IAPP CIPM Practice Exams
Last updated on Oct 22,2026- Exam Code: CIPM
- Exam Name: Certified Information Privacy Manager (CIPM)
- Certification Provider: IAPP
- Latest update: Oct 22,2026
Which of the following is NOT recommended for effective Identity Access Management?
- A . Demographics.
- B . Unique user IDs.
- C . User responsibility.
- D . Credentials (e.g.. password).
SCENARIO
Please use the following to answer the next QUESTION:
Paul Daniels, with years of experience as a CEO, is worried about his son Carlton’s successful venture, Gadgo. A technological innovator in the communication industry that quickly became profitable, Gadgo has moved beyond its startup phase. While it has retained its vibrant energy, Paul fears that under Carlton’s
direction, the company may not be taking its risks or obligations as seriously as it needs to. Paul has
hired you, a Privacy Consultant, to assess the company and report to both father and son. "Carlton won’t listen to me," Paul says, "but he may pay attention to an expert."
Gadgo’s workplace is a clubhouse for innovation, with games, toys, snacks. espresso machines, giant fish tanks and even an iguana who regards you with little interest. Carlton, too, seems bored as he describes to you the company’s procedures and technologies for data protection. It’s a loose assemblage of controls, lacking consistency and with plenty of weaknesses. "This is a technology company," Carlton says. "We create. We innovate. I don’t want unnecessary measures that will only slow people down and clutter their thoughts."
The meeting lasts until early evening. Upon leaving, you walk through the office it looks as if a strong windstorm has recently blown through, with papers scattered across desks and tables and even the floor. A "cleaning crew" of one teenager is emptying the trash bins. A few computers have been left on for the night, others are missing. Carlton takes note of your attention to this: "Most of my people take their laptops home with them, or use their own tablets or phones. I want them to use whatever helps them to think and be ready day or night for that great insight. It may only come once!"
What phase in the Privacy Maturity Model (PMM) does Gadgo’s privacy program best exhibit?
- A . Ad hoc.
- B . Defined.
- C . Repeatable.
- D . Managed.
SCENARIO
Please use the following to answer the next QUESTION:
Paul Daniels, with years of experience as a CEO, is worried about his son Carlton’s successful venture, Gadgo. A technological innovator in the communication industry that quickly became profitable, Gadgo has moved beyond its startup phase. While it has retained its vibrant energy, Paul fears that under Carlton’s
direction, the company may not be taking its risks or obligations as seriously as it needs to. Paul has
hired you, a Privacy Consultant, to assess the company and report to both father and son. "Carlton won’t listen to me," Paul says, "but he may pay attention to an expert."
Gadgo’s workplace is a clubhouse for innovation, with games, toys, snacks. espresso machines, giant fish tanks and even an iguana who regards you with little interest. Carlton, too, seems bored as he describes to you the company’s procedures and technologies for data protection. It’s a loose assemblage of controls, lacking consistency and with plenty of weaknesses. "This is a technology company," Carlton says. "We create. We innovate. I don’t want unnecessary measures that will only slow people down and clutter their thoughts."
The meeting lasts until early evening. Upon leaving, you walk through the office it looks as if a strong windstorm has recently blown through, with papers scattered across desks and tables and even the floor. A "cleaning crew" of one teenager is emptying the trash bins. A few computers have been left on for the night, others are missing. Carlton takes note of your attention to this: "Most of my people take their laptops home with them, or use their own tablets or phones. I want them to use whatever helps them to think and be ready day or night for that great insight. It may only come once!"
What phase in the Privacy Maturity Model (PMM) does Gadgo’s privacy program best exhibit?
- A . Ad hoc.
- B . Defined.
- C . Repeatable.
- D . Managed.
Which of the documents below assists the Privacy Manager in identifying and responding to a request from an individual about what personal information the organization holds about then with whom the information is shared?
- A . Risk register
- B . Privacy policy
- C . Records retention schedule
- D . Personal information inventory
Which of the following is a physical control that can limit privacy risk?
- A . Keypad or biometric access.
- B . user access reviews.
- C . Encryption.
- D . Tokenization.
Which of the following helps build trust with customers and stakeholders?
- A . Only publish what is legally necessary to reduce your liability.
- B . Enable customers to view and change their own personal information within a dedicated portal.
- C . Publish your privacy policy using broad language to ensure all of your organization’s activities are captured.
- D . Provide a dedicated privacy space with the privacy policy, explanatory documents and operation frameworks.
What must a global privacy strategy consider besides regulatory compliance and business practices? (Choose three)
- A . Economic conditions
- B . Political stability
- C . Cultural norms
- D . Technological advancements
- E . Geographic features
As a Data Protection Officer, one of your roles entails monitoring changes in laws and regulations and updating policies accordingly.
How would you most effectively execute this responsibility?
- A . Consult an external lawyer.
- B . Regularly engage regulators.
- C . Attend workshops and interact with other professionals.
- D . Subscribe to email list-serves that report on regulatory changes.
Under the General Data Protection Regulation (GDPR), when would a data subject have the right to require the erasure of his or her data without undue delay?
- A . When the data subject is a public authority.
- B . When the erasure is in the public interest.
- C . When the processing is carried out by automated means.
- D . When the data is no longer necessary for its original purpose.
Under the General Data Protection Regulation (GDPR), when would a data subject have the right to require the erasure of his or her data without undue delay?
- A . When the data subject is a public authority.
- B . When the erasure is in the public interest.
- C . When the processing is carried out by automated means.
- D . When the data is no longer necessary for its original purpose.