r/cipp

Hi everyone, I'm looking for some mentorship and advice as I navigate breaking into AI governance and privacy law.

Background:

• 31 years old, JD (graduated May 2025)
• Currently working full-time as an AI legal tech professional
• Contract work on the side: AI legal training evaluation for Mercer
• Bar exam scheduled for February 2026 (failed by 2 points on first attempt; New York State)
• Beyond these roles, I have no direct experience in privacy or AI governance

Relevant Experience:

- Member of a Google Developer Group focused on AI governance trends

- Previous contract role besides my general tasks, was in evaluating AI's impact on privacy and client/investor confidentiality

Multiple attorneys have advised me to pursue IAPP certifications in this order: CIPP first, then AIGP. I'm considering starting studies this month and aiming for a CIPP exam in September, which would give me time before bar prep in February.

My goal is to work in-house for a firm (or in-house counsel generally) ensuring AI compliance with applicable laws and regulations while protecting client confidentiality. I understand this space is emerging, and policy/governance work seems like the best entry point to a "true" AI governance legal role.

I have tech-savvy siblings in software engineering at startups and established companies, which has given me insight into where law and tech intersect. I see real market potential here but lack clear direction and connections.

• Does the CIPP → AIGP pathway make sense for my goal?
• Should I pursue these certifications before or after passing the bar?
• Any advice for someone pivoting into this space without direct experience?

I appreciate mentorship and realistic guidance about timing and next steps.

Has anyone had experience getting a first role in DP, without any prior experience? Currently studying for CIPP/E in Ireland but i see employers all asking for a minimum of 3 to 5 years hands on experience (which makes sense, i know). My background is legal & compliance. Would appreciate any tips, thanks

Hi guys, i know this has been asked a few years before but asking again -- how should i prepare for the exam? what kind of study materials should i be using? how long is the prep time? any advice and any tips would be appreciated.

Thanks!

I'm a litigation attorney and FINRA arbitrator looking to transition into data/privacy law due to burnout, but without any practical data or privacy experience yet. Im studying to take the CIPP/US Exam by late August/mid September.

Assuming I pass on my first attempt (or even later on as necessary), how can I gain practical experience in data or privacy law in order to leverage that into a full time position with a firm or fintech/healthcare/corporation?

wanted some guidance to start my career i am a law student in my 3rd year and wanted to make my career in ai governance i researched a lot but i am stuck at a decision to make should i directly start learning ai governance via AIGP and other courses or should first learn GRC ,then data privacy and then learn ai governance and if there is any kind of work in which any help and i can learn ai governance from any professional , i am open to volunteer and learn

I am taking the CIPP/US this week at a PearsonVUE center. Do you know what tools we can work with during the exam? For example, do we have the ability to make notes on paper while in the exam and/or can we strike/highlight the text of the questions while working on the test, sort of like the ability to do so on the MPRE?

I studied for almost a year off and on. Used bootcamp and the LinkedIn course. Read a few books too. Still had so many questions seemingly out of left field.
So glad it’s over.

Hi guys, I passed the exam today!

I just wanted to give some pointers. First of all, read the jurisdiction carefully. Be ready to recite all reports by the OPC, and know about the history of the law and how it has evolved. The exam is verbal, so if you are a slow reader, focus on your reading skills.

Good luck

I’ve been an attorney for 19 years and want to get into privacy work and eventually start a small consulting boutique in Europe in a few years. My plan is to take the CIPM, start a privacy career here in the states, take CIPP/E, eventually start consulting here in the states, then move with business to EU.

Does this plan work or is the CIPP/US important to do first?

Edit: I'm not trying to upsell/advertise anything, I am looking for answers to a question that popped in my head for something I'm working on from SMEs. I was under the assumption that AI-assisted redaction would be welcome, and I'm trying to verify that. I am not mentioning/trying to sell anything to anyone

I’m trying to understand how people think about redaction in practice. For you, is the main value speed, or is it privacy and control?

Would a fully manual redaction workflow be fine if it ran locally and nothing ever touched the cloud? Or does AI-assisted redaction matter enough that you’d prefer the time savings?