Free IAPP CIPP-US Exam Actual Questions & Explanations

Last updated on: Aug 12, 2026
Author: Aubrey Perez (Senior Privacy Compliance Educator, IAPP)

The CIPP-US exam, offered by IAPP (International Association of Privacy Professionals), validates your expertise in U.S. privacy law and regulations. This certification demonstrates that you understand the legal landscape governing data collection, use, and protection across federal and state jurisdictions. Whether you work in compliance, legal, technology, or business operations, the Certified Information Privacy Professional/United States credential signals competency to employers and peers. This page guides you through the exam syllabus, question formats, and a focused preparation strategy to help you pass with confidence.

CIPP-US Exam Syllabus & Core Topics

Use this topic map to guide your study for IAPP CIPP-US (Certified Information Privacy Professional/United States) within the Certified Information Privacy Professional path.

  • Introduction to the U.S. Privacy Environment: Understand the foundational principles, historical context, and key stakeholders that shape U.S. privacy regulation. You must recognize how constitutional, common law, and statutory frameworks interact.
  • Limits on Private-Sector Collection and Use of Data: Learn the rules governing how organizations can gather, store, and process personal information. Analyze consent requirements, purpose limitations, and data minimization principles in practice.
  • Federal Privacy Laws: Master the major statutes including GLBA, HIPAA, FCRA, CAN-SPAM, and others. Identify which laws apply to your industry and what compliance obligations they impose.
  • Government and Court Access to Private-Sector Information: Examine subpoenas, warrants, national security letters, and regulatory investigations. Determine when and how to respond to government requests while protecting individual rights.
  • Workplace Privacy: Evaluate employee monitoring, background checks, and workplace surveillance policies. Balance employer interests with employee privacy expectations and legal constraints.
  • State Privacy Laws: Understand the growing patchwork of state regulations including CCPA, VCCPA, and emerging comprehensive privacy laws. Apply multi-state compliance strategies to real-world scenarios.
  • The U.S. Privacy Environment: Synthesize all topics to assess how regulatory, technological, and business trends reshape privacy obligations. Develop strategies that adapt to evolving legal requirements.

Question Formats & What They Test

The CIPP-US exam measures both foundational knowledge and the ability to apply privacy principles to realistic business situations. Questions progress in difficulty and require you to think critically about compliance decisions.

  • Multiple Choice: Test your recall of definitions, key legal requirements, and terminology. For example, identify which law governs health information or recognize the scope of CCPA exemptions.
  • Scenario-Based Items: Present real-world cases where you analyze facts and select the best privacy or compliance approach. Example: determine whether a data sharing agreement complies with federal law or identify the correct response to a government data request.
  • Application Questions: Require you to connect multiple topics, such as evaluating how state privacy laws interact with federal requirements or designing a compliant data retention policy.

Questions become progressively harder as you advance, rewarding both breadth of knowledge and depth of practical reasoning.

Preparation Guidance

An effective study routine maps the seven core topics to a realistic timeline, allowing you to build knowledge progressively and test yourself frequently. Dedicate time each week to a different topic, then integrate concepts across the broader privacy landscape.

  • Break the syllabus into weekly study blocks: assign Introduction to the U.S. Privacy Environment and The U.S. Privacy Environment to foundational weeks; dedicate separate weeks to Federal Privacy Laws, State Privacy Laws, and Limits on Private-Sector Collection and Use of Data; allocate final weeks to Government and Court Access to Private-Sector Information and Workplace Privacy.
  • Complete practice question sets after each topic; review explanations carefully to identify knowledge gaps and reinforce correct reasoning.
  • Connect concepts across workflows: understand how federal law sets a baseline, state laws add restrictions, and workplace policies must satisfy both.
  • Run a timed practice test one week before your exam date to build pacing confidence and identify any remaining weak areas.
  • In your final review, focus on high-weight topics (federal and state privacy laws) and common compliance pitfalls.

Explore other IAPP certifications: view all IAPP exams.

Get the PDF & Practice Test

Strengthen your preparation with up-to-date resources from validexamdumps.com. These materials align to CIPP-US and cover practical scenarios with clear explanations.

  • Q&A PDF with explanations: topic-mapped questions that clarify why correct options are right and others aren't.
  • Practice Test: realistic items, timed and untimed modes, progress tracking, and detailed review.
  • Focused coverage: aligned to Introduction to the U.S. Privacy Environment, Limits on Private-Sector Collection and Use of Data, Federal Privacy Laws, Government and Court Access to Private-Sector Information, Workplace Privacy, State Privacy Laws, and The U.S. Privacy Environment so you study what matters most.
  • Regular reviews: content refreshes that reflect syllabus and product changes.

Visit the exam page to download the PDF, Online Practice Test, or get a bundle discount for both formats: Certified Information Privacy Professional/United States.

Frequently Asked Questions

What topics carry the most weight on the CIPP-US exam?

Federal Privacy Laws and State Privacy Laws typically represent the largest portion of the exam, reflecting their importance in daily compliance work. Government and Court Access to Private-Sector Information and Limits on Private-Sector Collection and Use of Data also carry significant weight. Balance your study time accordingly, spending more hours on these high-impact areas while ensuring you have solid foundational knowledge across all topics.

How do the different privacy law topics connect in real compliance projects?

In practice, you start with federal baseline requirements (GLBA, HIPAA, FCRA), then layer on state-specific rules (CCPA, VCCPA), and finally apply industry-specific policies to Workplace Privacy and data handling. Government requests often trigger all three: you must know federal disclosure rules, state privacy law exemptions, and your own retention policies. Understanding these connections helps you answer scenario-based questions and handle actual compliance scenarios.

How much hands-on experience helps, and what should I prioritize?

Direct experience with privacy policies, data handling procedures, or compliance audits strengthens your ability to apply exam concepts. If you lack hands-on experience, prioritize studying real-world case studies and scenario questions that show how laws apply to common business situations. Reading actual privacy policies and compliance frameworks (available online) also builds practical intuition without requiring a job change.

What are common mistakes that cost exam points?

Candidates often confuse federal law scope with state law scope, miss exemptions and exceptions in statutes, or fail to distinguish between private-sector and government obligations. Another frequent error is misidentifying which law applies to a given fact pattern. Avoid these by carefully reading scenario details, noting keywords like "employee" or "health information," and reviewing exemption lists during practice.

What is the best pacing and review strategy in the final week?

In your final week, take one full-length timed practice test to simulate exam conditions and identify any remaining gaps. Spend the next three days reviewing only your weak topics and re-reading explanations for questions you missed. In the last two days, do a light review of high-weight topics (Federal and State Privacy Laws) without introducing new material. Get adequate sleep the night before the exam; fatigue hurts reasoning more than last-minute cramming helps.

Get All 195 Questions
Question No. 1

Which of the following best describes an employer's privacy-related responsibilities to an employee who has left the workplace?

Show Answer Hide Answer
Correct Answer: D

Employers have a duty to protect the personal information of their current and former employees, as well as applicants, from unauthorized access, use, or disclosure. This duty may arise from federal or state laws, such as the Fair Credit Reporting Act (FCRA), the Health Insurance Portability and Accountability Act (HIPAA), or the California Consumer Privacy Act (CCPA), or from contractual obligations, such as non-disclosure agreements or privacy policies. Employers may retain sensitive employment records, such as performance evaluations, disciplinary actions, medical records, or background checks, for a legitimate business purpose, such as complying with legal requirements, defending against lawsuits, or conducting audits. However, employers must ensure that these records are stored securely, accessed only by authorized personnel, and disposed of properly when no longer needed.Reference:IAPP CIPP/US Study Guide, Chapter 4, Section 4.1.1,IAPP CIPP/US Body of Knowledge, Domain IV, Objective B


Question No. 2

A financial services company install "bossware" software on its employees' remote computers to monitor performance. The software logs screenshots, mouse movements, and keystrokes to determine whether an employee is being productive. The software can also enable the computer webcams to record video footage.

Which of the following would best support an employee claim for an intrusion upon seclusion tort?

Show Answer Hide Answer
Correct Answer: A

An intrusion upon seclusion tort occurs when someone intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, if the intrusion would be highly offensive to a reasonable person12.The intrusion does not need to involve a physical trespass, but can also be an electronic or optical intrusion, such as using a webcam to record a person who has a reasonable expectation of privacy2.The intrusion must also cause mental anguish or suffering to the plaintiff2.

In this case, option A would best support an employee claim for an intrusion upon seclusion tort, because the webcam is enabled to record video any time the computer is turned on, regardless of whether the employee is working or not, or whether the employee is in a private or public place. This would be an intentional and highly offensive intrusion into the employee's seclusion or private affairs, and would likely cause the employee distress or anxiety.

Option B would not support an intrusion upon seclusion tort, because the creation and saving of a biometric template based on keystroke dynamics is not an intrusion into the employee's seclusion or private affairs, but rather a data collection and processing activity that may implicate other privacy laws or principles, such as notice, consent, and security3.

Option C would not support an intrusion upon seclusion tort, because the software sending a notification to a supervisor when the employee's mouse is dormant for more than five minutes is not an intrusion into the employee's seclusion or private affairs, but rather a performance monitoring activity that may be justified by the employer's legitimate business interests4.

Option D would not support an intrusion upon seclusion tort, because the webcam recording video of an employee using a company laptop to perform personal business while at a coffee shop during work hours is not an intrusion into the employee's seclusion or private affairs, but rather a misuse of company property and time that may be subject to the employer's policies and disciplinary actions5.Moreover, the employee may not have a reasonable expectation of privacy in a public place like a coffee shop.Reference:1:Intrusion on seclusion - Wikipedia2:Elements of an Intrusion Claim | Digital Media Law Project3: Biometrics - IAPP4: Employee Monitoring - IAPP5: Employee Privacy - IAPP : Privacy in Public Places - IAPP


Question No. 3

The Family Educational Rights and Privacy Act (FERPA) requires schools to do all of the following EXCEPT?

Show Answer Hide Answer
Correct Answer: D

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records and gives parents or eligible students the right to access, amend, and control the disclosure of their records. FERPA applies to all educational agencies and institutions that receive funds under any program administered by the U.S.Department of Education12

FERPA requires schools to do all of the following:

Verify the identity of students who make requests for access to their records.Schools must use reasonable methods to identify and authenticate the identity of parents, students, school officials, and any other parties to whom they disclose education records12

Provide students with access to their records within a specified amount of time. Schools must provide parents or eligible students with an opportunity to inspect and review the student's education records within 45 days of receiving a request.Schools are not required to provide copies of records unless it is impossible for parents or eligible students to review the records at the school12

Respond to all reasonable student requests regarding explanation of their records. Schools must provide parents or eligible students with an opportunity to request the amendment of the student's education records that they believe are inaccurate, misleading, or otherwise in violation of the student's privacy rights. Schools must consider the request and decide whether to amend the records within a reasonable time.If the school decides not to amend the records, it must inform the parent or eligible student of their right to a hearing on the matter12

FERPA does not require schools to do the following:

Obtain student authorization before releasing directory information in their records. Directory information is information contained in a student's education record that would not generally be considered harmful or an invasion of privacy if disclosed. Examples of directory information include the student's name, address, phone number, e-mail address, date and place of birth, major field of study, participation in sports and activities, dates of attendance, degrees and awards received, and most recent school attended. Schools may disclose directory information without consent unless the parent or eligible student has opted out of such disclosure.Schools must notify parents and eligible students of the types of information they designate as directory information and of their right to opt out of directory information disclosure12

Therefore, the correct answer is D. Obtain student authorization before releasing directory information in their records.


Family Educational Rights and Privacy Act (FERPA)

IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 4: Federal Privacy Laws, Section 4.3: The Family Educational Rights and Privacy Act (FERPA)

Question No. 4

A student has left high school and is attending a public postsecondary institution. Under what condition may a school legally disclose educational records to the parents of the student without consent?

Show Answer Hide Answer
Correct Answer: C

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of students' educational records. FERPA generally requires schools to obtain written consent from students before disclosing their records to third parties, such as parents. However, FERPA allows some exceptions to this rule, such as when the disclosure is for health or safety emergencies, or when the student is still a dependent for tax purposes. According to FERPA, a school may disclose educational records to the parents of a student who is claimed as a dependent on the parents' most recent federal income tax return, without the student's consent. This exception applies regardless of the student's age or enrollment status at a postsecondary institution.Reference:

IAPP CIPP/US Body of Knowledge, Section III, C, 2

[IAPP CIPP/US Study Guide, Chapter 3, Section 3.5]

[FERPA, 34 CFR 99.31(a)(8)]


Question No. 5

What is a key way that the Gramm-Leach-Bliley Act (GLBA) prevents unauthorized access into a person's back account?

Show Answer Hide Answer
Correct Answer: D

The GLBA prohibits financial institutions from disclosing a consumer's account number or similar form of access number or access code to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer. This restriction is intended to prevent unauthorized access to a person's bank account by third parties who may use the account number to initiate fraudulent transactions or identity theft. The GLBA also requires financial institutions to implement safeguards to protect the security, confidentiality, and integrity of customer information, and to notify customers and regulators in the event of a security breach involving such information.Reference:

IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 2: Limits on Private-sector Collection and Use of Data, Section 2.3: Financial Privacy, p. 49-50

IAPP CIPP/US Body of Knowledge, Domain II: Limits on Private-sector Collection and Use of Data, Objective II.C: Identify the privacy requirements for financial institutions, Subobjective II.C.2: Identify the restrictions on disclosure of account numbers, p. 14

IAPP CIPP/US Exam Blueprint, Domain II: Limits on Private-sector Collection and Use of Data, Objective II.C: Identify the privacy requirements for financial institutions, Subobjective II.C.2: Identify the restrictions on disclosure of account numbers, p. 5


Get All 195 Questions Explore Other IAPP Exams