Body of Knowledge and Exam Blueprint v2.6.1
CIPP/US Body of Knowledge and exam blueprint
IAPP’s CIPP/US credential page links to Body of Knowledge and Exam Blueprint v2.6.1, effective September 1, 2025. It covers the U.S. privacy environment, federal privacy laws, government and court access, workplace privacy and state privacy laws. Use its question ranges to plan study time across all five domains.
How many questions does the blueprint assign to each domain?
IAPP publishes a minimum and maximum for each domain. Use the ranges to judge relative emphasis and the full blueprint to find the competencies and performance indicators underneath each heading. The chapter numbers show where those domains are covered in the TestCertify kit. The free resources linked in this guide let you follow the same sequence.
| Domain | IAPP question range | Kit chapters |
|---|---|---|
| I. U.S. privacy environment | 27–33 | 1–3 |
| II. Federal privacy laws | 15–19 | 4–7 |
| III. Government and court access | 3–5 | 8 |
| IV. Workplace privacy | 4–6 | 9 |
| V. State privacy laws | 17–21 | 10–12 |
I. U.S. privacy environment
Study how statutes, regulators, enforcement mechanisms and information-management principles fit together. Start with a data-flow drawing for a company that collects customer information and sends some of it to a service provider. Label the parties, collection purpose, access, retention and disposal. Then identify which facts you still need to select a legal authority or an enforcement route.
Chapters 1–3 of the kit pair legal structure and regulators with operational topics. When you review a regulator, write down its remit and the type of conduct you would investigate. This connects the name of an agency to a candidate decision you can explain under time pressure.
II. Federal privacy laws
Compare federal consumer protection and the healthcare, financial, education, telecommunications and marketing contexts named in the blueprint. For each context, list the organization, the kind of record, a typical action and the source that would help you check whether a rule applies. Chapters 4–7 cover these areas in the kit.
Consumer reports provide a useful source-reading exercise. Open 15 U.S.C. § 1681b and identify where subsection (b) discusses employment purposes. Record which paragraph you would read for obtaining a report and which one addresses adverse action. Keep the subsection, statutory exceptions and the date you checked it together in your notes.
III. Government and court access
Organize your notes by requester and process. Draw separate paths for law enforcement, national security and civil litigation, as the blueprint does. For each path, identify the type of record, who holds it and the authority invoked. Chapter 8 uses that distinction to organize requests for records and electronic discovery.
As a study exercise, compare two requests to the same company for the same record. Change who made the request and why. List the facts you would need to verify before determining which process applies, including the identity of the requester, the authority named in the request and the scope of the records sought.
IV. Workplace privacy
Make a timeline covering recruitment, employment and departure. Sort topics such as screening, monitoring, investigations and record retention into the relevant stage. Keep the applicable jurisdiction and the identity of any third party next to each note. Chapter 9 follows the same timeline so you can see where overlapping topics fit.
V. State privacy laws
The outline covers state authority, data privacy and security rules, and breach notification. Compare scope, rights, exceptions and enforcement across examples in the outline. In a separate row, track the facts that would matter to a breach review, such as the data involved and the jurisdiction of the affected people. Chapters 10–12 of the kit follow that progression.
Keep a date next to any state-law note, and start from the statute or regulator when you check a detail. When you review an older resource, compare the topic with v2.6.1 and confirm that its legal example still applies as described. Record the difference between when a law was enacted and when the relevant provision took effect.
How can you tell whether a resource matches the current blueprint?
Open the Body of Knowledge from the CIPP/US credential page and check its version and effective date. Then compare the performance indicators with the headings in your resource. A guide can have the right five domain names and still omit an objective added beneath one of them. Mark those gaps before choosing what to review.
Track blueprint changes and legal changes in separate notes. The first tells you which topics IAPP lists for the exam. The second tells you when an authority or example was checked. If your notes disagree with a published source, go back to the original text and date before memorizing a rule.