IAPP CIPP-E Practice Exams
Last updated on Oct 22,2026- Exam Code: CIPP-E
- Exam Name: Certified Information Privacy Professional/Europe (CIPP/E)
- Certification Provider: IAPP
- Latest update: Oct 22,2026
What is the main task of the European Data Protection Board?
- A . To assess adequacy of data protection in third countries
- B . To ensure consistent application of the GDPR.
- C . To proactively prevent disputes between national supervisory authorities.
- D . To publish guidelines tor data subjects on how to property enforce their rights
There are three domains of security covered by Article 32 of the GDPR that apply to both the controller and the processor. These include all of the following EXCEPT?
- A . Consent management and withdrawal.
- B . Incident detection and response.
- C . Preventative security.
- D . Remedial security.
A company wishes to transfer personal data to a country outside of the European Union/EEA In order to do so, they are planning an assessment of the country’s laws and practices, knowing that these may impinge upon the transfer safeguards they intend to use All of the following factors would be relevant for the company to consider EXCEPT’?
- A . Any onward transfers, such as transfers of personal data to a sub-processor in the same or another third country.
- B . The process of modernization in the third country concerned and their access to emerging technologies that rely on international transfers of personal data
- C . The technical, financial, and staff resources available to an authority m the third country concerned that may access the personal data to be transferred
- D . The contractual clauses between the data controller or processor established in the European Union/EEA and the recipient of the transfer established in the third country concerned
A homeowner has installed a motion-detecting surveillance system that films his front doc and entryway. The camera does not film any public areas only areas that are the property of the homeowner. The system has seen declared to the authorities per the homeowner’s country law, and a placard indicating the area is being video monitored is visible when entering the property
Why can the homeowner NOT depend on the household exemption with regards to the processing of the video images recorded by the surveillance camera system?
- A . The surveillance camera system can potentially capture biometric information of the homeowner’s family, which would be considered a processing of special categories of personal data.
- B . The homeowner has not specified which security measures ore in place as part of the surveillance camera system
- C . The GDPR specifically excludes surveillance camera images from the household exemption
- D . The surveillance camera system can potentially film individuals who enter its filming perimeter
What is a reason the European Court of Justice declared the Data Retention Directive invalid in 2014?
- A . The requirements affected individuals without exception.
- B . The requirements were financially burdensome to EU businesses.
- C . The requirements specified that data must be held within the EU.
- D . The requirements had limitations on how national authorities could use data.
In which case would a controller who has undertaken a DPIA most likely need to consult with a supervisory authority?
- A . Where the DPIA identifies that personal data needs to be transferred to other countries outside of the EEA.
- B . Where the DPIA identifies high risks to individuals’ rights and freedoms that the controller can take steps to reduce.
- C . Where the DPIA identifies that the processing being proposed collects the sensitive data of EU citizens.
- D . Where the DPIA identifies risks that will require insurance for protecting its business interests.
Which GDPR requirement will present the most significant challenges for organizations with Bring Your Own Device (BYOD) programs?
- A . Data subjects must be sufficiently informed of the purposes for which their personal data is processed.
- B . Processing of special categories of personal data on a large scale requires appointing a DPO.
- C . Personal data of data subjects must always be accurate and kept up to date.
- D . Data controllers must be in control of the data they hold at all times.
SCENARIO
Please use the following to answer the next question:
ProStorage is a multinational cloud storage provider headquartered in the Netherlands. Its CEO. Ruth Brown, has developed a two-pronged strategy for growth: 1) expand ProStorage s global customer base and 2) increase ProStorage’s sales force by efficiently onboarding effective teams. Enacting this strategy has recently been complicated by Ruth’s health condition, which has limited her working hours, as well as her ability to travel to meet potential customers. ProStorage’s Human Resources department and Ruth’s Chief of Staff now work together to manage her schedule and ensure that she is able to make all her medical appointments The latter has become especially crucial after Ruth’s last trip to India, where she suffered a medical emergency and was hospitalized m New Delhi Unable to reach Ruths family, the hospital reached out to ProStorage and was able to connect with her Chief of Staff, who in coordination with Mary, the head of HR. provided information to the doctors based on accommodate on requests Ruth made when she started a: ProStorage
What transfer mechanism did ProStorage most likely rely on to transfer Ruth’s medical information to the hospital?
- A . Ruth’s implied consent.
- B . Protecting the vital interest of Ruth
- C . Performance of a contract with Ruth.
- D . Protecting against legal liability from Ruth.
A worker in a European Union (EU) member state has ceased his employment with a company.
What should the employer most likely do in regard to the worker’s personal data?
- A . Destroy sensitive information and store the rest per applicable data protection rules.
- B . Store all of the data in case the departing worker makes a subject access request.
- C . Securely store the data that is required to be kept under local law.
- D . Provide the employee the reasons for retaining the data.
A company has collected personal data tor direct marketing purpose on the basis of consent. It is now considering using this data to develop new products through analytics.
What is the company first required to do?
- A . Obtain specific consent for the new processing
- B . Only inform the data subjects of the new purpose.
- C . Proceed no further, as such repurposing is unlawful
- D . Update the privacy notice upon which consent was given