The 2026 edition built natively to BoK v1.3.3The IAPP refreshed the CIPP/E exam in September 2025. Three domains became five. The Body of Knowledge moved to v1.3.3. The EU AI Act, the EU Data Act, the withdrawn ePrivacy Regulation, the UK Data (Use and Access) Act 2025, and the Latombe ruling on the Data Privacy Framework all reshaped the test that's in front of you. Most CIPP/E books on Amazon predate every one of those changes.
This guide is current. Every Article reference, every EDPB output, every named case verified against 2026 sources.
What's insideThe full 5-domain map. Weighted to BoK v1.3.3 (7 / 37 / 27 / 16 / 14). The chapter map follows the weighting, not the table of contents of an EU privacy treatise.22 chapters. Front matter, assessment test, orientation, plus 17 domain chapters covering every Article, EDPB output, and named case the IAPP tests.Two full 90-question mock exams. Weighted to the BoK and matched to the IAPP's scenario-stem pattern.450+ practice questions drilled to the indicator level across the chapters and mocks.A 28-page rapid-fire review for the 24 hours before exam day.GDPR Article-indexed throughout. Every chapter cross-references the Articles, EDPB output, and cases tested.Appendices. Article index, EDPB output index, case index, acronym glossary, BoK competency to chapter cross-reference, recommended further reading.Who this book is forEU/UK privacy lawyers pivoting in-houseIndia / APAC lawyers riding DPDPA who need GDPR depthBig 4 / consultancy GRC practitionersDPOs and privacy program leaders preparing for the IAPP CIPP/E exam in 2026This guide assumes you've already met the GDPR. It moves quickly, skips the parts the exam doesn't ask about, and spends more time on Article 6 lawful-basis selection than a privacy academic would call reasonable.
Why choose this guideIt's the companion to Ustaran, not a replacement. If you already own European Data Law and Practice 3rd ed., keep it on your shelf. Ustaran is the reference you reach for when a client asks what Recital 47 actually says about legitimate interests. This book is the spine you read when the IAPP asks you to pick the right answer between four nearly-identical options in 90 seconds.
The current 2023–2026 case law is on the Meta Token Breach €251M, LinkedIn €310M, the European Commission's €200M DMA decision applying the consent-or-pay framework, Bundeskartellamt v Meta, Österreichische Post, Schrems II, Latombe upholding the DPF, SRB v EDPS on the relative concept of personal data, CK v Dun & Bradstreet Austria (C-203/22) on ADM and trade secrets, C-383/23 ILVA on undertaking-level fines, Garante v. OpenAI €15M annulled by the Court of Rome on 18 March 2026.
The post-2024 EU regulatory stack is on the AI Act phased application (high-risk + Article 50 transparency triggering 2 August 2026), Data Act applied 12 September 2025, ePrivacy Regulation withdrawn 16 July 2025, NIS2 + DORA, UK DUAA 2025.
3 reading plans (4-week intensive, 8-week balanced, 12-week new-to-EU-privacy). 2 full mock exams. Per-chapter practice questions and explanations that teach, not just label the right letter.