Free CIPM Mock Exam
CIPM (Certified Information Privacy Manager)
This free CIPM mock exam has 200 original practice questions on privacy programme governance and management, with no sign-up. The real IAPP CIPM exam has 90 multiple-choice questions in 2.5 hours, scored from 100 to 500 with 300 needed to pass.
Start the mock
Exam-format mock
90 questions drawn at random from the bank, 150-minute timer — the length of the real IAPP exam.
Whole question bank
All 200 questions in order (200 Q Pattern), 150-minute timer — the original app's setting.
- Includes case studies.
- Real-time countdown; pause and resume are not available.
- Review answers and explanations at the end.
- The timer starts when you press Start. Answers stay in this browser tab only; leaving or refreshing ends the attempt.
Key facts
| Real IAPP exam | This mock | |
|---|---|---|
| Questions | 90 | 200 in the bank; exam-format mode draws 90 |
| Time | 2.5 hours (150 min) | 150 min (exam format) or 150 min (whole bank) |
| Scoring | Scored 100–500; 300 passes (IAPP stresses this is not 60%) | Percentage correct; unanswered counts as not correct |
| Explanations | — | Yes, in the answer review |
| Cost / sign-up | Paid | Free, no sign-up |
Exam facts verified against IAPP on 4 October 2026.
Sample questions
1. Based on the principles of privacy governance models, what is the best strategic recommendation for AstraLogistics to maintain brand consistency while addressing local legal requirements?
- A. Adopt a hybrid governance model where the central office issues core directives and local entities fulfill them through specialized regional compliance hubs.
- B. Maintain the centralized model but hire additional privacy analysts in London to research local laws in Brazil and Singapore remotely.
- C. Fully decentralize the program, allowing "PortoSafe" and the Singapore branch to manage their own privacy budgets.
- D. Standardize all global operations to follow the most restrictive jurisdiction (Germany).
Answer: A. Adopt a hybrid governance model where the central office issues core directives and local entities fulfill them through specialized regional compliance hubs.
Explanation: A hybrid model allows a large organization to assign central responsibility while allowing local entities to fulfill specific local mandates.
2. According to the "Protect" phase guidelines for new technologies, what is a "Deepfake" and what control is recommended?
- A. A corrective control.
- B. It is the use of AI to manipulate media; the AI system should inform users they are interacting with AI.
- C. A detective control.
- D. A form of encryption.
Answer: B. It is the use of AI to manipulate media; the AI system should inform users they are interacting with AI.
Explanation: A deepfake uses AI to manipulate media; AI systems must inform data subjects they are interacting with an AI.
3. Why should "Technical Advice" be sought before sharing data where different systems are involved?
- A. Salary cost.
- B. Because there is a potential security risk that could result in loss, corruption, or degradation of data.
- C. Move to Level 1.
- D. Just-in-Time.
Answer: B. Because there is a potential security risk that could result in loss, corruption, or degradation of data.
Explanation: Different systems involved in data sharing pose a security risk that could result in loss/corruption.
4. Privacy Maturity Model has how many levels?
- A. Three.
- B. Four.
- C. Five.
- D. Six.
Answer: C. Five.
Explanation: Five maturity levels.
5. The OECD "Collection Limitation" principle states that personal data should be obtained how?
- A. Secretly to avoid user pushback.
- B. By lawful and fair means and, where appropriate, with knowledge or consent.
- C. By scraping any public website.
- D. Only via automated decision-making.
Answer: B. By lawful and fair means and, where appropriate, with knowledge or consent.
Explanation: Lawful/fair means with knowledge/consent.
Study with PrivacyLawHub
Frequently asked questions
- How many questions are on the real CIPM exam, and how long is it?
- 90 multiple-choice questions in 2.5 hours (150 minutes).
- What is the passing score?
- IAPP exams are scored from 100 to 500, and 300 passes. IAPP stresses that 300 is not the same as 60%.
- Are these real exam questions?
- No. They are original practice questions written by the author, not IAPP exam or IAPP practice-exam questions.
- Is this affiliated with the IAPP?
- No. PrivacyLawHub is independent and is not affiliated with or endorsed by the IAPP.
- Is it free, and do I need to sign up?
- It is free and needs no account. Your attempt runs in your browser tab and is not saved.
- How does this differ from IAPP's official practice exam?
- IAPP sells its own official practice exam. This mock is an independent bank of original questions; its percentage score is not an IAPP scaled score.
Questions written and reviewed by Shubhank Suman, CIPP/E, CIPM, AIGP.
CIPP/E, CIPM and AIGP are registered trademarks of the IAPP. PrivacyLawHub is not affiliated with or endorsed by the IAPP.
Related: CIPP/E Mock Exam · AIGP Mock Exam · DPDPA Exam