Take the CIPP/E first if you're new to privacy, work with EU personal data, or are heading for legal or advisory roles, because it gives you the legal foundation the CIPM assumes. Take the CIPM first if you already know the law and your job is running or building a privacy programme, or if you work outside Europe and need a jurisdiction-neutral credential. Many privacy leaders hold both.
The CIPP/E and the CIPM are IAPP's most popular combination. They're designed to complement each other: one covers what the law requires and the other covers how an organisation delivers it. The right order depends on your current role and where you want to go next.
CIPP/E vs CIPM at a glance
| CIPP/E | CIPM | |
|---|---|---|
| Focus | European data protection law (GDPR, ePrivacy, institutions) | Privacy programme management (governance, operations) |
| Jurisdiction | EU | Jurisdiction-neutral |
| Current BoK | v1.3.3 (5 domains) | v4.2.0 (6 domains) |
| Format | 90 Qs, 2.5 h + break | 90 Qs, 2.5 h + break |
| Question style | Applying legal rules to scenarios | Management decisions in scenarios and case studies |
| Fee | $550 | $550 |
| Languages | English, German, French | English, German, French, Chinese, Brazilian Portuguese |
| Typical roles | Privacy counsel, DPO, privacy analyst, consultant | Privacy programme manager, head of privacy, DPO, privacy operations |
Decision guide by role
| Your situation | Take first |
|---|---|
| New to privacy | CIPP/E: build the legal vocabulary first |
| Lawyer or legal adviser | CIPP/E, then CIPM if you move into programme leadership |
| Privacy programme manager, privacy operations | CIPM |
| DPO | Either; most DPOs eventually hold both |
| Security, GRC or compliance professional moving into privacy | CIPM if you already know frameworks; CIPP/E if EU law is new to you |
| Outside Europe, no EU data | CIPM (or your regional CIPP) |
Why the CIPP/E-then-CIPM order is common
- CIPM questions assume you understand concepts such as lawful bases, DPIAs, data subject rights and breach notification. The CIPP/E teaches them in depth.
- Having just passed the CIPP/E, you'll find parts of the CIPM's Domains III and VI (assessments, requests and incidents) familiar.
- The pairing signals that you can interpret the law and operationalise it.
When CIPM first makes more sense
- Your job is already programme management and you need credibility in that role quickly.
- You work across several jurisdictions and don't want to specialise in EU law yet.
- You want to sit the exam in Chinese or Brazilian Portuguese.
Which is harder?
It depends on your background. Lawyers often find the CIPM's management framing less intuitive, and operational people find the CIPP/E's legal precision harder. IAPP doesn't publish pass rates for either. See CIPM vs CIPP/E: which is harder?
Where the AIGP fits
If your career is moving towards AI governance, a common path is CIPP/E, then CIPM, then AIGP, or CIPP/E then AIGP. See is the full AIGP + CIPM + CIPP/E stack worth it?
A realistic two-exam timeline
| Month | Activity |
|---|---|
| 1–2 | CIPP/E study (40–60 hours) |
| 2 | Sit the CIPP/E |
| 3 | Short break; activate the credential; begin CIPM reading |
| 3–4 | CIPM study (35–50 hours, less thanks to the overlap) |
| 4–5 | Sit the CIPM |
Where the two exams overlap
- DPIAs and privacy impact assessments: legal triggers (CIPP/E) and process (CIPM)
- Data subject rights: legal requirements (CIPP/E) and the operational workflow (CIPM)
- Breach notification: legal thresholds and deadlines (CIPP/E) and the incident response process (CIPM)
- Processor and vendor management: Article 28 terms (CIPP/E) and the vendor lifecycle (CIPM)
- The DPO role: legal requirements (CIPP/E) and governance structures (CIPM)
Studying them close together reinforces both. Just be ready for the different question styles.
Planning both? Save with the bundle
Each Complete Pack includes a Cram Guide, a 300-question bank and an After You Pass guide. The Full Stack Bundle adds the AIGP for $400 in total.
Get the Complete PackWhat a typical question looks like on each exam
Two original questions on the same topic show how differently the exams think.
CIPP/E style: A controller suffers a breach of customer passwords that were properly encrypted, and the key wasn't compromised. Must it notify affected individuals?
Answer: Generally no, because Article 34(3)(a) exempts communication to individuals where appropriate protection such as encryption makes the data unintelligible. The controller should still assess whether to notify the authority and must document the breach.
CIPM style: After a breach, what is the most useful step to prevent a repeat?
Answer: A root-cause analysis followed by updated controls, training and the incident response plan, with metrics to check the fix works.
The CIPP/E asks what the law requires. The CIPM asks what a privacy manager should do.
Cost and maintenance for both
| CIPP/E | CIPM | |
|---|---|---|
| Exam fee | $550 | $550 |
| Retake (reported) | About $375 | About $375 |
| Languages | English, German, French | English, German, French, Chinese, Brazilian Portuguese |
| Maintenance | 20 CPE + $250 per 2 years (fee included in membership) | 20 CPE + $250 per 2 years (fee included in membership) |
With two certifications, IAPP membership (about $295 a year) usually costs less than paying two maintenance fees, and relevant CPE can count toward both.
Signals that you should take the CIPM first
- You already run privacy operations: DSARs, vendor reviews, training, assessments.
- You're aiming for a privacy programme manager role rather than legal advice.
- You work across several jurisdictions and need a jurisdiction-neutral credential.
- You plan to add the AIGP and want programme management skills that transfer to AI governance.
Signals that you should take the CIPP/E first
- You're new to privacy and need the legal foundations.
- Your target role is DPO, privacy counsel or GDPR consultant.
- Your employer or clients ask specifically for GDPR expertise.
- You want the strongest base for the EU AI Act parts of the AIGP.
Frequently asked questions
Should I take the CIPP/E or CIPM first?
Most people take the CIPP/E first for the legal foundation. Take the CIPM first if you already know the law and manage a privacy programme.
Is the CIPM worth it without a CIPP?
Yes, especially for programme managers and people outside Europe. It's jurisdiction-neutral.
Can I study for the CIPP/E and CIPM together?
It's possible, but most candidates do better sitting them a few weeks or months apart, because the question styles differ.
Do the CIPP/E and CIPM cost the same?
Yes, $550 each.
Can I take the CIPM without knowing the GDPR?
Yes. The CIPM is jurisdiction-neutral and tests privacy programme management. General awareness of common legal requirements helps, but you don't need deep GDPR knowledge.
Which is more useful for a DPO, the CIPP/E or the CIPM?
Both. The CIPP/E covers the legal knowledge a DPO needs; the CIPM covers running the programme. Many DPOs hold both, often starting with the CIPP/E.
Sources
Last reviewed: October 2026.