Takeaways from Privacy Roundtable’s Ask Me Almost Anything with Dr. Kyle David, Bestselling AIGP, CIPP/US/E, CIPM Instructor.

Most privacy professionals didn’t get their start in privacy. Dr. Kyle David is a perfect example. He built his career in academia until the 2020 hiring freeze, then pivoted to a privacy role at the U.S. Department of Energy. 

Fast forward to today: Dr. David holds five IAPP credentials and teaches AIGP, CIPP, and CIPM masterclasses taken by 10,000 professionals across 120+ countries. That experience is why we chose him for the first session in our Ask Me Almost Anything series. 

We surveyed Privacy Roundtable’s 2,500+ community members and CIPP and AIGP certifications were a top area of interest, with many privacy professionals actively studying for the exams or wondering which to seek first, and others wondering how to use accreditation to break into the privacy field. 

So we opened a live Q&A channel with Dr. David in the Privacy Roundtable Slack and let our members ask away. 

Here’s what we learned.

Which privacy certification should you get first?

This was the most common question in the community, asked from every angle: a beginner weighing AIGP, a technologist already handling DSRs as a DPO, a sales professional moving into AI governance.

Dr. David’s advice was the same for all of them. Start with the certification that benefits you most professionally. That means picking based on the work you actually do, or want to do. 

Here’s a helpful guide to get you started:

*Note from Dr. David: ISACA is beta-testing an Advanced in AI Governance (AAIG™) credential, but it requires you to already hold a prerequisite ISACA credential like CGEIT, which carries its own multi-year experience requirements. For someone starting out, that’s a much higher bar for entry.

How do you build privacy experience without a privacy job?

Several members asked a version of this, including someone with a year of hands-on work experience looking to land their first privacy role. Dr. David’s answer comes in three parts:

1) Focus on what you’re learning.

This is the one lever you control completely. Finding hands-on experience takes time; learning doesn’t, and you can start today. Dr. David recommends beginning with an IAPP certification chosen by jurisdiction, role, or interest (see the guide above), and then adding complementary skills around it. For example, if you’re aiming at AI governance, that means learning how models and agents are actually built and deployed, not just the frameworks that govern them. Every month you spend learning is a month of something concrete to talk about in an interview.

2) Leverage what already exists inside your organization.

If there’s a privacy or AI governance function, ask those people for advice and find a project to contribute to. If there isn’t one, that means there’s an opportunity to stand it up as a collateral duty, or start a community of practice and begin asking the questions nobody has asked yet, like “Did we perform a use case assessment?” or “Do we have an AI system inventory?”

3) Volunteer.

IAPP KnowledgeNets and ISACA chapters exist in most major cities, and they are constantly looking for help. It’s unpaid, but it’s hands-on, and it puts you in front of people who make hiring decisions.

Dr. David was candid that a certification alone guarantees nothing. It may get you shortlisted for an interview, but in the room it comes down to you and your experiences.

Why do smart people fail exams?

In the interview, Dr. David named three mistakes, and none involved the content of the exam: 

1) Inconsistency.

A life event pulls someone off their study schedule and they never recover.

His fix is a small daily block, even thirty minutes, and for people who need external pressure, booking the exam date before prep begins helps.

2) Skipping Bloom’s Taxonomy.

At the front of every IAPP body of knowledge you’ll find Bloom’s Taxonomy. It’s a teaching framework that ranks learning from foundational skills (remember, understand) up to higher-order skills (apply, analyze, evaluate, create), and IAPP uses it to design the exam. The questions test the top of that ladder, which is why rote memorization alone won’t work. But if the facts, laws, principles, and fines aren’t committed to memory, there’s nothing to analyze and you will fail.

Memorize first, then practice applying what you’ve memorized to scenarios. The exam rewards both.

3) Poor exam strategy.

The exam is long, and the pressure is real. Dr. David described a candidate who knew the material and should have passed on his first attempt. He spent two hours on the first fifty questions, zoned out, and reached question 51 with thirty minutes left, under a minute per question.

Decide your pace before you sit down, know how much time each question gets, and have a plan for managing anxiety when it shows up.

What comes after the certification?

Dr. David’s closing advice on building a career in this field applied to everyone. Ask yourself what you’re in this for. If it’s a line on your resume or LinkedIn, the process will disappoint you. If it’s to master your craft, studying becomes enjoyable and the credential becomes what it should be: a step in your journey, not a finish line.

The Ask Me Almost Anything series continues. If you’re not yet a Roundtable member, join Privacy Roundtable, the Slack community for privacy professionals, for direct access to the next guest and the conversations that happen in between.