IAPP CIPP / US Certified Information Privacy Professional Study Guide
Description
Prepare for success on the IAPP CIPP/US exam and further your career in privacy with this effective study guide - now includes a downloadable supplement to get you up to date on the current CIPP exam effective September 2025!
Information privacy has become a critical and central concern for small and large businesses across the United States. At the same time, the demand for talented professionals able to navigate the increasingly complex web of legislation and regulation regarding privacy continues to increase.
Written from the ground up to prepare you for the United States version of the Certified Information Privacy Professional (CIPP) exam, Sybex's IAPP CIPP/US Certified Information Privacy Professional Study Guide also readies you for success in the rapidly growing privacy field.
You'll efficiently and effectively prepare for the exam with online practice tests and flashcards as well as a digital glossary. The concise and easy-to-follow instruction contained in the IAPP/CIPP Study Guide covers every aspect of the CIPP/US exam, including the legal environment, regulatory enforcement, information management, private sector data collection, law enforcement and national security, workplace privacy and state privacy law, and international privacy regulation.
- Provides the information you need to gain a unique and sought-after certification that allows you to fully understand the privacy framework in the US
- Fully updated to prepare you to advise organizations on the current legal limits of public and private sector data collection and use
- Includes 1 year free access to the Sybex online learning center, with chapter review questions, full-length practice exams, hundreds of electronic flashcards, and a glossary of key terms, all supported by Wiley's support agents who are available 24x7 via email or live chat to assist with access and login questions
Perfect for anyone considering a career in privacy or preparing to tackle the challenging IAPP CIPP exam as the next step to advance an existing privacy role, the IAPP CIPP/US Certified Information Privacy Professional Study Guide offers you an invaluable head start for success on the exam and in your career as an in-demand privacy professional.
More details
Other editions
Additional editions
Persons
ABOUT THE AUTHORS
Mike Chapple, PhD, CIPP/US, is Teaching Professor of Information Technology, Analytics, and Operations at Notre Dame's Mendoza College of Business. He is the bestselling author of over 25 technical books. He is also the Academic Director of the University's Master of Science in Business Analytics program.
Joe Shelley, CIPP/US, is the Vice President for Libraries and Information Technology at Hamilton College in New York. He oversees the information security and privacy programs, IT risk management, business intelligence and analytics, and data governance.
Content
Introduction xxi
Assessment Test xxxi
Answers to Assessment Test xxxv
Chapter 1 Privacy in the Modern Era 1
Introduction to Privacy 2
What Is Privacy? 3
What Is Personal Information? 4
What Isn't Personal Information? 5
Why Should We Care About Privacy? 7
Generally Accepted Privacy Principles 8
Management 9
Notice 9
Choice and Consent 10
Collection 10
Use, Retention, and Disposal 11
Access 11
Disclosure to Third Parties 12
Security for Privacy 12
Quality 14
Monitoring and Enforcement 14
Developing a Privacy Program 15
Crafting Strategy, Goals, and Objectives 15
Appointing a Privacy Official 16
Privacy Roles 17
Building Inventories 18
Conducting a Privacy Assessment 18
Implementing Privacy Controls 20
Ongoing Operation and Monitoring 20
Online Privacy 20
Privacy Notices 21
Privacy and Cybersecurity 21
Cybersecurity Goals 22
Relationship Between Privacy and Cybersecurity 23
Privacy by Design 24
Summary 25
Exam Essentials 25
Review Questions 27
Chapter 2 Legal Environment 31
Branches of Government 32
Legislative Branch 32
Executive Branch 33
Judicial Branch 34
Understanding Laws 36
Sources of Law 36
Analyzing a Law 41
Legal Concepts 43
Legal Liability 44
Torts and Negligence 45
Summary 46
Exam Essentials 46
Review Questions 48
Chapter 3 Regulatory Enforcement 53
Federal Regulatory Authorities 54
Federal Trade Commission 54
Federal Communications Commission 60
Department of Commerce 61
Department of Health and Human Services 61
Banking Regulators 62
Department of Education 63
State Regulatory Authorities 63
Self-Regulatory Programs 64
Payment Card Industry 65
Advertising 65
Trust Marks 66
Safe Harbors 66
Summary 67
Exam Essentials 68
Review Questions 69
Chapter 4 Information Management 73
Data Governance 74
Building a Data Inventory 74
Data Classification 75
Data Flow Mapping 77
Data Lifecycle Management 78
Workforce Training 79
Cybersecurity Threats 80
Threat Actors 81
Incident Response 86
Phases of Incident Response 86
Preparation 87
Detection and Analysis 88
Containment, Eradication, and Recovery 88
Post-Incident Activity 88
Building an Incident Response Plan 90
Data Breach Notification 93
Vendor Management 93
Summary 95
Exam Essentials 95
Review Questions 97
Chapter 5 Private Sector Data Collection 101
FTC Privacy Protection 103
General FTC Privacy Protection 103
The Children's Online Privacy Protection Act (COPPA) 104
Future of Federal Enforcement 107
Medical Privacy 110
The Health Insurance Portability and Accountability Act (HIPAA) 111
The Health Information Technology for Economic and Clinical Health Act 119
The 21st Century Cures Act 120
Confidentiality of Substance Use Disorder Patient Records Rule 121
Financial Privacy 122
Privacy in Credit Reporting 122
Gramm-Leach-Bliley Act (GLBA) 125
Red Flags Rule 129
Consumer Financial Protection Bureau 130
Educational Privacy 131
Family Educational Rights and Privacy Act (FERPA) 131
Telecommunications and Marketing Privacy 132
Telephone Consumer Protection Act (TCPA) and Telemarketing Sales Rule (TSR) 133
The Junk Fax Prevention Act (JFPA) 136
Controlling the Assault of Non-solicited Pornography and Marketing (CAN-SPAM) Act 136
Telecommunications Act and Customer Proprietary Network Information 138
Cable Communications Policy Act 139
Video Privacy Protection Act (VPPA) of 1988 140
Driver's Privacy Protection Act (DPPA) 141
Digital Advertising and Data Ethics 142
Web Scraping 143
Summary 143
Exam Essentials 144
Review Questions 146
Chapter 6 Government and Court Access to Private Sector Information 151
Law Enforcement and Privacy 152
Access to Financial Data 153
Access to Communications 157
National Security and Privacy 162
Foreign Intelligence Surveillance Act (FISA) of 1978 162
FISA Amendments Act Section 702 164
USA-PATRIOT Act 165
The USA Freedom Act of 2015 167
The Cybersecurity Information Sharing Act of 2015 168
Civil Litigation and Privacy 169
Compelled Disclosure of Media Information 170
Electronic Discovery 171
Summary 173
Exam Essentials 173
Review Questions 175
Chapter 7 Workplace Privacy 179
Introduction to Workplace Privacy 180
Workplace Privacy Concepts 180
U.S. Agencies Regulating Workplace Privacy Issues 181
U.S. Antidiscrimination Laws 182
Privacy Before, During, and After Employment 185
Automated Employment Decision Tools 186
Employee Background Screening 186
Employee Monitoring 190
Investigation of Employee Misconduct 194
Termination of the Employment Relationship 196
Summary 197
Exam Essentials 198
Review Questions 200
Chapter 8 State Privacy Laws 205
Federal Versus State Authority 206
Elements of State Privacy Laws 207
Applicability 207
Data Subject Rights 208
Privacy Notice Requirements 209
Data Protection 209
Enforcement 211
Data Breach Notification 212
Elements of State Data Breach Notification Laws 212
Key Differences Among States 214
Significant Developments 215
Other Recent Updates to State Breach Notification Laws 218
Comprehensive State Privacy Laws 220
California Consumer Privacy Act (2018) and California Privacy Rights Act (2020) 220
Virginia Consumer Data Protection Act 223
Colorado Privacy Act 226
Connecticut Data Privacy Act 229
Utah 231
Florida 232
Oregon 234
Texas 237
Montana 239
Subject-Specific State Privacy Laws 241
Health and Genetic Information 241
Online Privacy 243
Biometric Information Privacy Regulations 247
AI and Automated Decision-Making 249
Data Brokers 250
Financial Privacy 251
California Financial Information Privacy Act 252
Recent Developments 253
Marketing Laws 254
Summary 255
Exam Essentials 256
Review Questions 258
Chapter 9 International Privacy Regulation 263
International Data Transfers 264
European Union General Data Protection Regulation 265
Adequacy Decisions 268
Binding Corporate Rules 272
Standard Contractual Clauses 273
Other Approved Transfer Mechanisms 273
APEC Privacy Framework 274
Cross-Border Enforcement Issues 276
Global Privacy Enforcement Network 276
Resolving Multinational Compliance Conflicts 276
Summary 277
Exam Essentials 277
Review Questions 279
Appendix Answers to Review Questions 283
Chapter 1: Privacy in the Modern Era 284
Chapter 2: Legal Environment 285
Chapter 3: Regulatory Enforcement 287
Chapter 4: Information Management 289
Chapter 5: Private Sector Data Collection 291
Chapter 6: Government and Court Access to Private Sector Information 293
Chapter 7: Workplace Privacy 294
Chapter 8: State Privacy Laws 296
Chapter 9: International Privacy Regulation 298
Index 301
Introduction
If you're preparing to take the Certified Information Privacy Professional/US (CIPP/US) exam, you'll undoubtedly want to find as much information as you can about privacy. The more information you have at your disposal and the more hands-on experience you gain, the better off you'll be when attempting the exam. We wrote this study guide with that in mind. The goal was to provide enough information to prepare you for the test-but not so much that you'll be overloaded with information that's outside the scope of the exam.
We've included review questions at the end of each chapter to give you a taste of what it's like to take the exam. If you're already working in the privacy field, we recommend that you check out these questions first to gauge your level of expertise. You can then use the book mainly to fill in the gaps in your current knowledge. This study guide will help you round out your knowledge base before tackling the exam.
If you can answer 90 percent or more of the review questions correctly for a given chapter, you can feel safe moving on to the next chapter. If you're unable to answer that many correctly, reread the chapter and try the questions again. Your score should improve.
Don't just study the questions and answers! The questions on the actual exam will be different from the practice questions included in this book. The exam is designed to test your knowledge of a concept or objective, so use this book to learn the objectives behind the questions.
The CIPP/US Exam
The CIPP/US certification is designed to be the gold standard credential for privacy professionals working in the United States and those seeking to enter the field. It is offered by the International Association of Privacy Professionals (IAPP) and fits into the IAPP's suite of geographic-based privacy certifications.
The exam covers five major domains of privacy knowledge:
- Introduction to the U.S. Privacy Environment
- Limits on Private-Sector Collection and Use of Data
- Government and Court Access to Private-Sector Information
- Workplace Privacy
- State Privacy Laws
These five areas include a range of topics, from building a privacy program to understanding U.S. privacy laws and regulations. You'll find that the exam focuses heavily on scenario-based learning. For this reason, you may find the exam easier if you have some real-world privacy experience, although many individuals pass the exam before moving into their first privacy role.
The CIPP/US exam consists of 90 multiple-choice questions administered during a 150-minute exam period. Each of the exam questions has four possible answer options. Exams are scored on a scale ranging from 100 to 500, with a minimum passing score of 300. Every exam item is weighted equally, but the passing score is determined using a secret formula, so you won't know exactly what percentage of questions you need to answer correctly to pass. IAPP does publicly state that passing scores typically range between 65 and 80 percent correct, depending upon the specific questions on your exam.
Exam Tip
There is no penalty for answering questions incorrectly. A blank answer and an incorrect answer have equal weight. Therefore, you should fill in an answer for every question, even if it is a complete guess!
IAPP charges $550 for your first attempt at the CIPP/US exam and then $375 for retake attempts if you do not pass on the first try. More details about the CIPP/US exam and how to take it can be found in the IAPP Candidate Certification Handbook at iapp.org/certify/candidate-handbook.
You should also know that certification exams are notorious for including vague questions. You might see a question for which two of the possible four answers are correct-but you can choose only one. Use your knowledge, logic, and intuition to choose the best answer, and then move on. Sometimes, the questions are worded in ways that would make English majors cringe-a typo here, an incorrect verb there. Don't let this frustrate you; answer the question and move on to the next one.
IAPP uses a process called item seeding, which is the practice of including unscored questions on exams. It does this as part of the process of developing new versions of the exam. So, if you come across a question that does not appear to map to any of the exam objectives-or for that matter, does not appear to belong in the exam-it is likely a seeded question. Of the 90 questions on your exam, only 75 are scored-15 are unscored. You never really know whether or not a question is scored, however, so always make your best effort to answer every question.
Taking the Exam
Once you are fully prepared to take the exam, you can visit the IAPP website to purchase your exam voucher:
IAPP partners with Pearson VUE's testing centers, so your next step will be to locate a testing center near you. In the United States, you can do this based on your address or your ZIP code, while non-U.S. test takers may find it easier to enter their city and country. You can search for a test center near you at the Pearson Vue website, where you will need to navigate to "Find a test center":
In addition to the live testing centers, you may also choose to take the exam at your home or office through Pearson VUE's OnVUE service. More information about this program is available here:
home.pearsonvue.com/Test-takers/OnVUE-online-proctoring.aspx
Now that you know where you'd like to take the exam, simply set up a Pearson VUE testing account and schedule an exam. One important note: once you purchase your exam on the IAPP website, you have one year to register for and take the exam before your registration will expire. Be sure not to miss that deadline!
On the day of the test, take two forms of identification, and make sure to show up with plenty of time before the exam starts. At least one of the forms of identification must be a government-issued photo ID. Both of your forms of identification must have your first and last name, and the name must match your test registration.
Remember that you will not be able to take your notes, electronic devices (including smartphones and watches), or other materials into the exam with you.
Exam policies can change from time to time. We highly recommend that you check both the IAPP and Pearson VUE sites for the most up-to-date information when you begin your preparing, when you register, and again a few days before your scheduled exam date.
After the CIPP/US Exam
Once you have taken the exam, you will be notified of your score immediately, so you'll know if you passed the test right away. You should keep track of your score report with your exam registration records and the email address you used to register for the exam.
Maintaining Your Certification
IAPP certifications must be renewed periodically. To renew your certification, you must either maintain a paid IAPP membership or pay a $250 non-member renewal fee. You must also demonstrate that you have successfully completed 20 hours of continuing professional education (CPE).
IAPP provides information on the CPE process via its website:
Study Guide Elements
This study guide uses a number of common elements to help you prepare. These include the following:
- Summaries The summary section of each chapter briefly explains the chapter, allowing you to easily understand what it covers.
- Exam essentials The exam essentials focus on major exam topics and critical knowledge that you should take into the test. The exam essentials focus on the exam objectives provided by IAPP.
- Chapter review questions A set of questions at the end of each chapter will help you assess your knowledge and if you are ready to take the exam based on your knowledge of that chapter's topics.
Additional Study Tools
This book comes with a number of additional study tools to help you prepare for the exam. They include the following.
Go to www.wiley.com/go/sybextestprep, register your book to receive your unique PIN, and then, once you have the PIN, return to www.wiley.com/go/sybextestprep and register a new account or add this book to an existing account.
Sybex Online Learning Environment
Sybex's online learning environment lets you prepare with electronic test versions of the review questions from each chapter and the practice exams that are included in this book. You can build and take tests on specific domains, by chapter, or cover the entire set of CIPP/US exam objectives using randomized tests.
Audio Reviews
Mike Chapple, one of the authors of this book, recorded files containing the exam essentials for each chapter in a convenient audio form. Use these audio reviews in the car, on the train, when you're out for a run, or whenever you have a few minutes to review what you've learned.
Electronic Flashcards
Our electronic flashcards are designed to help you prepare for the exam. Over 100 flashcards will ensure that you know critical terms and concepts.
Glossary of Terms
Sybex provides a full glossary of terms in PDF format, allowing quick...
