CIPP/E is broader and more factual — it tests GDPR law across five domains and rewards memorisation. CIPM is narrower but harder to prepare for, because it tests applied judgment and resists memorisation. Most candidates who have sat both report that CIPM surprised them more. If you are stacking both, sit CIPP/E first: it builds the legal foundation CIPM assumes you have.
If you are deciding which IAPP exam to sit next — or planning to stack both — the CIPM vs CIPP/E question comes up constantly. The short answer is: they are not comparable in the way most people expect. One rewards knowing the law; the other rewards knowing how to run a programme that complies with it.
This article is a side-by-side breakdown of what each exam tests, who finds each one harder, and how to make the right choice for where you are in your career right now.
Side-by-Side: The Mechanics
| Factor | CIPP/E | CIPM |
|---|---|---|
| Questions | 90 | 90 |
| Time | 2.5 hours | 150 minutes (2.5 hours) |
| Domains | 5 | 6 |
| Focus | European privacy law (GDPR + ePrivacy) | Privacy programme management |
| Exam style | Scenario + law application | Case study + applied judgment |
| BoK version | v1.3.3 (Sep 2026) | v4.2.0 (Sep 2026) |
| Exam fee | $550 first cert / $375 subsequent | $550 first cert / $375 subsequent |
| Pass score | Not published (scaled) | Not published (scaled) |
| Retake wait | 30 days | 30 days |
| CPE required | 20 per 2 years | 20 per 2 years |
Same price. Same time. But the experience of sitting each exam is very different, and so is the preparation.
What CIPP/E Actually Tests
CIPP/E is a law exam with an operational layer. You need to know the GDPR — chapters, articles, recitals, supervisory authority powers — well enough to apply them to realistic workplace scenarios. The five domains are:
- European Data Protection Law and Regulation — EU legal landscape, GDPR structure, enforcement
- European Data Protection Law and Regulation (II: Data Protection Principles) — the heavy domain, up to 28 questions, covers lawful bases, consent, data subject rights, special categories
- Compliance with European Data Protection Law in Practice — DPO, records of processing, DPIAs, Privacy by Design, security
- International Data Transfers — adequacy, SCCs, BCRs, derogations, post-Schrems II landscape
- ePrivacy — ePrivacy Directive, cookies, direct marketing, PECR in the UK
Domain II carries up to 28 questions on its own — roughly 31% of your score from a single domain. You cannot pass CIPP/E without owning that domain.
The question format is scenario-based: here is a situation, which legal basis applies, is this lawful, what should the DPO do. The right answer is usually traceable to a specific GDPR provision. CIPP/E rewards candidates who can map situations to articles quickly.
What CIPM Actually Tests
CIPM does not test the law. It assumes you know it. What it tests is whether you can run a privacy programme — set it up, staff it, audit it, fix it, scale it, and explain it to the board. The six domains are:
- Privacy Programme Governance — roles, accountability, authority, board engagement
- Privacy Programme Framework — the heavy domain, covers data inventory, legal bases catalogue, notices, consent architecture
- Privacy Programme Operational Lifecycle — training, vendor management, PIAs/DPIAs, product review
- Responding to Rights, Requests, and Incidents — DSRs, breach response, regulatory inquiries
- Privacy Programme Metrics and Auditing — KPIs, internal audit, reporting
- Privacy Technology and Information Security — PETs, Privacy by Design, security intersection
The question format leans heavily on case studies — 18 across the Archuz CIPM Question Bank, spread across three sets. The traps are not about forgetting an article number. They are about choosing between four plausible management responses and picking the one that is operationally right, not just legally defensible.
The CIPM is harder than it looks if you studied frameworks but not the question style.
It's the credential that signals you can run a programme, not just advise on one.
Get the Complete Pack →Who Finds Each Exam Harder?
Legal professionals and lawyers
Tend to find CIPM harder. They are trained to identify the safest legal position, and CIPM often rewards the practical programme management response instead. The "lawyer's answer" distractor family is designed specifically to catch legal professionals.
Privacy practitioners and programme managers
Often find CIPP/E harder on the first pass, because the volume of legislation is large and the question format punishes vague recall. The GDPR has 99 articles and 173 recitals — more than most people realise until they start preparing.
Technologists and engineers moving into privacy
Find both exams challenging but for opposite reasons. CIPP/E's density of legal content is unfamiliar; CIPM's preference for process over technical controls can feel counterintuitive. The "technologist's answer" distractor on CIPM is designed for this group.
Experienced CIPP/E holders moving to CIPM
Have the easiest second-exam path. GDPR knowledge is already there; the lift is the mindset shift from legal application to programme management.
The Recommended Order: CIPP/E First
If you are building toward both, sit CIPP/E first. Three reasons:
- CIPM assumes a foundation in data protection law — you will keep seeing GDPR concepts framed as programme decisions
- The subsequent cert fee drops to $375, saving you $175 on the second exam
- CIPP/E study naturally teaches the regulatory landscape that CIPM treats as background knowledge
The Archuz Full Stack Bundle at $400 (saves $138 vs three separate packs) is sequenced in this order: CIPP/E → CIPM → AIGP. The sequencing is intentional, not just a convenient grouping.
Preparation Hours: Honest Benchmarks
- CIPP/E, no prior GDPR experience: 80–120 hours over 5–8 weeks
- CIPP/E, prior privacy experience: 50–80 hours over 4–6 weeks
- CIPM, no prior privacy experience: 80–120 hours over 6–8 weeks (unusual — CIPM typically comes after CIPP/E)
- CIPM, after CIPP/E: 50–70 hours over 4–6 weeks
- Both exams, from scratch: 150–200 hours total over 3–5 months
These are informed estimates from candidate reports, not IAPP-published figures. Add 20–30% if you are preparing while working full time with limited focused study windows.
Preparing for CIPM Specifically
Because CIPM tests applied judgment, the most useful prep is not reading the Body of Knowledge cover to cover. It is working through case studies, explaining your reasoning on each answer, and getting comfortable with the four distractor families (the lawyer's answer, the technologist's answer, the hero's answer, the absolute answer).
The Archuz CIPM Cram Guide (BoK v4.2.0) structures every domain from the programme manager's perspective and flags the distractor patterns in the annotated question set. The 300-question bank includes 18 case studies across three full sets of 100 — enough volume to build genuine pattern recognition before exam day.
Preparing for CIPP/E Specifically
CIPP/E preparation looks different because the exam itself is different. Three principles:
- Spend disproportionate time on Domain II (Data Protection Principles). Up to 28 questions means it decides your pass more than any other domain.
- Learn the GDPR structurally, not article by article. Know how Chapter 2 (principles), Chapter 3 (rights), Chapter 4 (controller/processor), and Chapter 5 (transfers) interlock.
- Scenario practice beats definitional review. Working through scenario questions with explanations teaches you to spot which article applies in a fact pattern, which is the actual exam skill.
The Archuz CIPP/E Complete Pack includes 300 questions, 220 of them scenario-type, with 18 scenario blocks that mirror the real exam's shared-scenario format.
Frequently Asked Questions
Which exam should I take first, CIPM or CIPP/E?
CIPP/E first. It builds the GDPR foundation that CIPM treats as background. You also get the subsequent-cert discount ($375 instead of $550) when you take CIPM second.
Is CIPM easier than CIPP/E?
Not for most candidates. CIPM feels narrower because it is one topical area (programme management) rather than a full legal regime, but the applied-judgment format and the case study blocks are harder to prepare for than CIPP/E's mostly knowledge-based questions.
Do I need to pass CIPP/E before taking CIPM?
No. There is no formal prerequisite. But the subject-matter dependency is real: CIPM questions reference GDPR concepts without defining them. Candidates who sit CIPM without prior CIPP/E study often need to add GDPR fundamentals to their prep.
Can I take both CIPM and CIPP/E at the same time?
Technically yes, you can book both. In practice, candidates who try to prepare for both simultaneously tend to perform worse on each than if they sequenced them. 4–6 weeks between sittings is more efficient.
How much does it cost to get both CIPM and CIPP/E?
$925 in exam fees ($550 first cert + $375 subsequent cert) plus IAPP membership and study materials. The Archuz Full Stack Bundle at $400 covers all three (CIPP/E + CIPM + AIGP) study packs and saves $140 vs buying separately.
Which is more valuable for a career in privacy, CIPM or CIPP/E?
CIPP/E is more widely recognised and often listed as a baseline requirement in European roles. CIPM differentiates you for programme management and DPO roles. For maximum career optionality, holding both is standard among senior privacy practitioners.
Are the IAPP exams open book?
No. Both CIPP/E and CIPM are closed-book, proctored exams. You cannot bring notes, references, or electronic devices into the testing room or into a remote proctored sitting.
What is a Full Stack Bundle in IAPP terms?
The Archuz Full Stack Bundle refers to the combined study pack covering CIPP/E, CIPM, and AIGP — the three most commonly stacked IAPP certifications in modern privacy careers. $400 for all three, versus $540 if purchased individually.