If you fail the CIPP/E, you can buy a discounted retake, about $375 compared with $550 for a first attempt, once your result posts, then rebook through Pearson VUE. IAPP doesn't publish a cap on attempts. Check the current Candidate Handbook for the minimum interval before you can sit again. Use your score report's domain breakdown to plan a focused 3–5 week recovery.
A failed CIPP/E attempt is more common than people admit, especially among candidates who know the GDPR from daily work but haven't practised exam-style questions. The second attempt is usually easier to plan, because your score report shows you where the points went.
CIPP/E retake facts
| Item | Detail |
|---|---|
| First attempt fee | $550 |
| Retake fee | About $375 (discounted; check the IAPP store) |
| When you can buy it | After your result appears in MyIAPP |
| Minimum interval | Set by IAPP; confirm it in the current Candidate Handbook |
| Attempt cap | None published |
| Item review | Not available; you get a domain-level score report |
Step 1: Read your score report
- Your scaled score. 300 is the pass mark. A score in the high 200s usually needs a few targeted weeks. A much lower score means you should rebuild your plan from the BoK.
- Your domain results. Domains II and III together carry more than half the scored questions under BoK v1.3.3, so weakness there matters most.
- Don't average the domain percentages. They're based on different numbers of questions.
Step 2: Diagnose the cause
| Pattern | Likely cause | Fix |
|---|---|---|
| Weak Domain II or III | Article-level gaps on scope, principles, bases or rights | Re-read the core articles and drill scenario questions |
| Weak Domain IV | Transfers, DPIAs, DPOs, enforcement | Build comparison tables: transfer tools, the one-stop-shop, fine tiers |
| Weak Domain I | Institutions and history | Short, memorisation-friendly review |
| Weak Domain V | Applied topics: employment, marketing, cookies | Scenario practice; ePrivacy Article 5(3) |
| Ran out of time | Pacing | Timed sets of 45 questions in 75 minutes |
Step 3: A 4-week recovery plan
- Week 1: Your weakest domain. Re-study the BoK topics and do 60–80 targeted questions with full review.
- Week 2: Your second-weakest domain, using the same method. Update your error log.
- Week 3: A fresh 90-question timed mock. Review it by error type: knowledge gap, misreading or distractor.
- Week 4: Cram sheets, targeted sets, and rest before the exam. See the CIPP/E last-7-days cram guide.
Common reasons experienced practitioners fail
- Answering from company practice instead of the law. The exam asks what the GDPR requires, not what your organisation does.
- Confusing similar articles, such as Article 13 and 14 information duties, Articles 33 and 34 on breach notification, or Article 26 joint controllers and Article 28 processors.
- Thin coverage of Domain I and the ePrivacy Directive.
- Ignoring EDPB guidance listed in BoK v1.3.3, such as Guidelines 1/2024 on legitimate interest.
See the hardest GDPR concepts on the CIPP/E.
A retake practice question (original Archuz item)
A Dutch hospital's processor suffers a ransomware attack that encrypts patient records. The data wasn't exfiltrated, and backups restore it within 24 hours. What notification duties apply to the hospital?
- None, because no data was stolen
- Assess the risk. A loss of availability is a personal data breach, so notify the supervisory authority within 72 hours unless it's unlikely to result in a risk, record it internally either way, and notify patients if there's a high risk
- Notify all patients immediately in every case
- Only the processor must notify
Answer: B. A temporary loss of availability is a breach under the GDPR. Whether to notify depends on the risk assessment, and internal recording under Article 33(5) is always required. The processor must notify the controller without undue delay.
Domain-by-domain fixes
| Weak domain on your report | Likely cause | Fix |
|---|---|---|
| I. Introduction | Confusing EU and Council of Europe instruments; institutions and the legislative process | Build a one-page map of sources and institutions; 30 targeted questions |
| II. Law and regulation | Imprecise definitions, scope, principles; controller vs processor confusion | Re-read Articles 2–5 and 24–28 directly; Article 3 scenarios; a controller/processor flowchart |
| III. Processing | Lawful bases, special categories, information duties and rights | Comparison tables (Articles 6 vs 9, 13 vs 14); rights deadlines and exemptions |
| IV. Scope and accountability | DPIA triggers, DPO rules, breach notification, transfers, supervisory powers | DPIA criteria; Articles 33 vs 34; transfer mechanism hierarchy; Article 58 powers table; lead authority flowchart |
| V. Compliance | Applying rules to employment, surveillance, marketing, cookies and AI | Scenario practice; ePrivacy cookie and marketing rules; employee monitoring guidance |
Changing how you study, not just how long
- If you mostly read: switch to question-led study. Do questions first, then read only what you got wrong.
- If you did lots of questions: slow down. Write a one-line reason for every wrong answer.
- If you ran out of time: practise in timed blocks of 45 questions and use the flag-and-return method.
- If you knew the law but chose wrong: practise reading the question stem for the qualifier (first, best, most likely, except) and the role you're playing.
Retake cost compared
| First attempt | Retake (reported) | |
|---|---|---|
| CIPP/E | $550 | About $375 |
| CIPM, CIPP/US, CIPT | $550 | About $375 |
| AIGP | $649 / $799 | About $475 (member) |
Confirm current prices in the IAPP store before you buy. Retake vouchers, like first-attempt vouchers, must be used within a year.
Before you rebook
- Your fresh mock score is at least 75%
- Your weakest domain is within about 10 points of your average
- Your error log shows fewer misread-qualifier mistakes
- You've reviewed Domain I and the ePrivacy Directive, which are common blind spots
Fresh questions for the second attempt
The CIPP/E Complete Pack's 300 BoK v1.3.3 questions (220 scenario-based) and Cram Guide are built for exactly this kind of targeted recovery.
Get the Complete PackFrequently asked questions
How much does a CIPP/E retake cost?
About $375 at the time of writing, compared with $550 for a first attempt. Check the IAPP store for the current price.
How soon can I retake the CIPP/E?
You can buy a retake once your result posts. The minimum interval before sitting again is set out in IAPP's Candidate Handbook.
How many times can I take the CIPP/E?
IAPP doesn't publish a limit. Each attempt is a separate purchase.
Can I see my wrong answers?
No. IAPP provides domain-level results, not item-level feedback.
What should I change after failing the CIPP/E?
Your method, not just your hours. Use your score report to target weak domains, switch to question-led study if you mostly read, review explanations more deeply if you did lots of questions, and practise timing if you ran short.
Is the CIPP/E retake the same exam?
Expect a different exam form with the same blueprint, format and passing score.
Sources
- IAPP Store: CIPP/E Exam
- IAPP Certification FAQs
- Privacy Bootcamp: What Are the Costs of IAPP Certification? (retake pricing)
Last reviewed: October 2026.