IIM CDPO Exam Format and Structure: 60 Questions, 70 Percent Pass, Explained

The IIM CDPO exam contains 60 questions across scenario-based, single-choice and multiple-choice formats. Candidates have 150 minutes, and the published pass threshold is 70 percent. The exam is proctored and can be taken remotely. IIM is Nigeria's National Certification Body for data protection, licensed by the Nigeria Data Protection Commission.

Most candidates start with the law. That makes sense. The Nigeria Data Protection Act 2023 is the centre of the certification, and there is a lot to know.

But the exam format changes how that knowledge has to be used.

A candidate who can recite the lawful bases for processing but struggles to choose the right one in a messy workplace scenario has a different preparation problem from a candidate who simply has not read the Act. The first problem is application. The IIM CDPO exam is built to expose that difference.

This guide breaks down the mechanics of the exam as IIM currently publishes them, then explains what those mechanics mean for the way you should prepare.

What is the IIM CDPO exam format?

According to the Institute of Information Management's current IIM CDPO certification page, the exam has:

• 60 questions
• 150 minutes of examination time
• Scenario-based questions
• Single-choice questions
• Multiple-choice questions
• A 70 percent pass threshold
• A proctored testing environment
• Remote proctoring for candidates sitting online

That gives you an average of two and a half minutes per question. It does not mean every question should take two and a half minutes. A direct knowledge question may take 30 seconds. A scenario involving a controller, a processor, a lawful basis and a cross-border transfer may deserve several minutes.

The better way to think about the 150 minutes is as a time budget across the whole paper, not as a stopwatch for every item.

What kinds of questions appear on the CDPO exam?

IIM publicly identifies three broad formats: scenario-based, single-choice and multiple-choice.

The distinction matters.

Single-choice questions

These are the most straightforward structurally. You are given several options and select one best answer.

The difficulty is usually not the interface. It is whether two answers look legally plausible and only one fits the facts.

A question about consent, for example, may offer both "consent" and "legal obligation" as options. If the organisation is processing data because a Nigerian law requires it, choosing consent simply because the data subject was informed would be the wrong analysis.

Multiple-choice questions

Multiple-choice questions can require more than one correct option. They test whether you understand a rule as a set of conditions rather than as a single memorised sentence.

That is important in data protection because many obligations are cumulative. A privacy notice, a breach notification or a data processing arrangement can require several elements to be present at the same time.

Scenario-based questions

This is where the exam becomes more demanding.

A scenario may describe a fintech onboarding flow, a hospital sharing patient information, an employer monitoring staff devices or a Nigerian company sending personal data to a foreign cloud provider. The question is then not "What does Section 25 say?" It is closer to "What should the organisation do next, and why?"

That shift from recall to judgement is the reason passive reading has limited value after a certain point. You still need the law. You also need to practise making defensible decisions from facts.

How much time do you have per question?

With 150 minutes for 60 questions, the arithmetic average is 2.5 minutes per question.

Do not turn that average into a rigid rule.

A practical exam rhythm is:

1. Answer the clear questions without overworking them.
2. Flag questions where two options remain genuinely plausible.
3. Spend more time on scenarios with several legal issues.
4. Reserve a final review window rather than using all 150 minutes on the first pass.

The exact split will depend on how quickly you read. What matters is avoiding the common mistake of spending six minutes trying to force certainty out of one difficult question while easier marks remain unanswered later in the paper.

Is the IIM CDPO exam online or in person?

IIM states that the certification exam is available through secure remote proctoring worldwide. Its current guidance also says candidates may schedule through the IIM online portal or the Certification department helpdesk, then receive confirmation containing the exam date, time, link or platform details and access credentials.

For an online sitting, IIM's published examination-day guidance includes:

• a quiet, well-lit environment;
• valid identification for verification; and
• joining the exam workstation 30 minutes before the scheduled start.

Treat the technical setup as part of exam preparation. A strong candidate can still lose useful time to a failing camera, unstable connection or identity-verification problem.

Run the device you intend to use before exam day. Do not make the real sitting the first time you test your webcam, microphone or browser permissions.

What does the 70 percent CDPO pass threshold mean?

The official threshold is 70 percent.

There is an important detail that many summaries skip. IIM's current page states "Passing score (70%): 105" even though the exam contains 60 questions. The public page does not explain the scoring model behind that figure.

That means it is unsafe to state as an official rule that "you need exactly 42 correct answers out of 60." Seventy percent of 60 is 42 as simple arithmetic, but the published score of 105 may indicate a points-based or scaled scoring model. IIM does not currently explain the individual item weighting on the public page.

For preparation, the distinction is useful: do not plan to scrape the threshold by counting how many questions you can afford to miss.

A candidate sitting a high-stakes professional exam should be preparing for a margin above the minimum, not for the minimum itself.

We cover the scoring issue in more depth in CDPO Pass Mark: What the 70% Threshold Actually Requires.

What does the exam format tell you about how to study?

It tells you four things.

1. Reading the NDPA is necessary but insufficient

You need to know the statutory rules. You also need to recognise when they apply.

After each major topic, force yourself to answer a scenario question without looking back at the text. If you can only identify the answer when the heading of the relevant section is in front of you, the knowledge is not yet exam-ready.

2. Your preparation should follow the official domain weights

IIM publishes five domains with different weightings. Legal and Regulatory Frameworks carries 30 percent; Governance, Policies and Ethics carries 10 percent.

Equal study time across those domains would ignore the exam blueprint.

See the full breakdown in The CDPO Exam Domains D1-D5.

3. Full-length timed mocks matter

Short question sets are useful for learning a concept. They do not tell you how well you can sustain judgement for 150 minutes.

A proper mock exam should reproduce the time pressure, domain mix and scenario density of the real assessment closely enough that the result means something.

Vantrel for CDPO is built around that distinction. Domain practice helps you learn. The full mock exam tells you whether the learning holds together under exam conditions.

4. Review the reasoning, not just the answer

Getting a question right for the wrong reason is a hidden problem.

If you selected "legal obligation" because it sounded more formal than "contract," you have not mastered the concept. The same instinct may fail on the next scenario.

Your review process should answer three questions:

• Why is the correct answer correct?
• Why is the closest distractor wrong?
• What fact in the scenario changes the legal analysis?

That is where a question bank becomes preparation rather than repetition.

How Vantrel mirrors the CDPO exam format

Vantrel for CDPO is designed around the published IIM structure rather than around generic privacy questions.

The question bank is mapped to the five IIM domains. Full mock exams are timed and scenario-led. The Signal Engine uses your performance history to surface domain gaps, while your Vantage Score gives you a readiness signal across the whole blueprint rather than a simple percentage from one session.

The point is not to make the interface feel like the real exam. The point is to make your decisions under pressure better than they were before the session began.

See how Vantrel mirrors the CDPO exam format.

Continue in this guide

• the complete guide to the IIM CDPO certification
• the CDPO exam domains D1-D5
• the CDPO pass mark

Frequently Asked Questions

How many questions are in the IIM CDPO exam?

The IIM CDPO exam contains 60 questions. IIM says the paper combines scenario-based, single-choice and multiple-choice questions.

How long is the IIM CDPO exam?

The published duration is 150 minutes, or two hours and 30 minutes.

What is the IIM CDPO pass mark?

The published pass threshold is 70 percent. IIM's current certification page also lists the passing score as 105, but it does not publicly explain the scoring scale or individual question weighting.

Is the IIM CDPO exam remotely proctored?

Yes. IIM states that CDPO certification exams are available through remote proctoring worldwide, with identity verification and exam-day rules.

Are all 60 CDPO questions multiple choice?

IIM describes the exam as a mixture of scenario-based, single-choice and multiple-choice questions. Scenario-based refers to how the problem is presented; a scenario can still use selectable answer options.

Is Vantrel affiliated with IIM or the NDPC?

No. Vantrel is an independent exam-preparation platform. It is not the certifying body and does not imply endorsement by IIM or the NDPC.

Certification formats and administrative procedures can change. Confirm your sitting details with IIM before booking.