Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by IAPP
Exam Format
Registration
Validity
Skills this practice test covers
- Separate personal data, special categories, pseudonymous data and anonymous data in a case.
- Pick the lawful processing basis that fits, from consent to legitimate interest.
- Choose a transfer tool for data leaving the EU, such as Standard Contractual Clauses or Binding Corporate Rules.
- Decide when a data protection impact assessment (DPIA) or a mandatory data protection officer (DPO) is required.
- Apply breach notification rules and each data subject right, from access to data portability.
- Assess workplace monitoring, CCTV, cookies and direct marketing against European law.
Explore related topics
CIPP-E exam content
5 domains · 18 topics · 340 questions
Introduction to European Data Protection
This domain gives the history behind the GDPR: human rights law, early data protection laws and the push for one European approach. It also covers the EU institutions, early laws such as Directive 95/46/EC and the ePrivacy Directive, and current ones such as the NIS/NIS 2 Directives and the EU Artificial Intelligence Act.
Skills tested
- Explain the historical rationale for data protection and the role of the OECD Guidelines and Convention 108.
- Describe the roles of the European Parliament, the European Commission, the European Council and the Court of Justice of the European Union.
- Explain early laws such as the Data Protection Directive 95/46/EC and the ePrivacy Directive, and how they relate to the GDPR.
- Explain the challenges of a harmonized European approach, such as Brexit.
Official topics
- Origins and historical context of European data protection laws
- Roles and functions of significant European Union institutions
- Legislative framework underpinning European data protection
European Data Protection Law and Regulation
This domain covers the building blocks of the GDPR: personal data and its categories, controllers and processors, and the measures that keep data secure. It also covers each data subject right and its limits, often through EDPB guidelines.
Skills tested
- Tell personal data, sensitive personal data and special categories of personal data apart.
- Separate the roles of controller and processor in a data flow.
- Define appropriate technical and organizational measures, such as encryption and access controls.
- Apply breach notification rules, including risk reporting.
- Handle requests for access, rectification, erasure, restriction, objection and portability.
Official topics
- Basic GDPR data protection concepts
- Requirements for maintaining security of personal data
- Data subjects' rights
European Data Processing
This domain is about lawful processing. Candidates apply the processing principles, choose a lawful basis, write transparent privacy notices, and move data out of the EU with a valid transfer tool.
Skills tested
- Apply purpose limitation, storage limitation and the other processing principles.
- Choose among consent, contractual necessity, legal obligation, vital interests, public interest and legitimate interest.
- Draft privacy notices, including layered privacy notices.
- Pick adequacy, Standard Contractual Clauses, Binding Corporate Rules or a derogation for a transfer.
- Run a transfer impact assessment (TIA) and explain what the Schrems decisions changed.
Official topics
- Principles of European data processing
- Lawful processing basis
- Information provision obligations
- International data transfers
European Data Protection: Scope and Accountability
This domain asks when the GDPR applies and what it demands. It covers establishment and territorial scope, accountability duties such as DPIAs and DPOs, the supervisory authorities, and the fines and compensation that follow a violation.
Skills tested
- Decide whether the GDPR applies to an organization established outside the EU.
- Apply data protection by design and default, and keep the records that show accountability.
- Decide when a DPIA is needed and when a DPO is mandatory.
- Identify the lead supervisory authority in a cross-border case.
- Explain the procedures and fines for infringements, and when class actions or compensation follow.
Official topics
- Territorial and material scope of GDPR
- Accountability requirements under GDPR
- European data protection supervision and enforcement
- Consequences for GDPR violations
Compliance with European Data Protection Law and Regulation
The last domain applies the law to everyday settings: employment, surveillance, direct marketing and internet technology. Each brings its own issues, from workplace monitoring and CCTV to cookies, dark patterns and artificial intelligence.
Skills tested
- Pick the legal basis for processing employee data and handle personnel records.
- Assess workplace monitoring, data loss prevention and BYOD programs.
- Apply the rules on CCTV, geolocation and biometrics, including facial recognition.
- Check direct marketing, online behavioral targeting and web cookies for compliance.
- Assess dark patterns on social media and the compliance issues of AI and machine learning.
Official topics
- Workplace data protection compliance
- Surveillance activities compliance
- Direct marketing compliance
- Internet technology and communications compliance
Requirements
- No formal prerequisites: anyone can book the exam.
- Recommended: IAPP's CIPP/E training and its textbook, European Data Protection: Law and Practice.
- Recommended: following new EDPB guidelines and court decisions, since IAPP expects candidates to know developments newer than the textbooks.
About the CIPP-E exam
IAPP's CIPP-E exam tests knowledge of European data protection law: the GDPR, the laws and institutions that shaped it, and how organizations apply it. Its domains run from EU institutions and early laws such as Convention 108 to data subjects' rights, lawful processing, transfers, accountability and enforcement. The final domain applies the law to employment, surveillance, marketing and internet technology. Passing earns the Certified Information Privacy Professional/Europe (CIPP/E) certification, which IAPP offers in English, French and German.
The PlanetCert practice test asks the most about European Data Protection Law and Regulation, from breach notification to the right of erasure and data portability, followed by scope and accountability. The explanations separate GDPR ideas that are easy to mix up, such as controller and processor, or pseudonymous and anonymous data. Flashcard Mode suits the legislation of the first domain, from Directive 95/46/EC to the NIS 2 Directive. Brainy AI Assistant can explain which lawful basis fits a case, or when a transfer impact assessment (TIA) is needed.
How to earn the certification
- Earns
- Certified Information Privacy Professional/Europe (CIPP/E)Professional
CIPP/E stays valid for two years and renews with Continuing Privacy Education (CPE) credits.
- After
- CIPM Certified Information Privacy Manager (CIPM)
IAPP's privacy program management certification. IAPP says that adding it to CIPP/E prepares a holder for the GDPR's data protection officer duties.
- FIP Fellow of Information Privacy (FIP)
IAPP's fellow-level designation, which recognizes advanced knowledge and issue-spotting skills in data privacy.
- CIPM Certified Information Privacy Manager (CIPM)
How to prepare for CIPP-E
- 1
Read each performance indicator
IAPP's body of knowledge lists competencies and performance indicators. The first verb of each indicator, such as know or understand, signals how deep the questions go, so use the list as the study checklist.
- 2
Read the GDPR alongside the textbook
Look up the GDPR text for each topic in Domains II to IV, such as lawful bases, data subject rights and DPIAs. Many performance indicators also name EDPB guidelines and opinions, so read those next to it.
- 3
Build a transfer decision tree
Write the order of checks for sending data outside the EU: adequacy first, then Standard Contractual Clauses or Binding Corporate Rules with a transfer impact assessment, and derogations last. Domain III covers each of these tools.
- 4
Test Domain V on real settings
Take one example each for employment, surveillance, marketing and internet technology, such as CCTV in a shop or a cookie banner on a website, and decide what the law requires in each case.
- 5
Sit timed rounds, then ask why
Take the CIPP-E practice test in Timed Mode once the domains feel solid. For each miss, ask Brainy AI Assistant which GDPR article or EDPB guideline settles the question.
Start a timed CIPP-Erun
IAPP's official preparation includes its CIPP/E training, online, live online or in person, the textbook European Data Protection: Law and Practice and the CIPP/E Practice Exam.
Who CIPP-E is for
- Data protection officers and privacy managers who handle personal data from the EU.
- Lawyers, compliance officers and consultants who advise on GDPR projects.
- IT and security staff whose systems process the personal data of people in Europe.
- Privacy professionals outside Europe whose organizations fall within the GDPR's territorial scope.
Typical job titles: Data protection officer · Privacy manager · Privacy counsel · Privacy analyst · Compliance officer · Privacy consultant
CIPP-E glossary
18 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- Adequate jurisdiction
- A country that the European Commission finds protects personal data to a standard close to the EU's, so data can flow there freely.
- Binding Corporate Rules (BCRs)
- Internal rules, approved by supervisory authorities, that let a corporate group transfer personal data among its members outside the EU.
- Controller
- The organization that decides why and how personal data is processed.
- Convention 108
- The Council of Europe's 1981 treaty on the automatic processing of personal data, later updated as Convention 108+.
- Data portability
- The right to receive personal data in a structured, machine-readable format and move it to another controller.
- Data protection by design and default
- Building data protection into processing from the start, and setting the most protective options as the default.
- Data protection impact assessment (DPIA)
- A review a controller must carry out before processing that is likely to result in a high risk to people's rights.
- Derogations
- Narrow exceptions, such as explicit consent, that allow a transfer when no adequacy decision or other safeguard is in place.
- EU-US Data Privacy Framework
- An arrangement that lets certified US companies receive personal data from the EU; it followed Safe Harbor and Privacy Shield.
- European Data Protection Board (EDPB)
- The EU body of national supervisory authorities that issues guidelines and opinions so the GDPR is applied consistently.
- Lead supervisory authority
- The data protection authority that leads on cross-border processing, usually where the organization has its main establishment in the EU.
- Legitimate interest
- A lawful basis that allows processing a controller or third party needs, unless the person's rights and interests outweigh that need.
- Processor
- An organization that processes personal data on behalf of a controller and follows its instructions.
- Pseudonymous data
- Personal data whose identifiers have been replaced, so it points to a person only with extra information that is kept apart.
- Right to be forgotten (RTBF)
- The right to have personal data erased when, for example, it is no longer needed or consent is withdrawn.
- Special categories
- Types of personal data, such as health, religious or biometric data, that the GDPR protects more strictly.
- Standard Contractual Clauses (SCCs)
- Contract terms adopted by the European Commission that let personal data move to a country without an adequacy decision.
- Transfer Impact Assessments
- Checks done before a transfer on whether the laws of the destination country would weaken the protection a transfer tool promises.