If you want the short answer: pick your IAPP certification by the job you are doing, not by which one sounds most senior. Lawyers and compliance staff take a CIPP in the jurisdiction they actually work in. People who run the privacy programme take CIPM. Engineers and architects take CIPT. Anyone whose remit has quietly grown to include AI takes AIGP, and the salary data says that is now the most valuable square on the board.
The reason this question comes up so often is that the IAPP sells five credentials that look interchangeable from the outside. They are not. They share an exam engine and a fee structure, but they test completely different jobs, and buying the wrong one costs you USD550 and roughly two months of evenings.
The Five IAPP Certifications at a Glance
Every IAPP exam runs through Pearson VUE, at a test centre or online proctored. The exam mechanics are near identical across the range, which is exactly why people assume the content is too.
| Certification | Full name | Questions | Time | Domains | Who it is for |
|---|---|---|---|---|---|
| CIPP/US | Certified Information Privacy Professional, United States | 90 | 2.5 hours | 5 | US privacy law: sectoral rules, workplace privacy, state statutes |
| CIPP/E | Certified Information Privacy Professional, Europe | 90 | 2.5 hours | 5 | GDPR and European data protection law |
| CIPM | Certified Information Privacy Manager | 90 | 2.5 hours | 6 | Building and running a privacy programme |
| CIPT | Certified Information Privacy Technologist | 90 | 2.5 hours | 5 | Privacy engineering, privacy by design, PETs |
| AIGP | Artificial Intelligence Governance Professional | 100 | 2.75 hours | 4 | AI governance, AI law, model and system oversight |
The IAPP also offers CIPP/A (Asia), CIPP/C (Canada), CIPP/CN (China) and an LGPD credential for Brazil. Those follow the same 90-question, 2.5-hour pattern, except LGPD, which is 60 questions in 2 hours.
Exam Tip: The passing score for every IAPP exam is 300 on a scale that runs from 100 to 500. The IAPP is explicit that this does not mean 60 percent. It is a scaled score, so do not try to reverse engineer how many questions you can afford to drop.
What Every IAPP Certification Has in Common
Before you compare the five, understand the parts that do not vary. They shape your budget more than the exam choice does.
- Cost. In the US, a first attempt is USD550 and a retake of the same exam is USD375.
- Validity. Certification runs for two years from the day after you pass.
- Maintenance. You need 20 continuing privacy education credits per two-year term, plus a certification maintenance fee of USD250 per term. IAPP membership at USD295 a year covers the CMF instead, and it covers every certification you hold rather than charging per credential. If you plan to hold two or more, membership is the cheaper route.
- Format. Multiple choice, closed book, no negative marking.
That last point on the CMF matters when you are choosing. Holding CIPP/E plus CIPM is a common pairing, and membership means the second credential costs nothing extra to maintain.
The 2026 Body of Knowledge Position
Each certification has a versioned body of knowledge, and the IAPP gives at least 90 days notice before a new one takes effect. The current state as of August 2026:
- CIPP/US: version 2.6.1, effective 1 September 2025, five domains unchanged from the prior year.
- CIPP/E: effective 1 September 2025, reorganised from three domains into five, with the same sub-topics and the same question allocation as before.
- CIPT: effective 1 September 2025, cut from seven domains to five. The IAPP described most of the change as reorganisation and consolidation rather than new material.
- CIPM: version 4.2.0, effective 1 September 2025, six domains.
- AIGP: version 2.1, effective 2 February 2026, four domains. This one added genuinely new content, including agentic architectures, third-party risk assessments, ISO 42005 and automated decision-making rules.
No autumn 2026 update had been announced as of mid-August 2026. If you are sitting an exam this year, the material you buy today is the material you will be tested on.
CIPP/US vs CIPP/E: Choose by Jurisdiction, Not Difficulty
Candidates waste weeks arguing about which CIPP is harder. Ask a different question: whose law do you have to apply on a Monday morning?
CIPP/E is GDPR and the European regime around it. Its five domains run from an introduction to European data protection, through the law and regulation itself, European data processing, scope and accountability, and compliance. If you work for a European organisation, or a US organisation with European customers, this is the one that gets referenced in job adverts.
CIPP/US is a different animal because there is no single US privacy law to learn. Its five domains are the US privacy environment, limits on private-sector collection and use of data, government and court access to private-sector information, workplace privacy, and state privacy laws. That last domain is why the credential keeps its value: the state patchwork keeps expanding, and someone has to track it.
Neither is a prerequisite for the other. Holding both is common for people at multinationals, and it is a reasonable second purchase once you have membership covering the CMF.
CIPM: The One That Proves You Can Run the Programme
CIPM is the operational credential, and it is the one most likely to move you from doing privacy work to owning privacy work. Its six domains split into two halves: developing a framework and establishing programme governance, then the four stages of the privacy programme operational life cycle, which are assessing data, protecting personal data, sustaining programme performance, and responding to requests and incidents.
The distinction from a CIPP is worth being precise about. A CIPP tests whether you know the law. CIPM tests whether you can build the machinery that keeps an organisation compliant with it: the data inventory, the DPIA process, the metrics, the breach response. Hiring managers for privacy manager and DPO roles read it that way.
Exam Tip: CIPM questions lean scenario-based. You will be given an organisation with a problem and asked what the privacy manager should do next. Rote memorisation of domain headings does not survive contact with that format, so practise applying the life cycle stages to situations rather than reciting them.
CIPT: The Technical One Nobody Buys Early Enough
CIPT is the smallest of the five by search demand and the most undervalued by candidates. Its five domains cover the privacy technologist's role in the organisation, data collection through to destruction, privacy risk management, privacy-enhancing strategies and technologies, and privacy by design.
If you are an engineer, architect, or security professional who has been handed privacy requirements, CIPT is the credential that translates. It is also the one that pairs best with a security background: much of the risk management and PETs material sits next to what you already know from a security certification. Readers coming from a CompTIA or ISC2 background usually find CIPT the easiest entry point of the five, because the vocabulary is closer to home than a CIPP's statutory detail.
AIGP: Where the Money Actually Moved
AIGP is the newest of the five and the only one with a bigger exam: 100 questions in 2.75 hours across four domains. Those domains are the foundations of AI governance, how laws, standards and frameworks apply to AI, governing AI development, and governing AI deployment and use.
The case for it is not theoretical. In the IAPP Salary and Jobs Report 2025-26, which surveyed more than 1,600 professionals across over 60 countries in March and April 2025, half of the respondents working across both privacy and AI governance earned more than USD169,700. For respondents working in privacy alone, half earned less than USD123,000. AI governance alone sat between the two, under USD151,800.
Read that carefully, because it is a combination effect rather than a case for abandoning privacy. The people at the top are not AI specialists who skipped privacy. They are privacy professionals who added AI governance to an existing remit. That makes AIGP the strongest second certification in the IAPP catalogue, and a defensible first one if your current job already touches model governance.
The same report found that 77 percent of respondents held at least one IAPP certification and 39 percent held more than one, so a single credential is closer to the entry ticket than a differentiator in this field.
If AIGP is where you are heading, we have a full breakdown in IAPP AIGP Explained: Domains, Cost and Is It Worth It in 2026, and a comparison against the ISACA and ISO alternatives in Best AI Governance Certification in 2026.
Which IAPP Certification Should You Take First?
Match the credential to the role you hold now, not the one you want in five years.
| Your role | Take this first | Then add |
|---|---|---|
| Lawyer or compliance officer, US | CIPP/US | CIPM |
| Lawyer or compliance officer, Europe | CIPP/E | CIPM |
| Privacy programme manager or DPO | CIPM | CIPP for your jurisdiction |
| Engineer, architect or security professional | CIPT | AIGP |
| Anyone with AI governance in their remit | AIGP | CIPM |
| Career changer with no privacy experience | CIPP for your jurisdiction | CIPT |
The one combination to avoid is buying two CIPPs before you hold either CIPM or CIPT. A second jurisdiction adds breadth to knowledge you already have. Adding the management or the technical credential adds a capability you do not.
Worth noting for anyone weighing IAPP against the neighbouring GRC credentials: ISACA CDPSE covers privacy from a technical and audit angle and requires proven experience, whereas the IAPP exams have no experience prerequisite at all. If you cannot yet evidence the years, the IAPP route is open to you today.
Frequently Asked Questions
What is an IAPP certification?
An IAPP certification is a credential issued by the International Association of Privacy Professionals, the largest professional body for privacy and AI governance. The programme covers privacy law by region (the CIPP family), privacy programme management (CIPM), privacy technology (CIPT) and AI governance (AIGP). All of them are examined through Pearson VUE and none require prior experience to sit.
Is IAPP certification worth it?
For privacy roles, yes, because the market treats it as the default credential. The IAPP Salary and Jobs Report 2025-26 found 77 percent of respondents held at least one IAPP certification, and the report notes median salary was higher for respondents holding any one IAPP qualification, with further increases for those holding several. The strongest single return in the 2025-26 data came from combining privacy with AI governance rather than from any one exam.
How long is IAPP certification valid?
Two years from the day after you pass. To keep it, you need 20 continuing privacy education credits within that two-year term and a certification maintenance fee of USD250, or IAPP membership at USD295 a year, which covers the CMF across every credential you hold.
How do you get an IAPP certification?
Choose the credential that matches your role, register for the exam through the IAPP, and sit it at a Pearson VUE test centre or online proctored. Study the current body of knowledge for that credential, since each one is versioned and dated. You then answer 90 questions in 2.5 hours, or 100 in 2.75 hours for AIGP, and need a scaled score of 300 out of 500 to pass. There is no experience requirement for any IAPP exam.
How much does an IAPP exam cost?
A first attempt is USD550 in the US, and a retake of the same exam is USD375. Budget separately for the two-year maintenance cost, which is either USD250 per certification term or USD295 a year for membership.
Ready to Start Practising?
Reading the body of knowledge tells you the scope. It does not tell you whether you can answer a scenario question under time pressure, which is the thing that decides your result on the day.
CertCrush runs a full AIGP practice course built around the current body of knowledge, with exam-style questions and explanations that show you why the wrong answers are wrong. If AI governance is the direction you are heading, that is the fastest way to find the gaps before Pearson VUE does.
Create a free CertCrush account and start practising today.