting with Set 3's harder case studies before you have built the foundation will produce false signal — you will not know whether you got questions wrong because of the format or because of the content.
The Four Distractor Families You Will See
Technically correct, legally defensible, but impractical for a programme manager. It is what counsel would advise, not what you would actually implement at your maturity level.
Solves the problem with a system, a tool, a technical control. Often the right instinct for an IT person, wrong for a programme manager who thinks in processes, governance, and people.
Heroic, fast, decisive — escalates immediately, calls the regulator, halts all processing. Right in a genuine emergency. Wrong when the scenario asks what you would do first in an ordinary situation.
"Always," "never," "must," "all" — absolutes rarely survive real-world privacy practice. When you see one, scrutinise it hard. Especially in questions about consent, data retention, and transfers.
Once you can name the distractor family a wrong answer belongs to, you stop getting fooled by it. The Archuz Cram Guide walks through each family with annotated examples.
The Step-by-Step Technique for Case Study Blocks
- Read the questions first. Scan the three to five questions attached to the case study before you absorb the scenario in detail. Know what the examiner is testing before you form a mental picture of the company.
- Read the scenario once, slowly. Mark the company's size, industry, structure, programme maturity, and the specific problem. These facts constrain every answer.
- Answer each question from the perspective of the programme manager in that company. Not the ideal programme manager with unlimited budget. The real one in the described situation.
- For every wrong answer you eliminate, name the distractor family. This keeps you honest and fast. If you cannot name why an option is wrong, you have not actually eliminated it.
- If stuck between two options, pick the proportionate one. The CIPM exam rewards proportionality. The option that matches the scenario's scale and maturity is usually the correct one.
- Do not go back to earlier case study questions. Once you have answered question 2 in a case study block, do not revise question 1 after seeing question 3. Later questions sometimes contain clues, but revising earlier answers under case-study pressure usually makes things worse.
The Mindset Shift That Changes Everything
The single most important concept in CIPM preparation is this: answer like the person who runs the programme. Not the lawyer. Not the CISO. Not the CEO. The person whose job is to make the privacy programme work day in and day out, within real constraints.
When a case study asks "what should you do first," the right answer is almost always the one that:
- Follows a logical sequence (assess → prioritise → act)
- Is proportionate to the situation described
- Does not skip steps
- Does not overreact
- Does not solve the wrong problem
The Archuz CIPM Cram Guide builds this mindset from Chapter 1. Every domain is framed from the programme manager's seat — not as abstract principles, but as decisions you would actually face.
Common Case Study Mistakes
Mistake 1: Ignoring the Organisation's Maturity Level
A case study that describes "a start-up with its first privacy hire" and one that describes "a mature privacy programme with a dedicated DPO" will have different right answers to the same question. If you ignore the maturity signal in the scenario, you will pick ambitious answers for immature programmes and modest answers for mature ones.
Mistake 2: Treating Each Question Independently
Case study questions share a scenario on purpose. The examiner expects you to carry forward what the scenario established. If the scenario says the company has no DPIA process, do not answer later questions as if one exists.
Mistake 3: Looking for the Perfect Answer
CIPM case study answers often describe actions that are suboptimal in the abstract but correct for the described organisation. Looking for the textbook-perfect option leads to over-ambitious wrong answers. Look for the proportionate right one.
Mistake 4: Burning Time on Case Study Blocks
With 90 questions in 150 minutes, you have 100 seconds per question on average. A case study block of five questions should take about 8 minutes total, not 15. Flag and move on if you are stuck; return at the end.
Frequently Asked Questions
How many case studies are on the CIPM exam?
IAPP does not publish an exact per-exam count. Based on candidate reports and the structure of the Body of Knowledge, you can expect three to five case study blocks on a typical CIPM sitting, accounting for roughly 15–25 of the 90 questions.
How long is the CIPM exam?
90 questions, 150 minutes (2.5 hours). Six domains covered. Pass/fail is scaled; IAPP does not publish an exact passing score.
What is a case study question on the CIPM?
A case study question is a question tied to a scenario describing a company and a privacy situation. Multiple questions share the same scenario, typically three to five, and all test applied judgment on how a programme manager would respond in that specific context.
Can I go back and change my answer on a CIPM case study?
Yes. The CIPM testing interface lets you flag questions and return to them before submitting. However, revising case study answers under time pressure often introduces new errors — only revise if you have a clear reason, not a vague doubt.
Are CIPM case studies the same as CIPP/E scenario questions?
Similar format, different test. CIPP/E scenarios test legal application — which article applies, which legal basis fits. CIPM case studies test programme management judgment — what you would do, in what order, at what level of intensity for the described organisation.
How do I practise CIPM case studies?
Use a question bank with multiple full case study blocks and explanations that walk through why each option is right or wrong. The Archuz CIPM Question Bank includes 18 case studies — six per set, across three sets — with annotated explanations that reference the distractor families above.
What is the hardest part of a CIPM case study?
Picking between two plausible options when both would be defensible in isolation. The technique is to re-read the scenario for maturity and context clues, then pick the proportionate option. The absolute-answer and hero-answer distractor patterns are the two most common fooling patterns at this stage.
How much time should I spend on case studies in CIPM prep?
Roughly 30–40% of your practice question time. Case studies carry disproportionate weight relative to their question count because they test the applied-judgment skill that distinguishes CIPM from other IAPP exams.