The IAPP has officially confirmed the Certified Information Privacy Professional / Australia (CIPP/AU), its newest regional certification. Through CIPP/AU certification, you'll learn the ins and outs of Australia's privacy framework, grounded in the Privacy Act 1988 and the 13 Australian Privacy Principles (APPs), along with state and territory privacy laws and the Office of the Australian Information Commissioner's (OAIC) enforcement powers.
The inaugural exam is offered in person at the IAPP ANZ Summit in Sydney on December 4, 2026, with online exam registration opening in 2027.
If you work for a company that's based in Australia, does business with Australia, or you're servicing customers who reside in Australia, the CIPP/AU may be worth considering. In this article, we'll walk through what it takes to earn and maintain the certification, why it's worth pursuing, who tends to seek it out, what's actually tested on the exam, and how to start preparing.
What Is Required to Obtain and Maintain the CIPP/AU Certification?
Earning the CIPP/AU certification comes down to a single hurdle: passing the certification exam. No application review, no work history to submit, no supervisor to sign off on your eligibility. That's a meaningful difference from many other professional credentials, which often gate entry behind years of on-the-job experience. For someone breaking into privacy work, or pivoting toward the Australian market specifically, it means the certification is available the moment you're ready for the exam, rather than the moment you've logged enough years in a role.
Once you've passed, keeping the credential active follows the standard IAPP maintenance cycle: 20 hours of Continuing Privacy Education (CPE) credits and a $250 USD Certification Maintenance Fee (CMF), both due every two years.
CPE hours are easier to accumulate than they might sound—conference attendance, webinars, and other IAPP-recognized activities all count toward the total. And if you already hold an IAPP membership, the $250 CMF is included at no extra charge.
- Learn about the costs of IAPP certification by visiting our article: What Are the Costs of IAPP Certification?
What Are the Benefits of CIPP/AU Certification?
For anyone whose work touches Australian personal information, the CIPP/AU designation functions as proof—to employers, clients, or regulators—that you actually know the framework rather than just having worked adjacent to it.
More specifically, the CIPP/AU qualification will demonstrate your understanding of Australian data governance and personal information protection, and your ability to adhere to Australian legal and regulatory requirements. Thus, you'll know how to mitigate risk for your organization, making you a valuable employee.
Because the credential just launched, it isn't yet a fixture in job postings the way CIPP/US or CIPP/E are. That's likely to shift quickly, though, given how fast Australian privacy enforcement has escalated—organizations hiring for APAC-facing privacy roles will have every reason to start asking for it.
According to the IAPP Salary and Jobs Report 2025–26, the global average total compensation across privacy, AI governance, and cybersecurity roles is $200,000.
Who Is Likely to Obtain CIPP/AU Certification?
Given how much of the CIPP/AU exam centers on statutory interpretation, lawyers and in-house counsel will likely make up a large share of CIPP candidates generally—but the certification wasn't built exclusively for them. Plenty of non-legal professionals hold CIPP credentials and use them just as effectively.
The CIPP/AU is likely to resonate with anyone whose role requires fluency in Australia's specific rules, rather than a general sense of "privacy best practices." That includes:
- Privacy officers and managers who oversee privacy practices to ensure their organizations comply with the Privacy Act 1988 and the Australian Privacy Principles
- Compliance officers responsible for ensuring their organization meets regulatory requirements in Australia and manages privacy risks abroad
- Legal advisors with expertise in privacy laws and regulations in Australia
- Consultants who offer privacy and compliance services to organizations operating in Australia
- Data protection officers (DPOs), privacy officers, and privacy champions responsible for their organization's data protection strategies and practices in Australia
What Is Tested on the CIPP/AU Certification Exam?
Expect the exam to lean heavily on the Privacy Act 1988 and the Australian Privacy Principles—their scope, the obligations they impose, individual rights under them, and how cross-border data transfers fit into the picture. It's less about memorizing statute numbers and more about knowing how the framework applies in practice.
Available at no cost, the IAPP offers resources like the CIPP/AU Body of Knowledge (BoK) and Exam Blueprint, which details the concepts and topics you'll need to know for the certification exam. The CIPP/AU certification exam is separated into four domains:
- Domain I — The Regulatory Context of Australian Privacy (14–18 questions): The federal legislative framework behind Australian privacy, the Privacy Act 1988, the Australian Government Agencies Privacy Code, and how the framework applies to emerging issues like AI.
- Domain II — The Australian Privacy Principles (21–25 questions): The largest domain on the exam. Covers all 13 APPs — collection, use and disclosure, direct marketing, cross-border data transfers, government identifiers, data quality and security, and individual rights of access and correction.
- Domain III — Australian Privacy Enforcement (10–14 questions): The OAIC's roles, functions, and enforcement powers, its intersections with regulators like the ACCC and eSafety Commissioner, and how the regulatory framework is adapting to AI, digital IDs, and cybersecurity.
- Domain IV — Special Cases Involving Personal Information (17–21 questions): Sector-specific privacy issues — health, finance (including the Consumer Data Right), children's privacy, employment and workplace surveillance, and law enforcement surveillance.
Each domain breaks down further into competencies and performance indicators—essentially a map of what you need to know (the competency) and the specific, testable skills that prove you know it (the performance indicators).
The other CIPP concentrations follow a standard 90 multiple-choice question, 2.5-hour format. However, the IAPP has indicated that the CIPP/AU certification exam is composed of 80 multiple-choice questions. Test-takers will have 2.5 hours to complete those questions.
How to Prepare for the CIPP/AU Certification Exam
Start with the primary sources: the IAPP Certification Candidate Handbook and the CIPP/AU BoK and Exam Blueprint linked above.
From there, most candidates supplement IAPP's materials with a dedicated study platform—reading the blueprint tells you what's covered, but working through practice questions and structured modules is what actually gets you exam-ready. Unfortunately, because this is such a new certification, no such platforms yet exist. For now, most students will need to rely upon self-study.
Our courses, which are currently offered for the CIPP/US, the CIPP/E, the CIPP/C, the CIPM, the CIPT, and the AIGP certifications, pair e-study modules with flashcards, practice questions, and interactive exercises so you're not just reading about the material but actually testing your recall of it.
IAPP generally recommends at least 30 hours of study time per certification, and there's no reason to expect the CIPP/AU will require less. Put that time in now, and you'll be positioned to sit for the exam as soon as it's available to you.
