IAPP CIPP-E Practice Exams
Last updated on Oct 22,2026- Exam Code: CIPP-E
- Exam Name: Certified Information Privacy Professional/Europe (CIPP/E)
- Certification Provider: IAPP
- Latest update: Oct 22,2026
Which of the following is NOT considered a fair processing practice in relation to the transparency principle?
- A . Providing a multi-layered privacy notice, in a website environment.
- B . Providing a QR code linking to more detailed privacy notice, in a CCTV sign.
- C . Providing a hyperlink to the organization’s home page, in a hard copy application form.
- D . Providing a “just-in-time” contextual pop-up privacy notice, in an online application from field.
What ruling did the Planet 49 CJEU judgment make regarding the issue of pre-ticked boxes?
- A . They are allowed if determined to be technically necessary.
- B . They do not amount to valid consent under any circumstances.
- C . They are allowed if recorded In the register of processing activities.
- D . They constitute valid consent if the processing is necessary for purposes of legitimate interest
Which EU institution is vested with the competence to propose new data protection legislation on its own initiative?
- A . The European Council
- B . The European Parliament
- C . The European Commission
- D . The Council of the European Union
Which of the following describes a mandatory requirement for a group of undertakings that wants to appoint a single data protection officer?
- A . The group of undertakings must obtain approval from a supervisory authority.
- B . The group of undertakings must be comprised of organizations of similar sizes and functions.
- C . The data protection officer must be located in the country where the data controller has its main establishment.
- D . The data protection officer must be easily accessible from each establishment where the undertakings are located.
Which mechanism, new to the GDPR, now allows for the possibility of personal data transfers to third countries under Article 42?
- A . Approved certifications.
- B . Binding corporate rules.
- C . Law enforcement requests.
- D . Standard contractual clauses.
Data retention in the EU was underpinned by a legal framework established by the Data Retention Directive (2006/24/EC).
Why is the Directive no longer part of EU law?
- A . The Directive was superseded by the EU Directive on Privacy and Electronic Communications.
- B . The Directive was superseded by the General Data Protection Regulation.
- C . The Directive was annulled by the Court of Justice of the European Union.
- D . The Directive was annulled by the European Court of Human Rights.
Under which of the following conditions does the General Data Protection Regulation NOT apply to the processing of personal data?
- A . When the personal data is processed only in non-electronic form
- B . When the personal data is collected and then pseudonymised by the controller
- C . When the personal data is held by the controller but not processed for further purposes
- D . When the personal data is processed by an individual only for their household activities
According to the E-Commerce Directive 2000/31/EC, where is the place of “establishment” for a company providing services via an Internet website confirmed by the GDPR?
- A . Where the technology supporting the website is located
- B . Where the website is accessed
- C . Where the decisions about processing are made
- D . Where the customer’s Internet service provider is located
According to the E-Commerce Directive 2000/31/EC, where is the place of “establishment” for a company providing services via an Internet website confirmed by the GDPR?
- A . Where the technology supporting the website is located
- B . Where the website is accessed
- C . Where the decisions about processing are made
- D . Where the customer’s Internet service provider is located
As per the GDPR, which legal basis would be the most appropriate for an online shop that wishes to process personal data for the purpose of fraud prevention?
- A . Protection of the interests of the data subjects.
- B . Performance of a contact
- C . Legitimate interest
- D . Consent