IAPP CIPP/CN study materials
IAPP CIPP/CN study resources

IAPP CIPP/CN study guide

IAPP CIPP/CN · Work through your exam, one topic at a time.

The CIPP/CN is the China-focused credential in the IAPP's Certified Information Privacy Professional family, aimed at practitioners whose work touches Chinese data protection law: in-house and outside counsel, privacy and compliance managers, security and data governance staff, consultants, and vendors serving Chinese or multinational clients. The IAPP describes itself as a policy neutral, not-for-profit association founded in 2000 with a mission to define, promote and improve the professions of privacy, AI governance and digital responsibility globally, and it lists certifications, certification FAQs and certification training among its offerings. Candidates typically prepare for a China-focused privacy exam by working through the underlying statute and its implementing rules, then the enforcement record, then operational compliance design, then cross-border transfer mechanics - the four areas such a credential normally tests. This page does not claim any official affiliation with the IAPP, and it does not state exam length, time limit, passing score, fee, retake policy or validity period, because the IAPP certification page for this credential returned a 404 error when retrieved and the retrieved IAPP material contains no exam logistics. The IAPP CIPP/CN study guide has 4 sections and about 1,601 words.

01

China Data Protection Law and Policy

China’s data regime is layered, not a single code. The Cybersecurity Law (CSL, 2017) establishes network operator duties, MLPS grading, and critical information infrastructure (CII) protection.

411 words, about 2 min
02

China Data Protection Regulation and Enforcement

The Cyberspace Administration of China (CAC) leads PIPL and cross-border enforcement, supported by provincial CAC offices. MIIT polices telecoms and apps, MPS handles cybersecurity crimes, SAMR handles consumer protection, and PBOC/NRTA regulate finance.

392 words, about 2 min
03

China Data Protection Practice and Compliance

Start with a data inventory: systems, purposes, data categories, retention, vendors, and cross-border flows. Classify PI, sensitive PI, and important data separately; important data is a DSL concept and can include non-PI.

408 words, about 2 min
04

China Data Protection Landscape and Cross-Border Considerations

PIPL Article 38 allows transfers only through one of: CAC security assessment; certification by a professional institution; a CAC standard contract; or another legal route. Article 39 adds separate consent and disclosure of the overseas recipient’s identity, contact, purposes, method, categories, and rights exercise.

390 words, about 2 min