IAPP CIPP-E Practice Exams
Last updated on Oct 22,2026- Exam Code: CIPP-E
- Exam Name: Certified Information Privacy Professional/Europe (CIPP/E)
- Certification Provider: IAPP
- Latest update: Oct 22,2026
In which situation would a data controller most likely be able to justify the processing of the data of a child without parental consent?
- A . When the data is to be processed for market research.
- B . When providing preventive or counselling services to the child.
- C . When providing the child with materials purely for educational use.
- D . When a legitimate business interest makes obtaining consent impractical.
When is data sharing agreement MOST likely to be needed?
- A . When anonymized data is being shared.
- B . When personal data is being shared between commercial organizations acting as joint data controllers.
- C . When personal data is being proactively shared by a controller to support a police investigation.
- D . When personal data is being shared with a public authority with powers to require the personal data to be disclosed.
SCENARIO
Please use the following to answer the next question:
Jane Stan’s her new role as a Data Protection Officer (DPO) at a Malta-based company that allows anyone to buy and sell cryptocurrencies via its online platform. The company stores and processes the personal data of its customers in a dedicated data center located in Malta (EU).
People wishing to trade cryptocurrencies are required to open an online account on the platform. They then must successfully pass a KYC due diligence procedure aimed at preventing money laundering and ensuring compliance with applicable financial regulations.
The non-European customers are also required to waive all their GDPR rights by reading a disclaimer written in bold and belong a checkbox on a separate page in order to get their account approved on the platform.
The customers must likewise accept the terms of service of the platform. The terms of service also include a privacy policy section, saying, among other things, that if a Are the cybersecurity assessors required to sign a data processing agreement with the company in order to comply with the GDPR”
- A . No, the assessors do not quality as data processors as they only have access to encrypted data.
- B . No. the assessors do not quality as data processors as they do not copy the data to their facilities.
- C . Yes. the assessors a-e considered to be joint data controllers and must sign a mutual data processing agreement.
- D . Yes, the assessors are data processors and their processing of personal data must be governed by a separate contract or other legal act.
Company X has entrusted the processing of their payroll data to Provider Y. Provider Y stores this encrypted data on its server. The IT department of Provider Y finds out that someone managed to hack into the system and take a copy of the data from its server. In this scenario, whom does Provider Y have the obligation to notify?
- A . The public
- B . Company X
- C . Law enforcement
- D . The supervisory authority
What obligation does a data controller or processor have after appointing a data protection officer?
- A . To ensure that the data protection officer receives sufficient instructions regarding the exercise of his or her defined tasks.
- B . To provide resources necessary to carry out the defined tasks of the data protection officer and to maintain his or her expert knowledge.
- C . To ensure that the data protection officer acts as the sole point of contact for individuals’ Questions: about their personal data.
- D . To submit for approval to the data protection officer a code of conduct to govern organizational practices and demonstrate compliance with data protection principles.
Which of the following is NOT recognized as being a common characteristic of cloud-computing services?
- A . The service’s infrastructure is shared among the supplier’s customers and can be located in a number of countries.
- B . The supplier determines the location, security measures, and service standards applicable to the processing.
- C . The supplier allows customer data to be transferred around the infrastructure according to capacity.
- D . The supplier assumes the vendor’s business risk associated with data processed by the supplier.
Which sentence best describes proper compliance for an international organization using Binding Corporate Rules (BCRs) as a controller or processor?
- A . Employees must sign an ad hoc contractual agreement each time personal data is exported.
- B . All employees are subject to the rules in their entirety, regardless of where the work is taking place.
- C . All employees must follow the privacy regulations of the jurisdictions where the current scope of their work is established.
- D . Employees who control personal data must complete a rigorous certification procedure, as they are exempt from legal enforcement.
Since blockchain transactions are classified as pseudonymous, are they considered to be within the material scope of the GDPR or outside of it?
- A . Outside the material scope of the GDPR, because transactions do not include personal data about data subjects m the European Union.
- B . Within the material scope of the GDPR but outside of the territorial scope, because blockchains are decentralized.
- C . Within the material scope of the GDPR to the extent that transactions include data subjects in the European Union.
- D . Outside the material scope of the GDPR, because transactions are for personal or household purposes
What is an important difference between the European Court of Human Rights (ECHR) and the Court of Justice of the European Union (CJEU) in relation to their roles and functions?
- A . ECHR can rule on issues concerning privacy as a fundamental right, while the CJEU cannot.
- B . CJEU can force national governments to implement and honor EU law, while the ECHR cannot.
- C . CJEU can hear appeals on human rights decisions made by national courts, while the ECHR cannot.
- D . ECHR can enforce human rights laws against governments that fail to implement them, while the CJEU cannot.
According to the GDPR, how is pseudonymous personal data defined?
- A . Data that can no longer be attributed to a specific data subject without the use of additional information kept separately.
- B . Data that can no longer be attributed to a specific data subject, with no possibility of re-identifying the data.
- C . Data that has been rendered anonymous in such a manner that the data subject is no longer identifiable.
- D . Data that has been encrypted or is subject to other technical safeguards.