IAPP CIPM Practice Exams
Last updated on Oct 22,2026- Exam Code: CIPM
- Exam Name: Certified Information Privacy Manager (CIPM)
- Certification Provider: IAPP
- Latest update: Oct 22,2026
All of the following are accurate regarding the use of technical security controls EXCEPT?
- A . Technical security controls are part of a data governance strategy.
- B . Technical security controls deployed for one jurisdiction often satisfy another jurisdiction.
- C . Most privacy legislation lists the types of technical security controls that must be implemented.
- D . A person with security knowledge should be involved with the deployment of technical security controls.
All of the following changes will likely trigger a data inventory update EXCEPT?
- A . Outsourcing the Customer Relationship Management (CRM) function.
- B . Acquisition of a new subsidiary.
- C . Onboarding of a new vendor.
- D . Passage of a new privacy regulation.
All of the following changes will likely trigger a data inventory update EXCEPT?
- A . Outsourcing the Customer Relationship Management (CRM) function.
- B . Acquisition of a new subsidiary.
- C . Onboarding of a new vendor.
- D . Passage of a new privacy regulation.
SCENARIO
Please use the following to answer the next QUESTION:
Perhaps Jack Kelly should have stayed in the U.S. He enjoys a formidable reputation inside the company, Special Handling Shipping, for his work in reforming certain "rogue" offices. Last year, news broke that a police sting operation had revealed a drug ring operating in the Providence, Rhode Island office in the United States. Video from the office’s video surveillance cameras leaked to news operations showed a drug exchange between Special Handling staff and undercover officers.
In the wake of this incident, Kelly had been sent to Providence to change the "hands off" culture that upper management believed had let the criminal elements conduct their illicit transactions. After a few weeks under Kelly’s direction, the office became a model of efficiency and customer service. Kelly monitored his workers’ activities using the same cameras that had recorded the illegal conduct of their former co-workers.
Now Kelly has been charged with turning around the office in Cork, Ireland, another trouble spot. The company has received numerous reports of the staff leaving the office unattended. When Kelly arrived, he found that even when present, the staff often spent their days socializing or conducting personal business on their mobile phones. Again, he observed their behaviors using surveillance cameras. He issued written reprimands to six staff members based on the first day of video alone.
Much to Kelly’s surprise and chagrin, he and the company are now under investigation by the Data Protection Commissioner of Ireland for allegedly violating the privacy rights of employees. Kelly was told that the company’s license for the cameras listed facility security as their main use, but he does not know why this matters. He has pointed out to his superiors that the company’s training programs on privacy protection and data collection mention nothing about surveillance video.
You are a privacy protection consultant, hired by the company to assess this incident, report on the legal and compliance issues, and recommend next steps.
What does this example best illustrate about training requirements for privacy protection?
- A . Training needs must be weighed against financial costs.
- B . Training on local laws must be implemented for all personnel.
- C . Training must be repeated frequently to respond to new legislation.
- D . Training must include assessments to verify that the material is mastered.
Under the General Data Protection Regulation (GDPR), what are the obligations of a processor that engages a sub-processor?
- A . The processor must give the controller prior written notice and perform a preliminary audit of the sub-processor.
- B . The processor must Obtain the controllers specific written authorization and provide annual reports on the sub-processor’s performance.
- C . The processor must receive a written agreement that the sub-processor will be fully liable to the controller for the performance of its obligations in relation to the personal data concerned.
- D . The processor must obtain the consent of the controller and ensure the sub-processor complies with data processing obligations that are equivalent to those that apply to the processor.
What should be the first major goal of a company developing a new privacy program?
- A . To survey potential funding sources for privacy team resources.
- B . To schedule conversations with executives of affected departments.
- C . To identify potential third-party processors of the organization’s information.
- D . To create Data Lifecycle Management policies and procedures to limit data collection.
What is the best way to understand the location, use and importance of personal data within an organization?
- A . By analyzing the data inventory.
- B . By testing the security of data systems.
- C . By evaluating methods for collecting data.
- D . By interviewing employees tasked with data entry.
What is the best way to understand the location, use and importance of personal data within an organization?
- A . By analyzing the data inventory.
- B . By testing the security of data systems.
- C . By evaluating methods for collecting data.
- D . By interviewing employees tasked with data entry.
SCENARIO
Please use the following to answer the next QUESTION:
Paul Daniels, with years of experience as a CEO, is worried about his son Carlton’s successful venture, Gadgo. A technological innovator in the communication industry that quickly became profitable, Gadgo has moved beyond its startup phase. While it has retained its vibrant energy, Paul fears that under Carlton’s direction, the company may not be taking its risks or obligations as seriously as it needs to. Paul has hired you, a Privacy Consultant, to assess the company and report to both father and son. "Carlton won’t listen to me," Paul says, "but he may pay attention to an expert."
Gadgo’s workplace is a clubhouse for innovation, with games, toys, snacks. espresso machines, giant fish tanks and even an iguana who regards you with little interest. Carlton, too, seems bored as he describes to you the company’s procedures and technologies for data protection. It’s a loose assemblage of controls, lacking consistency and with plenty of weaknesses. "This is a technology company," Carlton says. "We create. We innovate. I don’t want unnecessary measures that will only slow people down and clutter their thoughts."
The meeting lasts until early evening. Upon leaving, you walk through the office it looks as if a strong windstorm has recently blown through, with papers scattered across desks and tables and even the floor. A "cleaning crew" of one teenager is emptying the trash bins. A few computers have been left on for the night, others are missing. Carlton takes note of your attention to this: "Most of my people take their laptops home with them, or use their own tablets or phones. I want them to use whatever helps them to think and be ready day or night for that great insight. It may only come once!"
What would be the best kind of audit to recommend for Gadgo?
- A . A supplier audit.
- B . An internal audit.
- C . A third-party audit.
- D . A self-certification.
Your company wants to convert paper records that contain customer personal information into electronic form, upload the records into a new third-party marketing tool and then merge the customer personal information in the marketing tool with information from other applications.
As the Privacy Officer, which of the following should you complete to effectively make these changes?
- A . A Record of Authority.
- B . A Personal Data Inventory.
- C . A Privacy Threshold Analysis (PTA).
- D . A Privacy Impact Assessment (PIA).