In your last week before the CIPM, don't add new content. Use days 7–5 to fix your weakest programme areas, day 4 for one full timed mock, days 3–2 to lock in the decision rules and assessment-tool distinctions below, and day 1 for light review and logistics. The CIPM rewards choosing the right next step for a given organisation, so your final practice should be case studies, not reading.
The CIPM is an exam about sequence and judgement. Most questions describe an organisation, a problem and four actions — usually all reasonable — and ask what the privacy manager should do first, next or best. In the final week, you're not trying to know more. You're trying to make those calls faster and more consistently.
If you haven't covered the full syllabus yet, start with our CIPM study guide and consider moving your date.
The 7-Day Plan
40 mixed questions, including at least two case studies, at about 100 seconds per question. Sort every miss by area: governance, assess, protect, sustain, or requests and incidents. Your two weakest areas are days 6 and 5.
Re-read only that area. For each concept, write who owns it, when it happens and what it produces. Then 25 targeted questions.
Same method. Finish by re-reading your error log from the whole of your preparation.
A full 90-question mock in 2.5 hours, at your exam's time of day, with a break at the halfway point. Review every question, including lucky guesses.
Learn the rules and the tool cheat sheet below until you can apply them without looking. 30 mixed questions to test them.
Two or three case studies under strict time using the reading method further down. Light review of the error log.
An hour of light review at most. Confirm your appointment and ID; if testing online, run the system check and clear your desk. Then stop.
The Assessment-Tool Cheat Sheet
This cluster causes more CIPM misses than any other, because the options look interchangeable under time pressure.
| Tool | The question it answers | When it's the right answer |
|---|---|---|
| PTA — privacy threshold analysis | Does this project involve personal data enough to need a full assessment? | Early screening of a new project or system |
| PIA — privacy impact assessment | What are the privacy risks of this project and how do we reduce them? | Broad evaluation, often required by internal policy |
| DPIA — data protection impact assessment | Is this high-risk processing, and what measures address the risk? | GDPR-mandated where processing is likely to be high risk (Art. 35) |
| TIA — transfer impact assessment | Does the destination country's law undermine our transfer safeguards? | Cross-border transfers relying on SCCs, post-Schrems II |
| LIA — legitimate interests assessment | Does our legitimate interest pass the purpose, necessity and balancing tests? | Relying on legitimate interests as a lawful basis |
| Vendor assessment | Can this third party protect the data we'll share? | Before contracting, then periodically |
| Gap analysis / maturity assessment | Where is our programme today versus where it needs to be? | Starting or re-baselining a programme |
Seven Decision Rules the CIPM Keeps Testing
1. Know what you have before you protect it
If an organisation doesn't have a data inventory or map, building one is almost always the right first step — ahead of policies, tools or metrics.
2. Governance before tactics
Leadership support, a defined mission and clear roles come before rolling out controls. If a scenario describes an organisation where nobody owns privacy, the answer is rarely a new tool.
3. Fit the governance model to the organisation
Centralised models suit organisations needing consistency; decentralised models suit autonomous business units; hybrid models combine central policy with local execution. Match the model to the structure described in the case.
4. Incidents follow a sequence
Contain → assess the risk and scope → notify as required → remediate → review lessons learned. If an option jumps to notification before containment and assessment, be suspicious.
5. Data subject requests follow a workflow
Receive and log → verify identity → locate the data → check exceptions → respond within the legal deadline → document. Identity verification is the step candidates most often skip.
6. Vendors are managed across their whole lifecycle
Due diligence before signing, privacy terms in the contract, then ongoing monitoring and audit rights, and finally secure return or deletion at the end. "Assess after a problem" is almost never the best answer.
7. Metrics must suit the audience
Boards want trends and risk; operational teams want volumes and response times. The best metric in a question is the one that answers the stakeholder's actual question.
For more on how these rules show up as questions, see our CIPM operational workflows guide.
One week is still enough time — if you stop rereading and start practicing scenarios.
The last week before the CIPM is where candidates who prepared differently pull ahead. A structured final review beats rereading the same material a fourth time.
Get the Complete Pack →Four Practice Questions on the Decision Rules
Answer each one before opening the explanation. If you get all four, your decision rules are in good shape.
Question 1 — Starting a programme
A newly hired privacy manager joins a 900-person company that has no formal privacy programme. The CEO wants visible progress within three months. What should the privacy manager do first?
Show answer
B. Every other option depends on knowing what data the company processes and where the gaps are. A privacy notice written before a data inventory may be inaccurate (C), and tools and training chosen without a baseline may target the wrong risks (A, D). A current-state assessment is also the fastest way to give the CEO a credible plan.
Question 2 — Choosing the assessment
The marketing team wants to trial a new web analytics tool. The privacy team doesn't yet know whether the tool will process personal data or at what scale. Which assessment should come first?
Show answer
C. A PTA is the screening step: it establishes whether personal data is involved and whether a fuller assessment is needed. A DPIA (A) is for processing likely to be high risk, which hasn't been established. A TIA (B) and LIA (D) answer narrower questions about transfers and lawful basis that may follow once the facts are known.
Question 3 — Incident response
An employee accidentally emails a spreadsheet with 2,000 customers' names, addresses and order histories to the wrong external recipient. What should happen first?
Show answer
B. Containment comes first: it limits harm and shapes the later risk assessment. Whether to notify the authority (A) or individuals (C) depends on that assessment, and the clock for authority notification under the GDPR is 72 hours from awareness — enough time to contain first. Disciplinary action (D) is not part of the immediate response.
Question 4 — Governance model
A multinational has largely autonomous business units in 12 countries. The board wants consistent privacy standards across the group, but local teams need to adapt processes to local law and language. Which governance model fits best?
Show answer
C. A hybrid model sets policy and standards centrally while local teams handle execution — exactly what the scenario describes. A fully centralised model (A) would struggle with local adaptation; a fully decentralised one (B) wouldn't deliver the consistency the board wants. Outsourcing (D) isn't a governance model for this decision.
How to Read a Case Study Fast
- Read the question first. Know whether it's asking for the first step, the best tool, the governance model or the risk.
- Scan the case for constraints. Size, maturity, jurisdictions, budget, who's asking. These usually decide between two good answers.
- Eliminate the "ideal world" options. An answer that would be great in a mature programme can be wrong for a company that hasn't done the basics.
- Don't reread the whole case for each question. Go back only to the paragraph you need.
- Move on after two minutes. Flag it and come back. 90 questions in 150 minutes is about 100 seconds each.
Exam-Day Checklist
- Valid ID matching your registration name; for online testing, a quiet room and clear desk.
- Take the 15-minute break offered at the halfway point, per the IAPP candidate handbook.
- Watch for multi-select questions — the exam tells you when more than one answer is correct.
- Answer everything; there's no penalty for wrong answers.
- Remember 15 of the 90 questions are unscored. A strange question may not count — answer it and keep moving.
Your result appears on screen at the end. If it doesn't go your way, our CIPM retake guide has a four-week recovery plan.
Frequently Asked Questions
What should I review the week before the CIPM?
Focus on your two weakest programme areas, one full timed mock, the differences between assessment tools such as PTAs, PIAs, DPIAs and TIAs, and the operational sequences for incidents, data subject requests and vendor management.
What is the hardest part of the CIPM?
Many candidates find case studies hardest, because several answers are good practice and the right one depends on the organisation's situation. Choosing between assessment tools is another common source of errors.
How long is the CIPM exam?
The CIPM has 90 multiple-choice questions, 75 of them scored, with 2.5 hours to complete it and a 15-minute break offered halfway through.
What score do I need to pass the CIPM?
The CIPM is scored on a 100–500 scale and 300 is the passing score. Because it's a scaled score, it doesn't convert to a fixed percentage. Our CIPM passing score guide explains how the scaling works.
Should I study the night before the CIPM?
Keep it to about an hour of light review of your error log and decision rules, then rest. Judgement-based exams suffer more from fatigue than from one less hour of study.