CIPP/C study guide
CIPP/C · Work through your exam, one topic at a time.
The Certified Information Privacy Professional/Canada (CIPP/C) is a professional credential in the CIPP family of privacy certifications. IAPP describes itself as "a policy neutral, not-for-profit association founded in 2000 with a mission to define, promote and improve the professions of privacy, AI governance and digital responsibility globally." The CIPP/C designation is aimed at professionals whose work touches Canadian privacy obligations: privacy officers and counsel, compliance and risk staff, HR and marketing teams handling personal information, and consultants or vendors serving Canadian organizations. Candidates typically use it to demonstrate working knowledge of how privacy law and regulation operate across Canadian jurisdictions and how to build and run a privacy program against those requirements. Preparation generally starts with the exam blueprint, then combines structured study of Canadian privacy law and policy, regulation and enforcement, and program development and operations with practice on scenario-based questions that test application rather than recall. The CIPP/C study guide has 4 sections and about 1,543 words.
01Canadian Privacy Law and Policy
Canadian Privacy Law and Policy asks you to place a fact pattern in the right legal regime: the federal Privacy Act for the public sector, PIPEDA for private-sector commercial activity, provincial private-sector statutes where substantially similar, health-specific laws, and common-law torts. Expect questions on the ten PIPEDA principles, Quebec's Law 25, and the constitutional division of powers.
404 words, about 2 min02Canadian Privacy Regulation and Enforcement
Regulation and enforcement focuses on who investigates, what orders they can make, breach-reporting thresholds, and penalties. Know the federal Office of the Privacy Commissioner (OPC), provincial commissioners (CAI in Quebec, OIPC BC, OIPC Alberta, IPC Ontario), and the CRTC's CASL role.
407 words, about 2 min03Canadian Privacy Program Development and Management
Program development and management tests how you build governance, accountability, and risk controls that satisfy PIPEDA's Accountability principle and provincial requirements. The exam favors concrete program elements over security tools alone.
366 words, about 2 min04Canadian Privacy Program Operations
Operations tests day-to-day execution: consent, access and correction requests, breach response, vendor oversight, marketing rules, retention, and employee data. Questions often hinge on timelines and documentation.
366 words, about 2 min