The GDPR has 99 articles and 173 recitals. The CIPP/E exam draws heavily from maybe 25–30 of them. Know Arts. 5–11 (principles and lawfulness) cold. Know Arts. 12–23 (data subject rights) well enough to distinguish them. Know Arts. 24–43 (controller/processor obligations and DPO/DPIA/breach) for scenario questions. Know Arts. 44–49 (transfers) with precision. Everything else is context.
This is not a complete GDPR reference. It is the exam-focused cram sheet: the articles that appear most often, what the exam tests from each one, and which details you actually need to memorise versus understand in outline.
Use it in your final two weeks before the exam. In the final 48 hours, read through this list and for any article where you cannot immediately state what the exam tests from it, open the Cram Guide chapter and re-read that section.
Tier 1: Must Know Cold
These articles appear in some form on virtually every CIPP/E sitting. If you do not own these, you are losing points on the most common question types.
Definitions
Personal data, processing, controller, processor, consent, pseudonymisation, special categories, third party, biometric data. The exam frequently hinges on whether a definition applies — know the precise wording of the key terms.
Principles of Processing
All seven principles (lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality, accountability). Scenario questions describe a processing activity and ask which principle is being violated. Know each principle well enough to spot the violation.
Lawful Bases for Processing
All six lawful bases: consent (6(1)(a)), contract (6(1)(b)), legal obligation (6(1)(c)), vital interests (6(1)(d)), public task (6(1)(e)), legitimate interests (6(1)(f)). The exam frequently gives a scenario and asks which basis applies — or whether the organisation has one at all. Consent vs legitimate interests is the most common point of confusion.
Knowing GDPR gets you into the CIPP/E. Applying it is what gets you through.
Understanding why wrong answers are wrong matters more than memorising right ones.
Get the Complete Pack →Conditions for Consent
What makes consent valid: freely given, specific, informed, unambiguous, separable from other terms, withdrawable without detriment. The exam tests all of these conditions — often by describing consent that is almost valid but fails on one criterion.
Child's Consent for Information Society Services
Default age 16; member states can lower to 13. Parental consent required below the specified age. The exam tests both the default and member-state variation.
Special Categories of Personal Data
The complete list (racial/ethnic origin, political opinions, religious/philosophical beliefs, trade union membership, genetic, biometric for ID, health, sex life/orientation) and all ten processing bases in Art. 9(2). The exam tests whether something qualifies as a special category AND which 9(2) basis permits its processing.
Criminal Convictions and Offences
Separate from Art. 9. Can only be processed under control of official authority or when authorised by EU/member state law. Commonly tested as a quick fact in scenario questions.
Data Subject Rights (All Eight)
Transparency (12), access (15), rectification (16), erasure (17), restriction (18), portability (20), object (21), automated decision-making (22). Know the one-month response window (extendable by two months), when rights can be refused, and which rights do not apply in every situation (portability only applies to 6(1)(a) and (b) processing; erasure has specific exemptions).
Tier 2: Know Well for Scenario Questions
Transparency and Privacy Notices
Information required at collection (Art. 13) vs. not-at-collection (Art. 14). Exam questions test what must be included in a privacy notice and when the notice obligation is triggered. The exemptions in Art. 14(5) matter — disproportionate effort, legal obligation.
Responsibility of the Controller
The accountability principle in operational form. Controllers must implement appropriate technical and organisational measures to ensure and demonstrate compliance.
Data Protection by Design and by Default
The principle and what it requires in practice. Scenario questions typically describe a product launch and ask how DPbD applies or whether it has been satisfied.
Joint Controllers
When two entities jointly determine purposes and means. Requires a transparent arrangement; data subjects can exercise rights against either controller.
Processor Obligations and DPAs
What must be in a data processing agreement. The exam distinguishes controller-to-processor (Art. 28) from controller-to-controller (no DPA required, but transfer mechanism may be). Sub-processor rules in Art. 28(2) also tested.
Records of Processing Activities (RoPA)
What controllers and processors must maintain. The 250-employee threshold with carve-outs (regular, risky, or special categories processing still requires RoPA). Exam questions test the threshold and the content requirements.
Security of Processing
Appropriate technical and organisational measures. Examples listed (pseudonymisation, encryption, confidentiality/integrity/availability, testing). Risk-based approach — not prescriptive.
Breach Notification
72-hour notification to supervisory authority (Art. 33) unless the breach is unlikely to result in a risk to rights and freedoms. Communication to data subjects when high risk (Art. 34). The exam tests both timeframes and the conditions that trigger each obligation.
Data Protection Impact Assessments
When a DPIA is mandatory (three criteria: systematic and extensive profiling, large-scale special categories processing, systematic monitoring of publicly accessible areas). When to consult the supervisory authority (Art. 36). Know the three triggers cold.
Data Protection Officer
When mandatory (public authority, core activities = regular/systematic/large-scale monitoring, core activities = large-scale special categories), DPO independence requirements, DPO tasks. Expect at least one or two DPO-specific questions.
Tier 3: Know for Transfer Questions
General Principle for Transfers
All transfers of personal data outside the EU/EEA require a legal basis under Chapter V. No "default" freedom to transfer.
Adequacy Decisions
How the Commission designates third countries as providing an adequate level of protection. Current list of adequacy decisions matters — UK, Switzerland, Japan, Canada (commercial), etc. The EU-US Data Privacy Framework falls here.
Appropriate Safeguards
SCCs (Standard Contractual Clauses), BCRs, approved codes of conduct, certification. The exam tests which mechanism applies in a given scenario.
Binding Corporate Rules
For intra-group transfers in multinational organisations. Must be approved by competent supervisory authority. Content requirements in Art. 47(2).
Derogations for Specific Situations
Explicit consent, contract performance, important public interest, legal claims, vital interests, public register access. Only for occasional transfers — not a routine mechanism.
Tier 4: Supporting Articles
These matter less often but have appeared on sittings. A quick familiarity is enough.
- Art. 2–3: Material and territorial scope. Art. 3 is tested on extraterritorial reach.
- Art. 51–59: Independent supervisory authorities, powers, tasks.
- Art. 60–63: One-stop shop, cooperation, consistency mechanism.
- Art. 77–82: Right to lodge complaints, judicial remedy, compensation.
- Art. 83: General conditions for administrative fines. Two-tier fine structure (2%/€10M vs 4%/€20M).
Knowing GDPR gets you into the CIPP/E. Applying it is what gets you through.
Understanding why wrong answers are wrong matters more than memorising right ones.
Get the Complete Pack →How to Use This Cram Sheet
This cram sheet is designed to be read alongside the Archuz CIPP/E Cram Guide, not instead of it. The Cram Guide provides the context, examples, and annotated practice questions that make these articles stick. The cram sheet is the high-priority checklist for the final days before your exam.
Progressive compression method:
- Two weeks out: read every tier, open the Cram Guide for anything shaky.
- One week out: read Tier 1 and Tier 2 only, confirm the basics.
- Final 48 hours: read Tier 1 only, confirm you can state what the exam tests from each.
- Final 24 hours: no new material, trust the preparation, logistics and rest only.
Frequently Asked Questions
How many GDPR articles do I need to memorise for CIPP/E?
Roughly 25–30 articles get repeated attention on CIPP/E. Tier 1 and Tier 2 above cover the core. You do not need to recite every article from memory — you need to know what each one tests on the exam and how it applies in scenario fact patterns.
Does CIPP/E test recital numbers?
Rarely. Recitals support the article interpretation but are not usually tested as free-standing numbers. The exception: Recital 32 (consent) and Recital 47 (legitimate interests balancing) occasionally appear in explanations.
Is the ePrivacy Directive tested as articles on CIPP/E?
Less than GDPR, but yes — Articles 5(3) (cookies/consent) and the direct marketing provisions appear regularly. Domain V (ePrivacy) carries 8–12 of 90 questions.
Which GDPR articles are tested most heavily on CIPP/E?
Arts. 5, 6, 7, 9, and 12–22 (principles, lawful bases, special categories, data subject rights). Together they anchor Domain II, which carries up to 28 of 90 questions.
Do I need to know GDPR by heart to pass CIPP/E?
No. You need to know the structure and the specific tested-article content well enough to apply it in scenario questions. Verbatim recitation is not required.
What is the Archuz CIPP/E Cram Guide?
A structured exam-focused study guide current to IAPP CIPP/E BoK v1.3.3 (September 2026). Covers every CIPP/E domain with annotated references to the specific GDPR articles above and to the 300-question bank in the Complete Pack.
How is the GDPR structured?
99 articles across 11 chapters: General Provisions, Principles, Rights, Controller/Processor, Transfers, Independent Supervisory Authorities, Cooperation and Consistency, Remedies and Penalties, Specific Processing Situations, Delegated Acts, Final Provisions. CIPP/E tests from Chapters 1–8 heavily, 9–11 lightly.
Can I bring a GDPR text into the exam?
No. CIPP/E is closed-book. No notes, references, or electronic devices in the testing room or on a remote proctored sitting.