CIPP/USIAPP certification

How CIPP/US maintenance works

CPEs are logged in your IAPP account (My CPEs); each entry needs an activity title, date, provider, and hours. IAPP audits a sample of members and asks for documentation, so keep certificates or agendas.

The maintenance fee and IAPP membership are related but distinct: the certification maintenance fee keeps the credential active, while IAPP membership (bundled for many) unlocks the free CPE sources below. Verify current fee amounts on IAPP's site — they're periodically updated.

What counts as a privacy CPE

IAPP makes earning 20 CPEs over two years straightforward for anyone working in privacy. The richest free source is IAPP itself: web conferences, assessed Privacy Advisor and Resource Center content, and KnowledgeNet chapter meetings. Members typically clear the requirement from IAPP programming alone.

Outside IAPP, qualifying activities include privacy-relevant conferences (the IAPP Global Privacy Summit, the privacy tracks at events like RSA), law-firm and privacy-tech vendor webinars, relevant university coursework, and authoring or presenting on privacy topics. The test is relevance to the privacy profession, not the IAPP body of knowledge specifically.

Teaching, writing, and serving on privacy boards earn CPEs too, often at higher category rates — check IAPP's current category rules before assuming a flat 1-per-hour.

One CPE pool across multiple IAPP credentials

IAPP's structure rewards holding more than one credential. The CIPP designations (CIPP/US, /E, /C, /A) and the cross-cutting CIPM and CIPT share a combined CPE and maintenance structure rather than each demanding a wholly separate 20 CPEs — so a privacy pro holding CIPP/US plus CIPM doesn't simply double the work.

The exact multi-credential math — how many additional CPEs each extra designation adds, and how the single maintenance fee scales — is set by IAPP's current CPE policy. Confirm it against your account, as IAPP has adjusted the combined-credential rules over time.

Practical takeaway: if you're adding a second IAPP credential, the marginal maintenance burden is modest, which is why many privacy professionals stack CIPP/US with CIPM (management) or a second-jurisdiction CIPP.

Common pitfalls (and how to avoid them)

Pitfall 1: Treating the maintenance fee as the whole story. Paying the fee keeps the account current, but you still owe the 20 CPEs — and earning CPEs doesn't waive the fee. Both must be satisfied within the 2-year term.

Pitfall 2: The 2-year cadence. CIPP/US runs on a 2-year cycle, shorter than the 3-year CompTIA and ISC2 cycles. 20 CPEs over two years is 10 per year — small, but easy to forget until the term is closing.

Pitfall 3: Undocumented CPEs. IAPP audits a sample; self-reported activities without a certificate, agenda, or confirmation are the ones that fail. Save evidence when you earn it, especially for non-IAPP activities.