The CIPM BoK v4.2.0 (Sep 2026) covers six domains. IAPP does not publish exact per-domain question counts, but the BoK structure and candidate reports indicate Domain II (Privacy Programme Framework) and Domain III (Privacy Programme Operational Lifecycle) together account for roughly 46% of the exam. If time is short, these two domains are where you get the best return on study hours.
One of the most common CIPM preparation mistakes is treating all six domains as equal. They are not. The exam draws more questions from the domains that cover the core work of running a privacy programme — and that is exactly where most candidates are least prepared, because their day job may not touch all six areas.
This guide walks through the six CIPM domains with approximate weighting, the topics within each domain most likely to appear, and a three-week study allocation that matches where the points sit.
The Six CIPM Domains (BoK v4.2.0, Sep 2026)
Scattered CIPM prep leads to scattered results on exam day.
Most candidates who pass committed to one structured path.
That's what this is.
What Each Domain Actually Covers
Domain II — The Heaviest
Topics within Domain II that appear most often:
Data inventory and data mapping methodologies; legal bases catalogue construction; privacy notice drafting and layering; consent architecture (opt-in vs opt-out, granular vs bundled); records of processing activities (RoPA); policy hierarchy design; cross-functional policy integration.
Domain II is the architecture of the privacy programme. Everything downstream in Domain III and Domain IV depends on this architecture being right. The exam tests whether you can design the framework proportionate to the organisation, not just name its components.
Domain III — The Operational Core
Topics within Domain III that appear most often:
Training programme design (role-based, frequency, measurement); vendor privacy due diligence; PIA/DPIA trigger criteria and workflow; new product privacy review process; cross-border transfer operational workflow; monitoring and review cycles; privacy incident versus data breach distinction.
Domain III is where the case studies live. Expect every case study block on the exam to touch Domain III, often alongside Domain IV. The applied-judgment questions concentrate here.
Domain IV — The High-Pressure Domain
Topics within Domain IV that appear most often:
DSR intake, verification, and fulfilment workflow; breach assessment (notifiable vs not); 72-hour clock mechanics; regulator notification content requirements; data subject communication thresholds; forensics coordination; post-incident review process.
Domain IV questions test sequence as much as substance. Which step comes first? When is escalation triggered? What must be in a regulator notification? The right order of operations is the exam skill here.
Domain I — The Foundation
Topics within Domain I that appear most often:
DPO/CPO role scope and authority; governance committee structures; board reporting cadence and content; programme charter and vision; budget and resource planning; privacy maturity models; cross-functional governance (privacy, security, compliance, legal, IT).
Domain V — The Light but Not Zero Domain
Topics within Domain V that appear most often:
Programme KPI design (leading vs lagging); audit scope definition; audit frequency and triggers; external audit coordination; findings management; executive reporting formats; continuous improvement loops.
Domain VI — The Technical Intersection
Topics within Domain VI that appear most often:
Privacy-enhancing technologies (encryption at rest/in transit, pseudonymisation, tokenisation, differential privacy); Privacy by Design seven principles; data minimisation technical controls; privacy-security coordination; records of processing automation.
The Three-Week Study Allocation
- Week 1 — Foundation and Framework. Domain I + Domain II from the Cram Guide. Read, take structural notes, do 40–50 practice questions covering these two domains. By end of Week 1 you should be able to describe a complete privacy programme framework from memory.
- Week 2 — Operations and Response. Domain III + Domain IV. These are the applied-judgment domains and where most exam weight sits in combination. Do all six case studies from Set 1 of the question bank this week.
- Week 3 — Measurement, Technology, Full Mock. Domains V and VI in the first half of the week. Then Set 3 of the question bank as a full timed 90-question mock (actually 100 in the Archuz bank for extra margin). Final two days: targeted review of mock misses.
Compressing to Two Weeks
If you only have two weeks, compress Domains V and VI into three or four days total and spend the rest of Week 2 on practice questions. The case studies in the Archuz Question Bank are the most effective preparation for exam conditions — working through all 18 with explanations is worth more than re-reading the BoK a second time.
Do not compress below two weeks of focused preparation unless you have substantial prior privacy programme management experience. CIPM resists cramming more than any other IAPP exam.
A Note on the BoK v4.2.0 Update
The September 2026 BoK update introduced refinements to Domain III (particularly around AI and automated decision-making in operational workflows) and Domain VI (updated to reflect current privacy-enhancing technology standards). If you are using older study materials, these sections may be stale.
The Archuz CIPM Cram Guide is current to BoK v4.2.0 and flags where the September 2026 update changed content. You will know exactly what is new and why it matters for the exam.
Frequently Asked Questions
What are the six CIPM domains?
Privacy Programme Governance, Privacy Programme Framework, Privacy Programme Operational Lifecycle, Rights/Requests/Incidents, Metrics and Auditing, Privacy Technology and Security.
What is the heaviest domain on CIPM?
Domain II (Privacy Programme Framework), estimated at roughly 24% of the exam. Combined with Domain III (Operational Lifecycle, ~22%), these two domains account for nearly half the exam.
Does IAPP publish exact CIPM domain weights?
IAPP publishes the Body of Knowledge structure and relative weighting but does not publish exact per-domain question counts. The percentages in this article are informed estimates from the published BoK structure and candidate reports.
How long should I study for CIPM?
50–70 hours over 4–6 weeks for candidates with prior privacy law exposure (e.g. CIPP/E holders). 80–120 hours over 6–8 weeks for candidates coming to privacy from a technical, legal, or operational background without prior privacy focus.
What is in the CIPM BoK v4.2.0 update?
The September 2026 update refined Domain III on AI governance and automated decision-making in operational workflows, and Domain VI on privacy-enhancing technology standards. The overall domain structure is unchanged from v4.1.
Can I skip Domain V and VI on CIPM?
No. Together they account for roughly 19% of the exam. Light preparation is appropriate; skipping is not. The Archuz Cram Guide covers both domains efficiently in roughly 10–12% of total guide reading time.
How many case studies does the CIPM exam have?
IAPP does not publish exact counts. Candidate reports suggest 3–5 case study blocks per sitting, with each block containing 3–5 questions, for a total of 12–25 case-study questions out of 90.
What is the pass rate for CIPM?
IAPP does not publish pass rates. CIPM is generally regarded as neither the easiest nor the hardest IAPP exam; preparation quality matters more than the exam's inherent difficulty.
Scattered CIPM prep leads to scattered results on exam day.
Most candidates who pass committed to one structured path.
That's what this is.