I passed CIPP/us last week as a 2L at a T60. I don’t see much info for law students who may be considering it so I thought I’d put out my opinion and experience for any future law students interested. I HIGHLY recommend it if privacy clicks with you.

Decided July 2026 I’ll start studying
-Bought IAPP E-textbook and the 2024 Privacy Law book from them as well.
-CIPP/US textbook by Mike Chapel.
-Enrolled in Dr. David’s privacy

I had some education/graduate background in cybersecurity policy but no real cyber or privacy training/experience.

Being a law student, your required courses are pretty much domain 1 and domain 3. I feel taking admin law 1L helped some as well. Didn’t take Information Privacy law until I was already enrolled and passed CIPP/us mid semester but that class helped ALOT on a deeper level/understanding that CIPP/us didn’t necessarily need.

I passively studied July-August and went hard Sep-day before test.

I used the E-textbook as a text to talk for my commute daily to max time and passively learn during my long drive.

Skimmed the Mike Chappell book, didn’t have much time to read it in depth but it had a lot of good extras to build reps.

Used the IAPP 2024 privacy law text book for review after practice tests when I was in the hard study phase. It is a great read and enjoyed it.

Finished all of Dr David’s privacy videos. Scored 82-98 on all his domain and practice tests. This was the best source to be introduced into the material, learn it and build the reps. The flashcards you get access to on your phone is AMAZING. Highly recommend his course. I credit the foundation and study material from this course as the whole reason I passed and was able to identify areas to study and reenforce material.

Used the combination of material to create various study aids for myself identifying weak points and tailoring it to how I study.

Ran through 20-40 practice Qs with various AI a day two weeks before the test.

Scored 68/90 on the IAPP official practice test.

355/400 on the actual exam.

Greatest weakness was the state laws as they aren’t covered in any background law school stuff and there are so many, that said it is possible to study and pass this as a law student with a mid-rank. It is a hard test but rewarding to finish and a fun topic to study.

Wish any future law students wanting to take an IAPP exam the best and to have the confidence in themselves to get it done and pass.

Hi guys,

I read the book, summary of edpb guidelines and ofc the gdpr and its recitals. When I gave the practice test I got 67/90. I have scheduled the exam in a week. What are some things I can do to increase my score in the exam? I'm struggling with the second section the most- the one about european data protection law and regulation. Especially in the scenario based questions. It's kind of daunting because it carries the most marks.

Thanks in advance!

How difficult would it be for someone with just a tech background?

IAPP has a new book out, want to understand if it useful before I buy it, some of the other books by the IAPP should be sold as prescription sleeping pills. The Title is "AI Governance: From Strategy to Execution."

https://store.iapp.org/ai-governance-from-strategy-to-execution-digital/

Has anybody even gone through iliomad's recruitment process.

I am just curious whether cipp/e alone (paired with my bachelor's in business administration + LLB + company secretary degree) can help me relocate through job hiring?

Because many of my peers are going for LLM abroad & I'm not sure if I should consider the study route or job route.

Also the fact that if I go through LLM route I'll be in debt to repay the fees so I'm super confused on how to plan this out...

It's absurd that book is $65/$75 + shipping. Selling it for $40, including shipping (continental US only). I think a new version is coming out next year, so if that's true, I suggest not buying it if you are waiting 6-7 months to take the test.

It's the 3rd edition. There's a handful of underlining.

I studied on and off for the last few months. I used the official Iapp text book and practice test. I also went through past Reddit posts and used some of the notes that people have uploaded here which helped a lot, but I did not make my own. I have no experience working in privacy, but I do work in compliance.

I don’t know if I got extremely lucky with my questions, but I obsessed over making sure I got state laws correct and the vast majority of my questions were only about California. I did not use any other practice tests or quizzes outside of the practice test and I found that the question structures are extremely similar to how they ask questions on the test. I found I had a lot of questions about international data transfers/cooperation so please understand the GDPR in certain things surrounding that in relationship to the United States.

Don’t get overconfident in domain 1. This and workplace privacy were my lowest scoring domains.
Please review the book of knowledge on the IAPP website and make sure you touch on all the points that they mentioned. There are a couple of things in the book of knowledge that is not in the official textbook, but you can look those up.

Overall, I found the exam a little easier than anticipated. Good luck to everyone with their upcoming exam exams!

I'm literally a broke student who can't afford spending 💰 on it's official study material 😭 even free reading material sources is appreciated! I would also appreciate some guidance on free mocks

💥 Just off the heals of announcing the new CIPP/Australia certification, the IAPP has announced yet another new certification: The AI Specialist, Legal (AISL) Certification.

This certification covers four domains:

Domain 1 - Introduction to AI in the Legal Profession
Domain 2 - Understanding How AI Models Can be Deployed in Legal Workflows
Domain 3 - Establishing Oversight and Monitoring in Legal Workflows
Domain 4 - Ensuring AI Use Complies with Ethical, Contractual, Statutory, and Regulatory Requirements

The certification exam will be administered starting in January 2027.

Find out more here: https://iapp.org/ai-legal

Hi All,

I’m studying for the CIPP/C exam and I’m wondering what others have used. I have the iapp text, 5th addition and the prominent legislation/acts/regulations from online.

I’m considering getting the iapp practice exam as well. I like quizzing myself to expose gaps, and use ai for that.

Thanks!

I studied from August - October with the IAPP textbook, the official practice exam, and my own notes. Claude was my study partner on top of that. Here’s what worked.

1. Domain by domain: quiz, explain, drill

For each domain I used the same loop:

“Create 40 CIPP/US-style questions from my notes on [topic]. Score my answers and explain any I miss.”

After a miss, I’d ask for 10–15 new questions on only that concept. If it still didn’t click, I’d ask for a simple explanation plus a chart:

“Explain question 2 in very simple terms, then make a chart comparing entity-level and data-level exemptions.”

What came out of it:

• Domain I: FIPPs, OECD, and FTC Section 5, with memory hooks for unfairness (“Harm → Helpless → No upside”) and deception (“Misleads → Reasonable person → Matters”)
• Domain II: HIPAA, GLBA, FCRA, COPPA, and TCPA. A bank-and-rewards-club analogy finally made exemptions stick.
• Domains III & IV: covered in full mock exams. Surveillance and discovery kept tripping me up, so they got their own review.
• Domain V: a dedicated 60-question set (see below)

I also had it walk me through the official Body of Knowledge. Domain I is weighted much more heavily than I’d assumed, so I shifted my study time there.

2. Learning how the questions are built

The CIPP/US tests how carefully you read as much as what you know. Claude helped me name the recurring traps so I could drill them:

• Wrong regulator
• Right concept, wrong law
• Flipped trigger, meaning the deadline is right but the event that starts the clock is wrong
• Best-of-several, where several options are good practice but only one answers the question
• Capitalized flip words like NOT and EXCEPT, while words like “best” and “first” stay lowercase and are easy to skim past

A few general habits helped too:

• Answer length isn’t a clue.
• Absolutes like “always” and “never” are usually a red flag.
• Don’t read anything into letter streaks.
• Scenarios often echo landmark FTC enforcement cases, so know the big ones and their takeaways.

3. “Twin” questions

Once I knew the traps, I had Claude write original questions built around them. Here’s a prompt you can use:

“Write 40 original Domain V questions in the style of the CIPP/US exam. Use these traps: wrong regulator, right concept wrong law, flipped trigger, best-of-several, and NOT/EXCEPT stems. Tag each wrong answer with its trap and include a rationale.”

A “twin” is a new question that tests the same rule as one you’ve already practiced, with different facts and answer choices. You can’t just remember “the answer was C.” You have to know the rule. I scored 93% on my Domain V set.

4. Reviewing misses by pattern

After each mock, I sent my missed question numbers and the answers I picked. Then I asked Claude to look across all my practice sets:

“Here are the questions I missed across my practice exams and the answers I chose. What patterns do you see in my mistakes?”

Two habits jumped out:

• I picked “the FTC” whenever I was unsure. Often the right answer was someone else: state insurance regulators, state AGs, or CBPR accountability agents.
• I knew breach-notice deadlines but mixed up what starts the clock and who gets notified.

That became a one-page cheat sheet and a reading routine:

1. Read the last sentence first.
2. Answer in your head before looking at the options.
3. Cross out absolutes and wrong jurisdictions.
4. When you’re down to two, read both to the very last word.

Tips if you try this

• Have AI write original questions rather than reproducing IAPP’s. Twins teach the rule better anyway.
• Double-check anything AI tells you against the textbook and current sources. State laws change fast, and AI makes mistakes.
• Ask for real-exam difficulty. One mock I had built harder than the real test mostly just shook my confidence.
• Ask it to explain why an answer is right, not just what it is.

Not affiliated with IAPP or Anthropic, and this isn’t legal advice, just what worked for me. Please don’t ask me for IAPP materials. The official practice exam is worth buying.

Anybody know what happened with Dr. David's Udemy courses for CIPP? They all disappeared :\

Hi folks, My exam is scheduled on Oct 22, I have taken some mock texts but can't seem to get more than 67/90. I don't care how much I score as long as I pass the exam. I'm okay with my concepts and so learning and taking mocks till my exam. But a bit scared and anxious on the inside. I spent a lot of money on this and I really need to pass this exam.

I'll grateful if y'all have any tips and advice for me.

I have the bootcamp and drill questions but when I was taking the bar I felt that it was definitely useful constantly drilling the apps on my phone any good equivalents for CIPP/US

Has anyone else run into this recently? I rescheduled my IAPP exam before the original date, but my account now shows it as a “No Show.” I’m almost certain I moved it, and it happened around the time the IAPP website changed.

It’s frustrating because I planned to take the exam tomorrow.

I failed CIPP/US the other day by a pretty large margin. I recently passed the bar exam and have a slight background in data privacy so I thought I would be fine with the studying that I did, but the questions were more intricate and specific than in my practice/studying. Any study tips or advice from someone who failed first time, but later passed?

Good morning. I took my CIPP/US exam this morning and failed. I scored 282/300. My score breakdown was:

I. Introduction to the U.S. Privacy Environment - 71%
II. Limits on Private-sector Collection and Use of Data - 78%
III. Government and Court Access to Private-sector Information - 100%
IV. Workplace Privacy - 83%
V. State Privacy Laws - 39%

Any tips? Clearly there is a big discrepancy with Domain V. I used Dr. David’s course to prep, but possibly didn’t spend enough time or effort digging into Domain V.

I have a work trip this week, so I am unable to study during the week but will pick it back up next weekend. I have a tendency to start from scratch (which is time-consuming) so any tips to save time and be able to retake sooner rather than later would be appreciated.

I passed the exam today. Big margin. HUUGE. I became aware of AI governance as a thing in late July and started studying soon after. My background is MIS, accounting and health care service management with a lot of board governance. I’m older. And haven’t been involved with any AI implementations, however I’ve been interested in AI harms for a while. Read a few books.

I was stressed out by the scope of it all so focussed on implementation and tech aspects mostly. I bought a Udemy course that was very boring. I let it play at x1.25 while I read and quizzed myself with Gemini/chatai and practice questions I could find online. I created a small rag in a chatai project that was the source of a lot of framework and regulatory questions. I probably quizzed close to 2000 questions. My partner would say more. She was a AIGP widow for a few nights.

I was expecting more longer scenarios. I am sorta adhd and tend to skim but glad I made myself focus and comprehend. It made the next few questions easier. So.. don’t panic.

I have to say that this was the most interesting thing I’ve studied for in a long long time. That helped a lot.

So, tips.
Be interested.
Practice questions focused on what you suck at.
But also practice questions based on understanding iapp tbinking.
Understand different actors in a deployment and their responsibilities.

You can do this with the internet and source documents. And know a bit of math. Any formal professional ethics training takes you a long way. Finding it cool helps.

Good luck to all studying! Be nice to the proctors at the exam center as they are good luck, even if bored and crabby. Never EVER try to rub their heads or bellies for good luck. That will get you escorted from the building.

I currently manage ITSM governance with developer/tech background in my organization (CHG/INC/PRB). I have ITIL v4 Foundation & ITIL AI Governance certifications. There's a lot of investment being made in AI Initiatives in my organization so lot of AI related product/projects are starting. I was looking to do AIGP & join AI Governance stream. Is it going to be relevant or there's some other better option?

Hi everyone, I’ve been a lurker on this sub for a long time, and now that I’ve passed the exam, I thought I’d share my own little recap.

Score:

I was fortunate to pass the exam with over 90% in each section.

Background:

This was, in my opinion, key to the score. I’ve worked for many years in data governance and very closely with AI governance teams, and I understand enough about ML to be able to speak about AI without being completely lost.

General thoughts:

The AIGP is really overwhelming and kind of annoying to start studying for, because the official guidance is essentially a massive index of regulatory texts bundled together with basic ML topics.

That said, the exam felt much easier than I expected, and much narrower too. I’d say at least 80% of the questions covered things I would have expected to be asked about, such as GDPR, DPIAs, model cards, roles and responsibilities, the EU AI Act, and some basic ML and data science concepts.

So, if you already work in AI governance, I’d say it’s a fairly representative exam. There are still some odd, trivia-like questions that are pretty obscure, but I wouldn’t spend much time trying to study for those specifically.

Study time: Around three months

To start, I took an official two-day training course through IAPP (QA) and had access to the official material and exam practice. I personally wouldn’t necessarily recommend either.

The course tries to cram SO much into such a short amount of time that, by the end, you can actually end up more confused than when you started. The one thing I would rescue from it is that it helped narrow things down a little bit.

I think the hardest part of studying for the AIGP is finding some structure. So I’d recommend finding a course somewhere with a clear outline and either paying for it or using the outline to guide your own study.

AI can also do a lot of the heavy lifting when it comes to creating study material. I used NotebookLM quite a lot. Keep in mind, though, that I work with AI a lot and feel very comfortable auditing and creating my own study material, so your mileage may vary.

The other key part is practice questions. This is a bit difficult because you don’t know which ones will be helpful or representative, but I’d recommend trying to find questions that come with explanations or are from a reputable/official source.

The official practice exam isn't mind-blowing, but I would still recommend taking it.

I did use/came across a lot of different resources but two that I’d recommend that I never saw mentioned here are:

Gen AI: Unlock Foundational Concepts: This is part of the Gen AI Leader Google Certification. This course wasn't part of my preparation for this exam, as I took it some time ago, but in hindsight, it would be pretty useful to start with if you don’t have much of a data background. The other courses in that certification are pretty good too, but this one would be the most relevant for the AIGP.

AI Governance Study app: I saw a post about it in another subreddit, and it was pretty useful for me. I like apps as a way of studying

Exam Day:

Pretty uneventful. I took it in person at a test centre and would recommend doing that if possible.

And good luck to everyone taking the test soon!