The CIPM Body of Knowledge v4.2.0 (effective 1 September 2025) has six domains. Question ranges are: Domain I, Developing a Framework: 14–18; II, Establishing Program Governance: 12–16; III, Assessing Data: 12–16; IV, Protecting Personal Data: 9–13; V, Sustaining Program Performance: 7–9; VI, Responding to Requests and Incidents: 10–14. Domains I–III together account for close to 60% of the scored questions, so they deserve the biggest share of your study time.
The CIPM exam blueprint tells you exactly how many questions to expect from each area — as a range, because each exam form differs slightly. Most candidates never look at it. They study the textbook front to back and spend as long on a competency worth 0–2 questions as on one worth 6–8.
All figures below come from the official CIPM Body of Knowledge and Exam Blueprint, version 4.2.0.
The CIPM was restructured into these six domains in the 2023 Body of Knowledge, and the version effective September 2025 kept the same domains and question counts. If your materials describe five domains such as "Privacy Program Governance" and "Privacy in the Enterprise", they're based on the older outline. The underlying topics overlap, but the weights won't match the current exam.
The Six Domains at a Glance
| Domain | Questions | Midpoint share of 75 scored* |
|---|---|---|
| I — Privacy Program: Developing a Framework | 14–18 | ~21% |
| II — Privacy Program: Establishing Program Governance | 12–16 | ~19% |
| III — Operational Life Cycle: Assessing Data | 12–16 | ~19% |
| IV — Operational Life Cycle: Protecting Personal Data | 9–13 | ~15% |
| V — Operational Life Cycle: Sustaining Program Performance | 7–9 | ~11% |
| VI — Operational Life Cycle: Responding to Requests and Incidents | 10–14 | ~16% |
*Our approximation: each domain's midpoint as a share of the sum of midpoints. The blueprint gives ranges, not percentages.
Competency by Competency
The domain totals hide big differences inside each domain. These are the competency-level ranges from the blueprint.
Domain I — Developing a Framework (14–18)
| Competency | Questions |
|---|---|
| I.A Define program scope and develop a privacy strategy | 4–6 |
| I.B Communicate organizational vision and mission statement | 4–6 |
| I.C Indicate in-scope laws, regulations and standards applicable to the program | 5–7 |
I.C is where your legal knowledge counts: territorial and sectoral laws, oversight agencies, consequences of non-compliance and — new emphasis — the privacy risks of AI in the business. You need to know which laws apply and why, not their detail.
Domain II — Establishing Program Governance (12–16)
| Competency | Questions |
|---|---|
| II.A Create policies and processes across the privacy program life cycle | 6–8 |
| II.B Clarify roles and responsibilities | 1–3 |
| II.C Define privacy metrics for oversight and governance | 2–4 |
| II.D Establish training and awareness activities | 1–3 |
II.A alone is worth up to 8 questions — one of the largest single competencies on the exam. Policies and processes are the backbone of the programme.
Domain III — Assessing Data (12–16)
| Competency | Questions |
|---|---|
| III.A Document data governance systems | 3–5 |
| III.B Evaluate processors and third-party vendors | 1–3 |
| III.C Evaluate physical and environmental controls | 0–2 |
| III.D Evaluate technical controls | 3–5 |
| III.E Evaluate risks of shared data in mergers, acquisitions and divestitures | 2–4 |
M&A (III.E) catches people out: 2–4 questions on due diligence, contractual and data-sharing obligations, and risk alignment during deals. Physical controls (III.C) may not appear at all.
Domain IV — Protecting Personal Data (9–13)
| Competency | Questions |
|---|---|
| IV.A Apply information security practices and policies | 4–6 |
| IV.B Integrate the main principles of Privacy by Design | 1–3 |
| IV.C Apply organizational guidelines for data use and enforce technical controls | 3–5 |
Domain V — Sustaining Program Performance (7–9)
| Competency | Questions |
|---|---|
| V.A Use metrics to measure program performance | 1–3 |
| V.B Audit the privacy program | 1–3 |
| V.C Manage continuous assessment of the privacy program | 3–5 |
Domain VI — Responding to Requests and Incidents (10–14)
| Competency | Questions |
|---|---|
| VI.A Respond to data subject access requests and privacy rights | 5–7 |
| VI.B Follow organizational incident handling and response procedures | 3–5 |
| VI.C Evaluate and modify the incident response plan | 1–3 |
VI.A is another heavyweight — up to 7 questions on handling access requests, consent withdrawals, rectification, objections and complaints.
Most candidates split their study time evenly across domains. The blueprint says that's the wrong strategy.
The CIPM Complete Pack's 300 questions, built around 18 case studies in three 100-question sets, are mapped to BoK v4.2.0 — so your practice time follows the exam's weights.
Get the Complete PackThe Competencies Worth the Most
Ranked by maximum questions. The first six alone can account for up to 40 of the exam's questions:
- II.A Policies and processes — up to 8
- I.C In-scope laws and regulations — up to 7
- VI.A Data subject requests and rights — up to 7
- I.A Scope and privacy strategy — up to 6
- I.B Vision and mission — up to 6
- IV.A Information security practices — up to 6
- III.A, III.D, IV.C, V.C, VI.B — up to 5 each
Turning the Weights Into a Study Plan
For a 50-hour plan, allocate roughly in proportion to the blueprint, then hold back time for practice:
| Area | Hours (of 50) |
|---|---|
| Domain I — Framework | 7 |
| Domain II — Governance | 6 |
| Domain III — Assessing data | 6 |
| Domain IV — Protecting data | 5 |
| Domain V — Sustaining performance | 3 |
| Domain VI — Requests and incidents | 5 |
| Mixed case studies, mocks and review | 18 |
Adjust for your background. Privacy operations people can cut Domain VI and III time; CIPP holders can move faster through I.C. Our CIPM study hours guide has estimates by background, the CIPM cram guide covers the final week, and our 10 CIPM practice questions are mapped to these competencies so you can test each area.
Three Traps in Reading the Blueprint
- Ranges add up to more than 75. The domain maximums total 86, and minimums 64. Each form lands somewhere in between for each domain, totalling 75 scored questions plus 15 unscored.
- Low weight isn't zero weight. Domain V has only 7–9 questions, but those are often the most judgement-heavy (metrics, audits, continuous assessment). Skipping it is a common reason candidates miss the pass mark — see CIPM pass rate and difficulty.
- Domains overlap in practice. A case study about a vendor breach can touch III.B, VI.B and IV.A at once. Study the competencies, but practise mixed scenarios.
Frequently Asked Questions
What are the CIPM exam domains?
The CIPM Body of Knowledge v4.2.0 has six domains: Developing a Framework; Establishing Program Governance; and four operational life cycle domains — Assessing Data, Protecting Personal Data, Sustaining Program Performance, and Responding to Requests and Incidents.
Which CIPM domain has the most questions?
Domain I, Developing a Framework, with 14–18 questions. Domains II and III follow with 12–16 each.
How many questions are on the CIPM exam?
The CIPM has 90 multiple-choice questions, of which 75 are scored and 15 are unscored, to be completed in 2.5 hours.
Did the CIPM domains change for 2026?
The version effective 1 September 2025 (v4.2.0) kept the same six domains and the same number of questions per competency as the previous version, with clarifications to wording. It includes understanding the privacy risks of AI under competency I.C.
How should I split my CIPM study time?
Roughly in proportion to the blueprint — close to 60% of your content time on Domains I–III — and reserve around a third of your total hours for mixed case-study practice and timed mocks.