If your job entails operationalizing privacy, or you are looking to gain a foothold in the burgeoning privacy and data protection industry, you’ve probably thought about becoming a Certified Information Privacy Manager (CIPM). To do that, you’ll need to pass an exam administered by the International Association of Privacy Professionals (IAPP). And in order to obtain that passing grade, you’ll first need to take a peek at document called the Body of Knowledge (BoK). The CIPM Body of Knowledge is a high-level document that lays out what topics and concepts are tested on the CIPM exam.
Each year, generally in the late Spring, the IAPP publishes an updated version of the CIPM Body of Knowledge. The IAPP does this for several reasons. First, it does not want its certification exams to get “overexposed.” But more importantly, these annual updates are necessary to keep pacing with the quickly evolving world of data protection.
After the significant changes to the CIPM Body of Knowledge that the IAPP made last year, this year’s updates are relatively modest. Below, we cover these changes in detail.
When Do These Changes Go into Effect?
First thing first, when does this new BoK become effective? The IAPP does not want to surprise test-takers, and for that reason, it publishes its annual CIPM BoK updates months before any new material will actually appear on an exam.
The changes to the 2024-2025 Body of Knowledge for the CIPM exam go into effect on September 2, 2024.
The CIPM Body of Knowledge “Competencies” and “Performance Indicators”
Last year, the IAPP unleased a sea change on the CIPM exam by adopting a new approach towards the Body of Knowledge. We explained this new structure and mapped out the old BoK to this new structure last year.
In short, the IAPP combined the Body of Knowledge with the Exam Blueprint, as well as regrouped content into high-level “competencies” and matching sets of “performance indicators.” Competencies represent “clusters of connected tasks and abilities that constitute a body of knowledge domain,” while performance indicators “are the discreet tasks and abilities that constitutes the broader competence group.”
It is little surprise that the IAPP continued this format.
Changes to the New CIPM Body of Knowledge
Now for the nitty-gritty. According to the IAPP, the changes to any exam will not represent more than 10-15% new material compared to the year prior. This year, in contrast, the changes to the CIPM BoK appear even smaller than that.
Did the Domains Change?
Domains are the highest level of organization within the CIPM Body of Knowledge. Last year, the IAPP combined domains for “developing a privacy program” with “the privacy program framework” into one larger domain (Domain I). It then added another domain (Domain II) for “establishing program governance.”
This year, we are happy to report, there are no new Domains added to the CIPM BoK. The six Domains are the same as last year:
- Domain I – Privacy Program: Developing a Framework
- Domain II – Privacy Program: Establishing Program Governance
- Domain III – Privacy Program Operational Life Cycle: Assessing Data
- Domain IV – Privacy Program Operational Life Cycle: Protecting Personal Data
- Domain V – Privacy Program Operational Life Cycle: Sustaining Program Performance
- Domain VI – Privacy Program Operational Life Cycle: Responding to Requests and Incidents
Did the Number of Questions Asked on Each Topic Change?
Just like the Domains in the 2024-2025 CIPM Body of Knowledge have not changed, the number of questions tested on each topic also did not change.
Are There Any New Topics or Concepts That Have Been Added?
You’re probably asking yourself at this point, what did change? In total, the IAPP added five new performance indicators, but did not add any new competencies. These new performance indicators include:
- Competency I.A – Performance Indicator: “Understand the organization’s business strategy and risk appetite”
- Competency I.C – Performance Indicator: “Understand the privacy risks posed by the use of AI in the business environment”
- Competency II.A – Performance Indicator: “Create data retention and disposal policies and procedures”
- Competency II.B – Performance Indicator: “Define roles and responsibilities of privacy team and stakeholders”
- Competency III.D – Performance Indicator: “Collaborate with relevant stakeholders to identify and evaluate technical controls”
In addition to the above, the performance indicators under Competencies I.A and II.B were re-ordered.
There are also some minor clerical changes made to clarify language. For example, a prior performance indicator under Competency I.A that stated “Structure the privacy team” is now listed as “Define the structure of the privacy team.” The IAPP has stated that these changes are intended only as “clarified language” and do not represent substantive changes.
Were Any Topics or Concepts Removed?
This year, the IAPP did remove one of its performance indicators. Specifically, the third performance indicator under Competency V.C (Manage continuous assessment of the privacy program) was deleted. That covered the topic of “ensur[ing] AI usage is ethical, unbiased, meets data minimization and purpose limitation expectations and is in compliance with any regulations and/or privacy laws.”
While the IAPP does not explain why it removed this topic, it is likely a result of this information now being the focus of the newly released Artificial Intelligence Governance Professional (AIGP) certification.
We should note that while there appears to be no other deletions, the new competencies-and-performance-indicators format for the CIPM BoK removes some of the details included the older format. Thus, while we doubt any sub-topics have been completely removed from being tested on the CIPM exam, it is impossible to know with certainty.
Is Privacy Bootcamp’s CIPM Course Up to Date?
Yes, all Privacy Bootcamp courses are up to date.
As is annual tradition around here, we set to work updating our courses weeks before the IAPP releases its updated BoKs based upon changes we know have occurred in the privacy and data protection industry, as well as important events and student feedback. We are never left flat-footed. Because we begin working on these updates proactively, we typically are able to release annual comprehensive updates just weeks after the IAPP publishes updated BoKs. So be on the lookout in the coming weeks for new content.
We release our CIPM course updates months ahead of when any new material will appear on an exam (for exams taken after September 2, 2024). This update will happen seamlessly for all enrolled students; there is no action needed on the part of our students. Regardless of what changes the IAPP throws at you, with Privacy Bootcamp you can rest easy knowing you will always be prepared.
