New 2025-2026 CIPT Body of Knowledge: 5 Updated Domains and What Changed

If you've been studying for the Certified Information Privacy Technologist (CIPT) exam using older materials, you need to stop and read this. Effective September 1, 2025, the IAPP restructured the CIPT Body of Knowledge (BoK) from seven domains down to five. This isn't a minor reshuffle — entire topic areas were removed, domain boundaries were redrawn, and the exam's focus was sharpened to reflect real-world privacy engineering work in 2025 and 2026. Understanding exactly what changed is critical if you want to pass on your first attempt.

This guide breaks down every change between the old and new CIPT BoK, explains what each updated domain covers, identifies the topics that were cut entirely, and gives you a concrete plan for adjusting your study strategy. Whether you're just starting your CIPT exam preparation or pivoting mid-study, this is the definitive resource for the restructured exam.

What Changed in the 2025–2026 CIPT Body of Knowledge

The IAPP periodically updates its certification exams to keep pace with the privacy landscape. For the CIPT, the 2025 update was the most significant overhaul since the credential's launch. The core change is structural: the exam went from seven domains to five, consolidating related topics and eliminating content the IAPP determined was either too speculative or not central to a privacy technologist's day-to-day responsibilities.

Beyond the structural consolidation, three major topic areas were removed from the exam entirely: quantum computing, blockchain/NFT technologies, and VR/AR (virtual reality and augmented reality). These emerging technology topics, while interesting from a privacy perspective, were deemed too nascent and too far from the practical toolkit most privacy technologists use today. The result is a leaner, more focused exam that tests what you actually need to know on the job.

Old 7-Domain Structure vs. New 5-Domain Structure

To fully appreciate the 2025 changes, you need to see the before and after side by side. The following comparison table maps the old domain structure against the new one, showing how topics were consolidated, renamed, and reorganized.

Old BoK (Pre-September 2025)	New BoK (September 2025 Onward)	What Happened
Domain 1: Foundational Principles for IT Professionals	Domain 1: The Privacy Technologist's Role in the Context of the Organization	Renamed and refocused on organizational context
Domain 2: The Role of IT in Privacy	Merged into Domain 1	Consolidated with foundational principles
Domain 3: Privacy Policy, Data Collection, and Use	Domain 2: Data Collection, Use, Dissemination, and Destruction	Expanded to cover full data lifecycle
Domain 4: Assessing and Managing Privacy Risk	Domain 3: Privacy Risk Management	Streamlined naming; core content retained
Domain 5: Privacy-Enhancing Technologies	Domain 4: Privacy-Enhancing Strategies, Techniques, and Technologies	Broadened scope beyond pure technology
Domain 6: Privacy by Design	Domain 5: Privacy by Design	Retained as standalone domain
Domain 7: Emerging Technologies and Privacy	Removed / partially merged	Quantum, blockchain/NFT, VR/AR topics dropped

The most significant structural move was the merger of the old Domains 1 and 2 into a single domain, and the outright elimination of Domain 7 (Emerging Technologies). Some relevant content from the old Domain 7 that related to practical privacy engineering — such as AI and machine learning privacy considerations — was absorbed into the remaining domains rather than being discarded entirely.

Domain 1: The Privacy Technologist's Role in the Context of the Organization

The newly consolidated Domain 1 merges what were previously two separate domains covering foundational privacy principles and the role of IT in privacy. The result is a single, comprehensive domain that positions the privacy technologist within the broader organizational structure.

What This Domain Covers

• Understanding the privacy technologist's responsibilities within engineering teams, product development, and organizational governance
• Organizational privacy structures including the relationship between privacy technologists, DPOs, legal teams, and executive leadership
• Privacy legislation fundamentals as they apply to technology decisions (GDPR, CCPA/CPRA, and other frameworks)
• Translating legal and policy requirements into technical specifications and system architectures
• Cross-functional collaboration between privacy, security, engineering, and product teams

This domain sets the stage for everything else on the exam. If you understand why a privacy technologist exists within an organization and how that role connects to legal, compliance, and engineering functions, you have the conceptual foundation for the more technical domains that follow. Candidates studying for this domain should focus on understanding the organizational context — not just the technical "how" but the business "why" behind privacy engineering decisions.

Domain 2: Data Collection, Use, Dissemination, and Destruction

Domain 2 in the new BoK takes a full data lifecycle approach that the old structure only partially addressed. The old Domain 3 focused primarily on data collection and use policies. The updated domain extends that coverage through dissemination (sharing, transfer, disclosure) and destruction (deletion, anonymization, retention policy enforcement).

Key Topic Areas

• Data collection mechanisms — consent management platforms, cookie technologies, tracking pixels, SDKs, and API-based data collection
• Purpose limitation and data minimization in system design and database architecture
• Data sharing and third-party dissemination — vendor management, data processing agreements, cross-border transfer mechanisms
• Data retention and destruction — automated deletion workflows, cryptographic erasure, and audit trail requirements
• Notice and transparency — privacy notices, just-in-time disclosures, and layered consent approaches

The expansion of this domain reflects a real industry shift. Privacy technologists in 2025–2026 spend as much time building deletion pipelines and managing data retention as they do building collection systems. The exam now mirrors that reality.

Domain 3: Privacy Risk Management

Domain 3 is the most directly carried-over domain from the old BoK, though it has been streamlined. The old "Assessing and Managing Privacy Risk" domain was renamed to simply "Privacy Risk Management," and its content was tightened to focus on practical risk frameworks and assessment methodologies.

Core Concepts You Must Know

• Privacy Impact Assessments (PIAs) and Data Protection Impact Assessments (DPIAs) — when they're required, how to conduct them, and how to document findings
• Threat modeling frameworks — particularly LINDDUN (Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, Non-compliance)
• Risk assessment methodologies — likelihood vs. impact matrices, quantitative vs. qualitative approaches
• Vendor and third-party risk — evaluating processors and sub-processors for privacy compliance
• Incident response planning — breach notification requirements, technical response procedures

For a deep dive into the threat modeling frameworks you'll encounter on exam day, see our dedicated guide on CIPT Privacy Risk Management: Threat Models, LINDDUN, and Exam Prep. LINDDUN in particular appears frequently in scenario-based questions and is a framework you should be able to apply, not just define.

Domain 4: Privacy-Enhancing Strategies, Techniques, and Technologies

Notice the subtle but important name change here. The old domain was called "Privacy-Enhancing Technologies" — the new version adds "Strategies" and "Techniques" to the title. This signals a broader scope that goes beyond specific tools and technologies to include the strategic and methodological approaches privacy technologists use.

What the Expanded Scope Includes

• Encryption technologies — symmetric and asymmetric encryption, TLS/SSL, encryption at rest vs. in transit, homomorphic encryption
• De-identification techniques — anonymization, pseudonymization, k-anonymity, l-diversity, t-closeness, differential privacy
• Access control strategies — role-based access control (RBAC), attribute-based access control (ABAC), least privilege principles
• Technical privacy controls — data masking, tokenization, secure multi-party computation
• Strategic approaches — privacy architecture design, privacy-preserving data analytics, federated learning concepts

Domain 5: Privacy by Design

Privacy by Design (PbD) retains its position as a standalone domain in the new BoK — a clear statement from IAPP about its continued importance. This domain covers Ann Cavoukian's seven foundational principles and how privacy technologists embed them into system design, software development lifecycles, and enterprise architecture.

The Seven Foundational Principles on the Exam

Expect the exam to test your ability to apply these principles to real scenarios — not just recite them. You might be given a system architecture description and asked which PbD principle is being violated, or asked to recommend a design change that better embodies a specific principle. For thorough preparation, work through our CIPT Privacy by Design Domain study guide.

Topics Removed from the CIPT Exam

The elimination of the old Domain 7 (Emerging Technologies and Privacy) is one of the biggest changes candidates need to understand. Three topic areas were explicitly removed from the Body of Knowledge:

Quantum Computing

The old BoK included content on quantum computing's potential impact on encryption and privacy. While quantum threats to cryptography remain a legitimate long-term concern, the IAPP determined that this topic was too theoretical for a practitioner-focused exam. Post-quantum cryptography standards are still being finalized by NIST, and practical quantum threats to current encryption remain years away. You no longer need to study quantum key distribution, Shor's algorithm, or quantum-resistant cryptographic schemes for the CIPT.

Blockchain and NFTs

Blockchain privacy considerations — including immutability conflicts with the right to erasure, pseudonymity in distributed ledgers, and NFT metadata privacy — were removed entirely. The hype cycle around blockchain and NFTs has cooled significantly, and the IAPP recognized that most privacy technologists are unlikely to encounter these technologies as core responsibilities.

VR/AR (Virtual Reality and Augmented Reality)

Privacy in immersive environments, including biometric data collection through VR headsets, spatial mapping in AR, and avatar-based identity, was also cut. While these technologies continue to develop, they haven't reached the mainstream adoption level that would make them essential knowledge for every privacy technologist.

How to Adjust Your Study Plan for the New BoK

Whether you're starting fresh or adjusting an existing study plan, here's how to approach the restructured exam strategically.

Step 1: Verify Your Study Materials Are Current

The official IAPP textbook for the CIPT is An Introduction to Privacy for Technology Professionals (2nd Edition), available digitally for $75. If you're using older editions or third-party study guides published before mid-2025, cross-reference them against the five new domains. Any content that doesn't map to the current domain structure should be deprioritized or skipped entirely.

Step 2: Reallocate Your Study Time

With five domains instead of seven, you should spend approximately 20% of your total study time on each domain as a starting baseline, then adjust based on your strengths and weaknesses. The domains are not officially weighted equally, so use practice exams to identify where you need more work. For a complete study strategy, refer to our complete CIPT certification study guide.

Step 3: Focus on Scenario-Based Application

The CIPT exam includes scenario-based questions that test your ability to apply concepts to realistic situations. With the new BoK's emphasis on practical privacy engineering over theoretical emerging technologies, expect even more scenario-based questions. Practice answering questions that present a business or technical scenario and ask you to identify the correct privacy approach, the principle being violated, or the most appropriate technical control.

Step 4: Use Updated Practice Tests

Practice tests aligned with the pre-September 2025 BoK will include questions on topics no longer covered and may miss new emphasis areas. Use CIPT practice tests updated for the 2025–2026 BoK to ensure you're testing yourself on relevant material. Taking practice tests is one of the most effective ways to gauge your readiness and identify knowledge gaps.

Key Dates and Transition Timeline

Date	Event	Impact on Candidates
Before September 1, 2025	Old 7-domain BoK in effect	Exams tested on old domain structure including emerging technologies
September 1, 2025	New 5-domain BoK takes effect	All exams from this date forward use the new structure
September 2025 – Present	Transition period	Updated study materials and practice tests becoming available
Ongoing (2026)	New BoK fully established	All current candidates should study the 5-domain structure exclusively

Understanding the overall difficulty of the CIPT exam is also important as you calibrate your preparation. The restructuring doesn't necessarily make the exam harder or easier — it makes it different, and candidates who study the right material will have a clear advantage.

Frequently Asked Questions