IAPP Certifications: CIPP vs CIPM vs AIGP Compared

The International Association of Privacy Professionals (IAPP) offers the best-known certifications in data protection and privacy. As AI regulation and governance have grown in importance, the IAPP has added an AI governance credential alongside its long-standing privacy certifications. Three names come up most often: CIPP (Certified Information Privacy Professional), CIPM (Certified Information Privacy Manager) and AIGP (Artificial Intelligence Governance Professional). They are complementary rather than competing, but most people start with one. This guide explains the differences and how to choose.

The quick comparison

• CIPP is about the law: what privacy and data protection rules require in a specific jurisdiction.
• CIPM is about operations: how to build, run and improve a privacy programme in an organisation.
• AIGP is about AI governance: how to develop, deploy and oversee AI systems responsibly, considering law, risk and ethics.

The IAPP also offers CIPT (Certified Information Privacy Technologist), which focuses on privacy in technology and engineering. Combinations of IAPP certifications can lead to the Fellow of Information Privacy (FIP) designation; check the IAPP's current criteria if that interests you.

CIPP: privacy law and regulation

CIPP is offered in regional concentrations. Common ones include CIPP/E (Europe, centred on the GDPR and related European law), CIPP/US (US private-sector privacy), CIPP/C (Canada) and CIPP/A (Asia). Check the IAPP website for the full, current list.

Who it suits

• Lawyers, in-house counsel and paralegals
• Compliance officers and data protection officers
• Anyone who needs to interpret and apply privacy law

Choose the concentration that matches where your organisation operates or where your customers are. Many professionals in Europe start with CIPP/E; those working with US companies may add CIPP/US. Each concentration is a separate exam, so if you work across several regions, start with the jurisdiction that matters most to your current role and add others later.

Remember that CIPP tests your understanding of the law rather than your ability to give legal advice. You do not need to be a lawyer to pass, but you do need to read carefully and learn key definitions, principles and obligations precisely.

CIPM: running a privacy programme

CIPM is jurisdiction-neutral. It focuses on how privacy works day to day: programme governance, policies, data inventories and mapping, privacy impact assessments, data subject requests, training and awareness, vendor management, incident response and measuring programme performance.

Who it suits

• Privacy programme managers and DPOs
• Risk, compliance and information governance professionals
• Project managers and operations leads responsible for privacy

A common pairing is CIPP plus CIPM: one proves you understand the law, the other shows you can put it into practice.

AIGP: AI governance

AIGP is the IAPP's newer credential for professionals responsible for AI governance. At a high level, it covers the foundations of AI and how it works, how existing and emerging laws and standards apply to AI (including privacy law and AI-specific regulation), AI risk management, and governing AI across its lifecycle, from design and data through deployment and monitoring.

Who it suits

• Privacy and legal professionals whose remit now includes AI
• Risk, compliance and ethics teams
• Product managers, data scientists and technology leaders overseeing AI use

Because AI regulation is developing quickly, the AIGP body of knowledge is updated more often than older certifications. Always use the current version from the IAPP.

Exam format and practical details

IAPP exams are computer-based, multiple-choice tests that can be taken at a test centre or online with remote proctoring. Many questions are scenario-based, asking you to apply knowledge rather than recall it. The IAPP publishes a body of knowledge and exam blueprint for each certification, showing the domains and how many questions come from each. Question counts, time limits, fees and passing standards are set by the IAPP and can change, so check the official candidate handbook before booking. If you are testing at home, our online proctored exam checklist will help.

Certification is maintained through continuing privacy education credits and a maintenance fee, which may be covered by IAPP membership.

How to choose and how to prepare

1. Start with your job. Interpreting law points to CIPP; running processes points to CIPM; overseeing AI points to AIGP.
2. Read the body of knowledge for each option and see which feels most relevant.
3. Use the official textbook and practice questions where available, as the exams are closely aligned to IAPP materials.
4. Practise scenarios. For each concept, ask how it would apply to a real organisation.
5. Build a glossary. Terms like controller, processor, legitimate interest and data minimisation must be understood precisely.

How a personal 1-to-1 assistant can help

Privacy and AI governance material is dense, and scenario questions often hinge on subtle distinctions. A personal 1-to-1 study assistant can help you pick the right certification for your career, plan your reading against the body of knowledge, explain tricky legal and governance concepts in plain English and talk through practice scenarios. With FoxyCert, you chat with your assistant on Telegram whenever it suits you. You sit your own exam; FoxyCert provides coaching, and the package keeps all services included until you pass. See FoxyCert's 1-to-1 exam prep. You may also find our guide to ISACA's AI certifications useful.