CIPM Exam — Information & Free Practice

The authority publishes question-count ranges for each content area. The practice percentages below use the midpoint of each range, normalized to 100%; they are not exact percentages published by the authority. Practice question counts may differ slightly because of rounding.

• Privacy Program: Developing a Framework — Official range: 14–18 questions (Practice allocation: 21.33%)

  • Define program scope and develop a privacy strategy
  • Communicate organizational vision and mission statement
  • Indicate in-scope laws, regulations and standards applicable to the program
• Privacy Program: Establishing Program Governance — Official range: 12–16 questions (Practice allocation: 18.67%)

  • Create policies and processes to be followed across all stages of the privacy program life cycle
  • Clarify roles and responsibilities
  • Define privacy metrics for oversight and governance
  • Establish training and awareness activities
• Privacy Program Operational Life Cycle: Assessing Data — Official range: 12–16 questions (Practice allocation: 18.67%)

  • Document data governance systems
  • Evaluate processors and third-party vendors
  • Evaluate physical and environmental controls
  • Evaluate technical controls
  • Evaluate risks associated with shared data in mergers, acquisitions and divestitures
• Privacy Program Operational Life Cycle: Protecting Personal Data — Official range: 9–13 questions (Practice allocation: 14.67%)

  • Apply information security practices and policies
  • Integrate the main principles of Privacy by Design (PbD)
  • Apply organizational guidelines for data use and ensure technical controls are enforced
• Privacy Program Operational Life Cycle: Sustaining Program Performance — Official range: 7–9 questions (Practice allocation: 10.67%)

  • Use metrics to measure the performance of the privacy program
  • Audit the privacy program
  • Manage continuous assessment of the privacy program
• Privacy Program Operational Life Cycle: Responding to Requests and Incidents — Official range: 10–14 questions (Practice allocation: 16%)

  • Respond to data subject access requests and privacy rights
  • Follow organizational incident handling and response procedures
  • Evaluate and modify current incident response plan