Yes, you can pass the CIPP/E without a law degree. There are no prerequisites, and many successful candidates come from compliance, IT, security, HR, marketing and operations. Non-lawyers usually find three things hardest: EU institutions and sources of law, reading legal text precisely, and applying exceptions and conditions (lawful bases, Article 9 conditions, transfer mechanisms). Plan for 40–70 hours (the IAPP recommends at least 30), learn the structure of the GDPR first, and practise scenario questions early.
What non-lawyers find hard, and how to fix it
| Challenge | Fix |
|---|---|
| EU institutions and legal instruments | Learn a one-page map: Commission, Parliament, Council, CJEU; regulations vs directives; Council of Europe and the ECHR as separate from the EU |
| Legal vocabulary | Keep a glossary: controller, processor, lawful basis, adequacy, supervisory authority, lead authority, binding corporate rules |
| Precise reading | Notice "and" versus "or", "shall" versus "may", and exceptions ("unless", "where") |
| Case law | Learn the key point of each landmark case (e.g. Google Spain, Schrems I and II) rather than the full judgment |
| Applying rules to scenarios | Practise questions from week 2, not just at the end |
Concepts to master first
- Scope: material scope (Art. 2) and territorial scope (Art. 3).
- Key definitions (Art. 4): personal data, processing, controller, processor, consent.
- Principles (Art. 5) and lawful bases (Art. 6).
- Special category data (Art. 9).
- Data subject rights (Arts 12–22).
- Accountability: DPIAs (Art. 35), DPOs (Arts 37–39), records (Art. 30).
- Breach notification (Arts 33–34).
- International transfers (Chapter V).
- Supervision and enforcement: one-stop shop, EDPB, fines (Art. 83).
Plain-English CIPP/E prep
The CIPP/E Complete Pack includes a Cram Guide, 300 practice questions with explanations and an After You Pass guide.
Get the Complete PackA six-week plan
| Week | Focus |
|---|---|
| 1 | EU institutions, history (Directive 95/46/EC, ECHR Art. 8, Charter Arts 7–8), the structure of the GDPR |
| 2 | Definitions, principles, lawful bases, special categories. Start practice questions |
| 3 | Rights and controller/processor obligations |
| 4 | Transfers, supervision, enforcement, fines |
| 5 | Related EU law: ePrivacy, the AI Act and other digital laws in the BoK. Employment, surveillance, marketing |
| 6 | Full timed practice, weak areas, cram |
Study tips
- Read the GDPR's recitals for context only where a topic confuses you. You don't need to memorise them.
- Draw diagrams for transfers and for the one-stop-shop mechanism.
- Explain each article in one sentence of plain English.
- Focus on the high-yield articles. See GDPR articles on the exam and the hardest GDPR concepts.
Full plan: CIPP/E study guide. Timing: how many hours to study.
A one-page map of EU sources
| Source | What to remember |
|---|---|
| European Convention on Human Rights (Art. 8) | Council of Europe, not the EU. Right to private life. Enforced by the European Court of Human Rights |
| Convention 108 (and 108+) | Council of Europe's data protection treaty |
| EU Charter of Fundamental Rights (Arts 7–8) | Private life and protection of personal data as separate rights |
| Directive 95/46/EC | The GDPR's predecessor, repealed in 2018 |
| GDPR (Regulation 2016/679) | Directly applicable since 25 May 2018 |
| ePrivacy Directive | Cookies and electronic communications, implemented by national laws |
| CJEU | The EU court that interprets EU law, such as Schrems II |
Most non-lawyer mistakes on early practice tests come from mixing up the Council of Europe and the EU, or regulations and directives. Ten minutes with this table fixes most of them.
Reading a GDPR article: a worked example
Article 6(1) says processing is lawful "only if and to the extent that at least one of the following applies". Three things to notice:
- "Only if": without a lawful basis, processing is unlawful. There's no default permission.
- "To the extent that": the basis must cover each purpose. One basis for marketing doesn't cover HR processing.
- "At least one": you need one basis per purpose; you don't need all six.
Reading this closely is how you spot wrong answers that say "the controller needs consent for all processing" or "legitimate interest covers everything".
Glossary for non-lawyers
| Term | Plain meaning |
|---|---|
| Regulation | EU law that applies directly in all member states (the GDPR) |
| Directive | EU law that member states must implement in national law (ePrivacy) |
| Recital | An explanatory paragraph at the start of an EU law; helps interpretation but isn't binding on its own |
| Lex specialis | A more specific law that takes priority over a general one on the same point |
| Adequacy decision | A Commission decision that a non-EU country protects data adequately |
Frequently asked questions
Do you need a law degree for the CIPP/E?
No. There are no prerequisites, and many CIPP/E holders aren't lawyers.
Is the CIPP/E hard for non-lawyers?
It can be challenging at first because of legal terms and EU institutions, but with structured study and practice questions, non-lawyers pass regularly.
How long should a non-lawyer study for the CIPP/E?
Typically 40–70 hours. The IAPP recommends at least 30.
What is the difference between a regulation and a directive?
A regulation, like the GDPR, applies directly in every EU member state. A directive, like the ePrivacy Directive, sets goals that each member state must implement through its own national law.
Sources
Last reviewed: October 2026.