CIPP/US: Certified Information Privacy Professional/United States

Table of Contents

1. What Is CIPP/US?
2. CIPP/US at a Glance
3. Who Awards and Oversees the Credential?
4. When and Why Was the Credential Created?
5. Who Pursues It, and Where Is It Used?
6. What Knowledge and Skills Does It Cover?
7. What Are the Eligibility Requirements?
8. How Do You Earn the Credential?
9. How Long Does It Take, and How Do Candidates Prepare?
10. How Much Does the Credential Cost?
11. How Do Holders Maintain the Credential?
12. What Is Its Professional Value, and What Are Its Limitations?
13. What Should Employers and Clients Infer From It?
14. How Does It Compare With Related Credentials?
15. How Can You Verify It and Use Its Letters Correctly?
16. Frequently Asked Questions
17. Official Resources and Recent Changes

1. What Is CIPP/US?

CIPP/US stands for Certified Information Privacy Professional/United States, an individual professional certification awarded by the IAPP, the International Association of Privacy Professionals. It recognizes knowledge of U.S. privacy laws, regulatory structures, and requirements affecting organizations that collect, use, share, and retain personal information. Its principal orientation is U.S. private-sector privacy.

The credential is intended for professionals who need to understand privacy obligations for compliance and management purposes. Earning it requires passing the CIPP/US examination and activating certification through IAPP membership or a certification maintenance fee. Continuing education and financial maintenance obligations follow.

After someone’s name, CIPP/US should indicate assessed privacy-law knowledge, not simply attendance at training. It should not be interpreted as evidence that the person is a lawyer or has successfully delivered a privacy transformation. IAPP itself distinguishes examination success from demonstrated professional expertise.

2. CIPP/US at a Glance

• Full name: Certified Information Privacy Professional/United States.
• Abbreviation: CIPP/US.
• Credential type: Individual professional certification, with a U.S. jurisdictional concentration.
• Awarding organization: IAPP.
• Official website: IAPP CIPP/US credential page.
• Current status: Active and available to new candidates.
• First introduced: October 2004, through the original CIPP program.
• Professional focus: U.S. privacy law and compliance, principally private-sector requirements.
• Intended career stage: Professionals building or demonstrating privacy knowledge, rather than a prescribed seniority level.
• Geographic scope: U.S. legal content, with international professional relevance.
• Main eligibility requirement: Examination-based entry; no degree or work-experience prerequisite in the standard pathway.
• Assessment: One 90-question examination, with 150 minutes of testing and an optional 15-minute break.
• Indicative initial cost: USD800 for a first-time nonmember’s exam and initial maintenance fee, before preparation and taxes, as of September 25, 2026.
• Maintenance: Two-year terms, 20 continuing-education credits, and maintenance-fee or membership coverage.
• Verification: IAPP customer support using the certificate number.

3. Who Awards and Oversees the Credential?

The IAPP owns and awards CIPP/US. Its certification team works with an Exam Development Board whose responsibilities include reviewing examination content, approving passing scores, analyzing question performance, and updating the body of knowledge. Board participation is distinct from membership in the IAPP training faculty.

Pearson VUE administers examinations through test centers and its OnVUE remote-proctoring service. It is the delivery provider, not the credential issuer. Training providers likewise do not award CIPP/US merely by teaching a preparation course.

CIPP/US is accredited by the ANSI National Accreditation Board under ISO/IEC 17024:2012, the standard for bodies certifying persons. ANAB’s directory records accreditation from August 5, 2015, currently valid through August 5, 2030. This concerns the certification program, not accreditation of each holder’s employer or consulting firm.

IAPP administers certification complaints and disciplinary procedures. Examination oversight, training provision, and enforcement of certification rules are related but separate functions.

4. When and Why Was the Credential Created?

The original CIPP program launched in October 2004. IAPP identifies that launch as the origin of today’s CIPP/US credential. The program provided a common knowledge benchmark for a developing profession whose responsibilities crossed legal, information-management, and business functions.

An account by an inaugural 2004 certificant illustrates the professional setting: early privacy work included data mapping, privacy notices, employee training, and compliance projects involving health information, financial information, and international transfers. These activities required coordination beyond a single legal or technical specialty.

• 2004: The original certification launched, with an inaugural class of privacy professionals.
• By 2012: IAPP described CIPP/US within a broader family of jurisdictional and specialist credentials.
• 2015: CIPP/US obtained personnel-certification accreditation.

Its subject matter has subsequently expanded with the privacy landscape. The current official textbook includes comprehensive state privacy laws, technological aspects of privacy, privacy risk management, and international issues. The credential remains focused on understanding obligations rather than proving delivery experience.

5. Who Pursues the Credential, and Where Is It Used?

The issuer positions CIPP/US for people who need substantial knowledge of the U.S. privacy environment for compliance or privacy-management responsibilities. That makes it relevant to privacy analysts, compliance professionals, information-governance specialists, consultants, and lawyers whose work involves personal information. It can support a transition into privacy as well as formalize knowledge acquired through existing responsibilities.

The curriculum makes it particularly relevant to financial services, healthcare, education, telecommunications, digital marketing, and organizations managing customer or employee information. The connection differs by setting: a financial institution may emphasize financial-information rules, while a consumer-facing technology business may emphasize tracking, marketing, and state consumer rights. These are curriculum-based applications, not evidence that every holder has worked in those industries.

In consulting, the knowledge is directly relevant to data privacy compliance work, including identifying applicable obligations and helping translate them into operational requirements. This is a substantive match to the credential’s legal and compliance orientation, but staffing decisions should still test implementation experience.

Employer preferences are separate from certification eligibility. For example, HP has listed CIPP/US or CIPP/E among preferred certifications for a Privacy Program Manager role, alongside privacy-management and technology credentials. Such a preference is not a universal requirement to work in privacy.

6. What Knowledge and Skills Does It Cover?

The current body of knowledge organizes CIPP/US into five domains. Its published blueprint uses question ranges, not fixed percentage weightings.

• The U.S. privacy environment, 27-33 questions: Legal structures, regulators, enforcement, and information management. This supports identifying which authorities and requirements are relevant to a proposed use of personal information.
• Federal privacy laws, 15-19 questions: Federal Trade Commission consumer protection and sector-specific privacy rules. The practical distinction is that different activities and industries can trigger different obligations.
• Government and court access to private-sector information, 3-5 questions: Government requests, national-security access, and civil litigation. This supports recognizing when disclosure requests require specialized review.
• Workplace privacy, 4-6 questions: Privacy before, during, and after employment. Relevant situations include recruitment, monitoring, and employment-record handling.
• State privacy laws, 17-21 questions: State authority, privacy and security requirements, consumer rights, and breach notification. This supports distinguishing obligations across states rather than treating the United States as one uniform privacy regime.

Important sectoral topics include health information, financial records, education, telecommunications, and marketing. The official program text also addresses privacy risk management and international privacy issues. These subjects provide context for discussing requirements with business owners and counsel.

Applied capabilities

Illustrative applications include developing an initial obligations matrix for a new service, identifying privacy questions during a vendor review, and organizing the facts needed for a breach-notification assessment. These are reasonable applications of the curriculum, not tasks individually observed during certification.

Boundaries

For hiring purposes, do not convert this subject coverage into assumptions about coding, security architecture, litigation, or implementation leadership. The assessment is an examination, not an observed engagement, technical laboratory, or review of completed client work.

7. What Are the Eligibility Requirements?

The standard CIPP/US pathway has no specified degree, employment-duration, or prior-certification prerequisite. Candidates do not need to qualify first as a lawyer, obtain another CIPP concentration, or submit a portfolio of privacy projects. The published process begins with examination purchase rather than an experience-approval application.

This accessible entry route is important when evaluating holders: certification does not establish that IAPP verified years of employment. IAPP has explicitly acknowledged that lawyers, nonlawyers, and students can pass its examinations without having developed professional expertise in privacy.

Training is preparation, not admission. Candidates can use self-study, official materials, or training. A particular paid course is not a condition of earning the credential. Choosing a course should therefore depend on learning needs rather than a belief that attendance confers eligibility.

Membership is optional, but activation is not. Passing candidates must have either IAPP membership or certification-maintenance-fee coverage before their credential becomes active. Purchasing an examination, passing it, and holding an active certification are three distinct stages.

Candidates must also satisfy identification requirements and accept the applicable certification and confidentiality agreements. Employers may impose additional education, experience, or screening requirements unrelated to IAPP eligibility.

8. How Do You Earn the Credential?

Purchase, prepare, and schedule

Purchase the CIPP/US examination through IAPP, then schedule through the examination function in the MyIAPP account. The purchased attempt must be scheduled and taken within one year. Candidates can choose a Pearson VUE test center or an eligible remotely proctored appointment.

Use the body of knowledge as the preparation checklist. A textbook or course is a learning resource, not a substitute for understanding the full examination specification. Reviewing the testing rules before selecting remote or in-person delivery is also prudent.

Take the examination

CIPP/US is an English-language, closed-book examination containing 90 questions, with 150 minutes of testing time. Questions include standalone and scenario-based items; there is no essay or assessed work portfolio. Current IAPP examinations also permit clearly identified multiple-response questions. Those require all specified correct selections for credit, without partial credit.

The examination is divided into two halves, each containing half the questions and half the testing time. An optional 15-minute break separates them. Candidates must submit the first half before proceeding and cannot return to it, even when they skip the break. Plan review time within each half.

Understand the result

The passing score is 300 on IAPP’s 100-500 reporting scale. This is not equivalent to answering 60% correctly. Scored questions have equal weight, and candidates do not need a separate passing result in every domain. The domain breakdown can help identify preparation gaps after an unsuccessful attempt.

Computer-based results are generally available immediately. A failed candidate must purchase another attempt and cannot schedule the retake for a date fewer than seven days after the previous attempt.

Activate the award

After passing, ensure membership or maintenance-fee coverage is in place. An examination pass alone does not complete activation. IAPP’s digital certificate is issued through Accredible, generally within two weeks once the certification requirements are satisfied.

9. How Long Does It Take, and How Do Candidates Prepare?

Prerequisite-building time: There is no mandatory period of employment or university study before entering the standard examination route. Candidates should nevertheless distinguish permission to test from readiness to test.

Preparation time: IAPP recommends a minimum of 30 hours of study as general guidance. Its study guide acknowledges that individuals may need more or fewer hours depending on experience and learning choices. This is not a verified average completion time or a promise that 30 hours will be sufficient.

Official resources: The body of knowledge, blueprint, free study guide, official textbook, practice examination, and optional training provide different forms of preparation. IAPP offers online, live-online, and in-person learning options.

Preparation choices: A useful approach is to identify unfamiliar domains first, build comparisons between legal regimes, and practice explaining why an obligation applies. Do not use familiarity with one sector as a reason to skip the rest of the blueprint.

Administrative time: Appointment availability and accommodations can affect scheduling. Allow up to two business days for results to appear in IAPP’s system.

10. How Much Does the Credential Cost?

The following prices are IAPP’s listed U.S.-dollar prices as of September 25, 2026. Applicable taxes, travel, and preparation time are additional.

• First-time examination: USD550 for members and nonmembers.
• Nonmember maintenance: USD250 for the two-year certification term. A first-attempt examination plus initial maintenance therefore totals USD800, excluding preparation.
• Membership alternative: Annual professional membership costs USD295 and includes maintenance-fee coverage while membership is maintained. Two annual memberships plus the examination would total USD1,140, assuming unchanged prices. Existing members should not add a separate maintenance fee.

Optional preparation: The official fourth-edition digital textbook costs USD65 for members or USD75 for nonmembers. The digital practice examination costs USD45 or USD55, respectively. Optional self-paced online training costs USD995 for members or USD1,195 for nonmembers. These purchases are separate from the examination.

A nonmember choosing the examination, maintenance fee, digital textbook, and practice examination would therefore budget USD930 before tax, assuming a first-attempt pass and no other purchases.

Retakes and scheduling: Retakes are separately purchased at a discounted price. In-person cancellation or rescheduling requires 48 hours’ notice; missed appointments can consume the paid attempt.

11. How Do Holders Maintain the Credential?

CIPP/US operates on two-year certification terms. Holders must satisfy the continuing-education requirement and maintain financial coverage through either the certification maintenance fee or annual IAPP membership. Paying the fee does not replace continuing education.

Continuing education: Holders must submit 20 continuing professional education credits per term. Eligible activities include relevant education, events, reading, writing, and other activities recognized by IAPP, subject to activity-specific rules and limits. Maintain supporting records and check that credits appear correctly in the account.

Relevant activities may support more than one IAPP credential. Up to 10 surplus credits earned during the final six months of a term can carry into the next term. Neither overlap nor carryover should be assumed without checking the applicable rules.

Suspension and reinstatement: Missing credits or financial coverage can result in suspension. A prior-term education shortfall must be addressed with newly earned credits, in addition to the next term’s regular requirement. If a term ends while certification remains suspended, the credential is revoked; reinstatement then requires passing the examination again.

Conduct: Certification also remains subject to IAPP’s disciplinary procedures. Consequently, an old certificate is evidence of a historical award, not sufficient confirmation of current standing.

12. What Is Its Professional Value, and What Are Its Limitations?

CIPP/US can provide a recognizable knowledge signal when a role requires understanding U.S. privacy obligations. Employer evidence supports that limited conclusion: HP has listed it among preferred credentials for privacy program management, while Hershey has listed CIPP/US, CIPM, or CIPT as preferred experience for a Staff Privacy Management position.

The Hershey posting also emphasizes hands-on platform experience, integrations, delivery methods, stakeholder influence, and commercial trade-offs. That is an important illustration of how employers can value certification without treating it as a replacement for execution capability.

For professional development, the credential’s potential value lies in three mechanisms: structuring a broad field of study, demonstrating examination-based knowledge to others, and maintaining an ongoing learning obligation. These mechanisms are useful reasons to consider the credential, but they do not establish a particular employment or compensation outcome.

For an individual decision, compare the curriculum with the target role. A professional who needs to interpret U.S. privacy obligations has a more direct use case than someone seeking primarily technical security implementation skills. CIPT, for example, addresses privacy in products and technical systems more directly.

The practical limitation is straightforward: ask what the person can do with the knowledge. Do not assume that the letters establish industry depth, strong client communication, effective project leadership, or a salary premium.

13. What Should Employers and Clients Infer From It?

What the credential establishes

A current holder has passed IAPP’s U.S.-focused privacy examination and satisfied applicable activation and maintenance requirements. The credential provides evidence of assessed knowledge, not a verified employment history or a review of completed consulting engagements.

What still requires evaluation

Evaluate industry experience, implementation depth, project scale, judgment under uncertainty, and the ability to work with legal, technology, and business teams. Ask the candidate to distinguish their own work from work performed by counsel, engineers, or other specialists.

For HIPAA and healthcare privacy compliance assignments, treat CIPP/US as supporting knowledge evidence. Request separate evidence of experience with the relevant organizations, data flows, systems, and operational controls rather than assuming healthcare specialization from a broad privacy credential.

Evidence to request

Useful nonconfidential evidence might include a redacted applicability assessment, privacy requirements matrix, vendor-review template, incident decision record, or implementation plan. Ask which recommendations were adopted, how exceptions were resolved, and how the candidate tested whether processes worked in practice. Do not request confidential client data.

Three questions assessing applied competence

1. How would you determine which state privacy obligations apply to a retailer expanding into three additional states? A useful answer would organize the relevant business and data facts, identify applicability questions, and distinguish legal conclusions from assumptions requiring validation.
2. How would you assess a wellness application that shares health-related information with advertising vendors? Look for careful investigation of organizational roles, information flows, purposes, and potentially applicable regimes rather than an immediate assumption that one health-privacy rule resolves everything.
3. A service provider reports unauthorized access to customer information. What facts would you gather before recommending notifications? A useful answer would separate incident facts, affected populations, contractual responsibilities, legal analysis, and communication decisions, while identifying missing evidence and escalation needs.

These are illustrative hiring questions, not examination items. Evaluate the reasoning and evidence offered, not merely the number of laws the candidate names. An individual’s CIPP/US also does not establish that their firm has a separate accreditation or authorization.

14. How Does It Compare With Related Credentials?

• CIPP/E, Certified Information Privacy Professional/Europe: A jurisdictional alternative or complement focused on European data-protection law, including the GDPR. It is more directly aligned with European compliance responsibilities, not a senior version of CIPP/US. Multinational professionals may have a reason to pursue both.
• CIPM, Certified Information Privacy Manager: A complement focused on establishing, maintaining, and managing privacy programs. It addresses operational administration across the program life cycle rather than concentrating on one jurisdiction’s laws. It may fit program-management responsibilities more directly.
• CIPT, Certified Information Privacy Technologist: A complement focused on incorporating privacy into technology, products, and services. It is oriented toward technical privacy decisions, including minimization and access controls. It should not be confused with an observed coding or engineering assessment.
• PLS, Privacy Law Specialist: A potential subsequent designation for qualifying U.S. attorneys, not a general entry alternative. It requires CIPP/US plus CIPM or CIPT, together with additional professional-practice, education, ethics, and reference requirements. Permission to advertise a legal specialty depends on applicable professional rules.

The first three follow IAPP’s examination-based certification process. PLS adds requirements that expressly address professional legal practice. This distinction matters more than a supposed prestige ranking: select credentials according to jurisdiction, work responsibilities, and the kind of evidence an employer needs.

15. How Can You Verify It and Use Its Letters Correctly?

IAPP’s published verification method is to contact customer support with the holder’s certificate number. Its FAQ describes the identifier as nine digits followed by a capital “I.” Request the certificate information directly from the person rather than relying only on a résumé or social-media badge image.

Ask for confirmation of the holder’s identity, the specific CIPP/US designation, and current status. IAPP’s digital-certificate records include certification term dates and a certification ID. An award date alone should not be treated as confirmation that maintenance obligations remain satisfied.

The correct credential abbreviation is CIPP/US, including the jurisdictional suffix. An illustrative name line is “Alex Morgan, CIPP/US.” Retaining “/US” distinguishes this concentration from other CIPP credentials.

Candidates should not present themselves as certified before activation. Suspended holders must stop using certification marks, and withdrawn certification requires cessation of designation use. Historical achievement should be described clearly as historical, not as current standing.

A missing public-profile result should prompt issuer verification, not an automatic accusation of misrepresentation.

16. Frequently Asked Questions

Can a nonlawyer earn CIPP/US?

Yes. IAPP distinguishes its privacy examinations from qualifications establishing professional legal expertise. Nonlawyers and students can earn examination-based credentials; CIPP/US should not be represented as admission to legal practice or as the separate Privacy Law Specialist designation.

Does completing CIPP/US training make someone certified?

No. Training supports preparation. The credential requires passing the examination and completing activation. A course-completion document therefore establishes something different from an active CIPP/US certification, even when the training uses official IAPP materials.

Must holders remain IAPP members?

No. Membership is one maintenance option, not the only one. Nonmembers can use the certification maintenance fee. Membership includes that fee as a benefit while annual membership is maintained; neither payment option removes the continuing-education requirement.

Is CIPP/US the same as the retired CIPP/G?

No. CIPP/G was a separate government-focused credential. IAPP deactivated that program on September 30, 2018, with special treatment for holders then in good standing. Those legacy arrangements should not be applied to the active CIPP/US program.

17. Official Resources and Recent Changes

Official resources: IAPP provides a body of knowledge, examination blueprint, study guidance, preparation products, certification policies, and maintenance information. Use the examination specification to organize study rather than relying solely on a textbook edition.

Current examination baseline: The published CIPP/US body of knowledge is version 2.6.1, effective September 1, 2025.

Current policy documents: Candidate handbook version 5.3.2 is effective June 1, 2026; it describes the divided examination and optional break. The current continuing-education policy is effective April 7, 2026. Older preparation or renewal advice should be checked against these rules.

This profile is an independent Umbrex reference and is not issued or endorsed by the credential owner unless an explicit relationship is stated.