IAPP-CIPP-C Exam Information and Outline
Certified Information Privacy Professional/Canada (CIPP/C)
IAPP-CIPP-C Exam Syllabus & Study Guide
Before you start practicing with our exam simulator, it is essential to understand the official IAPP-CIPP-C exam objectives. This course outline serves as your roadmap, breaking down exactly which technical domains and skills will be tested. By reviewing the syllabus, you can identify your strengths and focus your study time on the areas where you need the most improvement.
The information below reflects the latest 2026 course contents as defined by IAPP. We provide this detailed breakdown to help you align your preparation with the actual exam format, ensuring there are no surprises on test day. Use this outline as a checklist to track your progress as you move through our practice question banks.
Below are complete topics detail with latest syllabus and course outline, that will help you good knowledge about exam objectives and topics that you have to prepare. These contents are covered in questions and answers pool of exam.
Exam Code: IAPP CIPP/C
Exam Name: IAPP Certified Information Privacy Professional/Canada (CIPP/C)
Exam Format: Multiple choice questions (MCQs)
Number of Questions: 90 questions
Time Allotted: 2.5 hours (150 minutes)
Passing Score: The IAPP uses a scaled scoring system, but the raw passing mark is generally considered to be around 75% (i.e., approximately 68 correct answers out of 90). The passing score is 300 on a scale of 100-500.
I. Introduction to Canadian Privacy Environment 20%
- Structure of Canadian law (constitutional foundation, federalism, Charter of Rights and Freedoms, common law vs. civil law in Quebec)
- Canadian legal system and sources of privacy law
- Key privacy concepts (personal information, consent, accountability, openness, etc.)
- Evolution of privacy law in Canada
- Role of privacy commissioners (federal OPC and provincial commissioners)
- Enforcement models (ombudsman vs. order-making powers)
II. Federal Private-Sector Privacy Law: PIPEDA and Substantially Similar Provincial Laws 35–40%
- Application and Scope
- Public vs. private sector
- Commercial activities
- Employee personal information in federally regulated organizations
- Substantially similar provincial laws (BC PIPA, Alberta PIPA, Quebec Private Sector Act)
- Health information laws (when they override PIPEDA (BC, Alberta, Ontario, New Brunswick, Newfoundland & Labrador, etc.)
- The 10 Fair Information Principles (Schedule 1 of PIPEDA)
- Accountability
- Identifying purposes
- Consent (including implied/expressed, opt-in/opt-out, withdrawal)
- Limiting collection
- Limiting use, disclosure, and retention
- Accuracy
- Safeguards
- Openness
- Individual access
- Challenging compliance
- Key compliance obligations
- Privacy policies and notices
- Privacy management programs
- Appointment of a privacy officer
- Breach notification requirements (mandatory since Nov 2018)
- Cross-border data flows and transfers (Accountability principle, APEC CBPR, EU adequacy decisions, etc.)
- Children’s privacy and CASL interaction
- Oversight and enforcement
- OPC investigations and findings
- Commissioner-initiated complaints
- Federal Court hearings and remedies
- New powers under proposed Bill C-27 / CPPA (if enacted by exam date)
III. Provincial Laws 25–30%
- Public Sector Privacy Laws
- Federal: Privacy Act
- Provincial: FIPPA/MFIPPA (Ontario), FOIP (Alberta), ATIPPA (Newfoundland), etc.
- Municipal: MFIPPA (Ontario)
- Provincial Private-Sector Privacy Laws
- Quebec Law 25 (formerly Law 25 – Act to modernize legislative provisions respecting the protection of personal information)
- British Columbia PIPA
- Alberta PIPA
- Differences from PIPEDA (consent, breach notification, private right of action in Quebec, etc.)
- Provincial Health Information Acts (very high yield)
- Ontario PHIPA (Personal Health Information Protection Act)
- British Columbia Personal Information Protection Act (health provisions)
- Alberta HIA
- New Brunswick PHIPAA
- Role of health information custodians, agents, circle of care, express consent requirements
IV. Emerging Developments and Specialized Topics 15–20%
- Anti-spam legislation (CASL) – interaction with privacy
- Artificial intelligence, automated decision-making (Directive A-1, Bill C-27/CPPA proposed rules)
- De-identification, anonymization, and pseudonymization standards
- Privacy by Design (PbD) and privacy impact assessments (PIAs/TIAs)
- Online behavioral advertising (OPC guidelines)
- Workplace privacy (video surveillance, biometric data, monitoring, drug testing)
- Transborder data flows and international transfers
- Children and minors’ privacy (Quebec, OPC guidelines)
- Political party and election privacy (provincial election laws)
- Proposed Consumer Privacy Protection Act (CPPA) / Bill C-27 / Digital Charter Implementation Act (if passed by exam date – know the major proposed changes)
- High-Yield Topics (appear very frequently)
- Differences between PIPEDA and provincial health laws (especially Ontario PHIPA)
- Breach reporting requirements (federal vs. Alberta vs. Quebec)
- Consent exceptions (Schedule 1, clause 4.3)
- Substantially similar designation process
- Health Information Custodian vs. agent under PHIPA
- Quebec Law 25 requirements (DPO appointment, privacy impact assessments, default privacy settings)
- Cross-border transfers and accountability