In the last week before the CIPP/E, stop learning new material. Spend days 7–5 repairing your two weakest areas, day 4 on one full timed mock, days 3–2 on the high-frequency numbers and scenario patterns below, and the day before on light review and rest. The exam rewards applying the GDPR to facts, so your final practice should be scenario questions, not reading.
The last week is where a lot of CIPP/E candidates lose a pass they'd already earned. They panic, open a new textbook, start a second course, or cram article numbers until 2 a.m. None of that helps on an exam that asks you to apply the GDPR to a messy fact pattern under time pressure.
This guide assumes you've already covered the syllabus. If you haven't, start with our 8-week CIPP/E study guide and move your exam date — rescheduling is free inside the allowed window, while a retake is USD 375.
The 7-Day Plan
Take 40 mixed scenario questions, timed at about 100 seconds each. Sort every miss by topic. Your two weakest topics are the plan for days 6 and 5. Don't study anything else today.
For most candidates this is international transfers or lawful bases. Re-read the relevant GDPR articles and recitals, then do 25 questions on that topic only. Write a one-line rule for each miss.
Same method on your second weakest area — often controller/processor roles or Article 22. 25 targeted questions, one-line rules for every miss.
One full 90-question mock in 2.5 hours, at the time of day your exam is booked. Take the break at the halfway point as you would on the day. Then review every question — including the ones you got right by guessing.
Learn the table below until you can recall it without looking. Then 30 mixed questions to check it sticks in context.
Work through the five patterns further down. For each, do five questions that match it. Re-read your one-line rules from days 5 and 6.
One hour maximum: your one-line rules and the numbers table. Confirm your appointment, ID, and — if testing online — run the system check. Then stop. Sleep is worth more than another hour of review.
The Numbers You Must Know Cold
The CIPP/E rarely asks for a number on its own, but the right answer to a scenario often depends on one. These come up again and again.
| Rule | The number | GDPR reference |
|---|---|---|
| Breach notification to the supervisory authority | Within 72 hours of becoming aware, where there's a risk to rights and freedoms | Art. 33 |
| Breach notification to individuals | Without undue delay, where the risk is high | Art. 34 |
| Processor informing controller of a breach | Without undue delay | Art. 33(2) |
| Responding to a data subject request | One month, extendable by two further months | Art. 12(3) |
| Age for children's consent to online services | 16 by default; member states may set as low as 13 | Art. 8 |
| Lower fine tier | Up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher | Art. 83(4) |
| Upper fine tier | Up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher | Art. 83(5) |
| Records of processing exemption | Organisations under 250 employees — but only if processing is occasional, low-risk and excludes special category or criminal data | Art. 30(5) |
| Prior consultation after a DPIA | Authority responds within 8 weeks, extendable by 6 | Art. 36(2) |
| Lawful bases | Six | Art. 6(1) |
| Principles | Seven (including accountability) | Art. 5 |
The Article 30 "under 250 employees" exemption is almost never available in exam scenarios, because it disappears the moment processing is not occasional, is likely to result in a risk, or includes special category or criminal data. If a question offers it as the answer, read the facts again.
The Five Scenario Patterns the CIPP/E Keeps Repeating
1. "Which lawful basis applies?"
Work through it in order: is the processing genuinely necessary for a contract with this person? Is there a legal obligation? Is it a public authority task? If none fits, is there a legitimate interest that survives the balancing test? Consent is often the trap answer — it's rarely appropriate in employment or where the person has no real choice. For special category data, you need an Article 9(2) condition as well, and legitimate interests is never enough on its own.
2. "Who is the controller?"
Ask who decides why the data is processed. Whoever decides the purpose is a controller. Two parties deciding it together are joint controllers (Art. 26). A party acting only on documented instructions is a processor (Art. 28) — until it uses the data for its own purposes, at which point it becomes a controller for that processing.
3. "Can this transfer go ahead?"
Apply the hierarchy: adequacy decision (Art. 45) → appropriate safeguards such as standard contractual clauses or binding corporate rules (Art. 46–47) → derogations (Art. 49) only as a last resort. If SCCs are available, a derogation is almost always the wrong answer.
4. "Does Article 22 apply?"
Two tests, both required: is the decision based solely on automated processing, and does it produce legal or similarly significant effects? Meaningful human review takes it outside Article 22. An objection to profiling that isn't a solely automated decision is usually an Article 21 question instead.
5. "Do we have to notify?"
Risk to rights and freedoms → notify the authority within 72 hours. High risk → also notify individuals, unless an exception applies (for example, the data was encrypted and the key wasn't compromised). No risk → no notification, but you still document the breach internally under Article 33(5).
For worked examples of each pattern, see the GDPR concepts that cost CIPP/E candidates the most points.
One week out from the CIPP/E and still scattered?
\nThe final week tends to determine the result more than everything before it.
\n Get the Complete Pack →\nFour Practice Questions to Test Yourself
One for each of the highest-frequency patterns. Answer before opening the explanation.
Question 1 — Breach notification
A French online retailer uses a cloud provider to host its customer database. On a Friday evening, the cloud provider discovers that an attacker accessed customer names, email addresses and hashed passwords. The provider tells the retailer on Saturday morning. Which statement best describes the notification obligation to the CNIL?
Show answer
B. Notification to the supervisory authority is the controller's duty under Article 33(1), and the 72 hours run from when the controller becomes aware. The processor's duty under Article 33(2) is to inform the controller without undue delay — not the authority (A). C uses the wrong trigger. D is wrong because names and email addresses were also exposed; hashing reduces the risk from the passwords but doesn't remove the risk to individuals.
Question 2 — Territorial scope
A US fitness app company has no offices or staff in the EU. It lists its app in the German app store with a German-language interface and prices in euros, and the app tracks users' running routes. Does the GDPR apply to its processing of German users' data?
Show answer
C. Article 3(2) applies the GDPR to controllers outside the EU that offer goods or services to people in the EU (German language and euro pricing are indicators) or monitor their behaviour in the EU (route tracking). Both limbs are met. A ignores Article 3(2). B reverses cause and effect — the representative obligation under Article 27 follows from being in scope. D is wrong because the GDPR protects people in the EU, regardless of citizenship.
Question 3 — Lawful basis in employment
A Dutch company wants to monitor employees' work email for data leakage. HR proposes adding a consent clause to all employment contracts. What is the most appropriate lawful basis?
Show answer
B. Consent is rarely valid in employment because of the imbalance of power — employees can't freely refuse — and bundling it into a contract makes it worse (A). Vital interests is for protecting someone's life (C), and public task is for official functions laid down in law (D). Legitimate interests can work if the monitoring is necessary, proportionate and passes the balancing test, which is why an LIA and transparency are part of the answer.
Question 4 — International transfers
An Irish company wants to send customer support tickets containing personal data to a service provider in a country without an EU adequacy decision. The provider is willing to sign whatever contract is required. What should the company rely on?
Show answer
B. With no adequacy decision, the next step in the hierarchy is appropriate safeguards under Article 46, and SCCs are available because the provider will sign. Post-Schrems II, a transfer impact assessment checks the destination's laws don't undermine them. Article 49 derogations are for exceptional, occasional cases (A). Encryption in transit is a security measure, not a transfer mechanism (C). BCRs only cover transfers within a corporate group (D).
Want more in this format? Our CIPP/E difficulty analysis has six more, and the question bank guide explains how many you need before the exam.
What Not to Do in the Last Week
- Don't start a new resource. A new textbook or course in the final week mostly creates doubt about things you already know.
- Don't drill article numbers in isolation. Knowing that consent is Article 7 won't help if you can't tell when consent is invalid.
- Don't keep taking full mocks. One in the final week is enough. Reviewing it thoroughly is worth more than taking a second.
- Don't read your score as a pass/fail prediction. Practice scores vary across question banks. Your trend and your weakest topics matter more than one number.
Exam Day: The Practical Checklist
- Arrive or check in early. For online proctoring, you'll need a quiet room, a clear desk and valid ID. For a test centre, allow time for check-in.
- Pace yourself. 90 questions in 150 minutes is about 100 seconds per question. Flag anything taking longer than two minutes and come back to it.
- Take the break. The IAPP candidate handbook says you'll be offered a 15-minute break halfway through. Use it.
- Read the last sentence first. In long scenarios, read the actual question before the facts so you know what you're looking for.
- Watch for multi-select questions. IAPP exams include questions with more than one correct answer, and the exam tells you when that's the case.
- Don't leave blanks. There's no penalty for a wrong answer, so answer every question before time runs out.
- Remember 15 questions don't count. 75 of the 90 questions are scored. If a question seems strange or off-syllabus, it may be unscored — answer it and move on.
Your result appears on screen when you finish, and the IAPP says it can take up to two business days to show in your IAPP account. If you're also planning your next credential, our guide to CIPP/E vs CIPM helps decide what comes next.
Frequently Asked Questions
What should I study the week before the CIPP/E?
Focus on your two weakest topics, take one full timed mock, then review high-frequency GDPR numbers and the common scenario patterns: lawful basis, controller and processor roles, transfers, Article 22 and breach notification. Avoid starting new material.
How many questions are on the CIPP/E and how long is it?
The CIPP/E has 90 multiple-choice questions, 75 of them scored, with 2.5 hours to complete it. It's scored on a 100–500 scale and 300 is the passing score.
Is there a break during the CIPP/E exam?
Yes. According to the IAPP candidate handbook, candidates are offered a 15-minute break halfway through the exam.
Should I cram the night before the CIPP/E?
Keep it to about an hour of light review — your notes on past mistakes and the key numbers — then rest. The exam tests applied judgement, which suffers more from tiredness than from one less hour of revision.
When do I get my CIPP/E results?
Results are shown immediately after you finish the exam, unless the IAPP tells you otherwise. They can take up to two business days to appear in your IAPP account.