IAPP CIPP/C Exam - Topic 1 Question 71 Discussion

Actual exam question for IAPP's CIPP/C exam

Question #: 71
Topic #: 1

According to the Alberta Personal Information Protection Act, which of the following data breach reporting notifications to the commissioner is NOT automatically triggered when real risk of significant harm (RROSH) has been determined?

AProviding a description of the steps the organization will take to notify the affected individual(s).

BProviding a description of the steps the organization has taken to reduce or mitigate that harm.

CProviding an estimate of the number of individuals affected by the breach.

DProviding a description of the personal information involved in the breach.

Show Suggested Answer

Suggested Answer: C

by Jose at Nov 23, 2025, 04:09 PM

Limited Time Offer

25%

Off

Get Premium CIPP/C Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Roosevelt

13 days ago

I feel unsure about this one.

upvoted 0 times

...

Maile

18 days ago

A and B are definitely required.

upvoted 0 times

...

Flo

24 days ago

D seems less critical to report.

upvoted 0 times

...

Miss

29 days ago

I agree with Kirk. Just a guess though.

upvoted 0 times

...

Kirk

1 month ago

I think it's C. No estimate needed.

upvoted 0 times

...

Sherell

1 month ago

I’m surprised C isn’t automatic, seems important!

upvoted 0 times

...

Adelina

1 month ago

A and B are definitely required, but C is tricky.

upvoted 0 times

...

Reuben

2 months ago

Wait, really? I thought all those were mandatory!

upvoted 0 times

...

Rashad

2 months ago

Totally agree, C is the odd one out here.

upvoted 0 times

...

Armanda

2 months ago

Wait, is the answer "All of the above"? I mean, who doesn't love a good trick question!

upvoted 0 times

...

Percy

3 months ago

I'm going with D. Providing a description of the personal information involved in the breach. That one seems like the odd one out.

upvoted 0 times

...

Maia

3 months ago

Hmm, I'm not sure, but I think C. Providing an estimate of the number of individuals affected by the breach is the one that is not automatically triggered.

upvoted 0 times

...

Cecily

3 months ago

D. Providing a description of the personal information involved in the breach seems like the one that is not automatically triggered.

upvoted 0 times

...

Sherell

3 months ago

I think the answer is B. Providing a description of the steps the organization has taken to reduce or mitigate that harm.

upvoted 0 times

...

Louvenia

3 months ago

I’m a bit confused here. I thought all of these were important, but maybe the steps to notify individuals aren’t always required? I need to double-check that.

upvoted 0 times

...

Gennie

3 months ago

I practiced a similar question, and I think the one about reducing harm is usually expected. I'm leaning towards option A being the one that isn't automatically triggered.

upvoted 0 times

...

Floyd

4 months ago

I'm not entirely sure, but I feel like the description of the personal information involved is definitely a must. Could it be the estimate of individuals affected that's not automatic?

upvoted 0 times

...

Lawanda

4 months ago

I feel pretty confident about this question. The key is understanding the specific breach reporting obligations under the Alberta Act.

upvoted 0 times

...

Christene

4 months ago

This seems straightforward enough. I'll methodically go through the options and eliminate the ones that are automatically required.

upvoted 0 times

...

Ludivina

4 months ago

Okay, I think I've got a handle on this. I'll focus on identifying the notification that is not automatically required when a real risk of significant harm has been determined.

upvoted 0 times

...

Charlette

4 months ago

I think I remember that not all notifications are required when RROSH is determined. Maybe it's the one about the steps taken to notify individuals?

upvoted 0 times

...

Cristal

5 months ago

C is the one that doesn't trigger automatically.

upvoted 0 times

...

Herminia

5 months ago

This question is tricky!

upvoted 0 times

...

Georgene

5 months ago

Hmm, I'm a bit confused on this one. I'll need to make sure I understand the specific requirements around breach reporting under this Act.

upvoted 0 times

...

Judy

6 months ago

This looks like a tricky one. I'll need to carefully review the key details in the Alberta Personal Information Protection Act to determine which notification is not automatically triggered.

upvoted 0 times