Discuss IAPP CIPP/E Exam Topic 2 Question 27

What are the obligations of a processor that engages a sub-processor?

AThe processor must give the controller prior written notice and perform a preliminary audit of the sub- processor.

BThe processor must obtain the controller's specific written authorization and provide annual reports on the sub-processor's performance.

CThe processor must receive a written agreement that the sub-processor will be fully liable to the controller for the performance of its obligations in relation to the personal data concerned.

DThe processor must obtain the consent of the controller and ensure the sub-processor complies with data processing obligations that are equivalent to those that apply to the processor.

Suggested Answer: C

Get Premium CIPP/E Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Adelaide 1 year ago

Annual reports? That sounds like a lot of extra work!

King 1 year ago

It's wild how much liability falls on the processor!

Denise 1 year ago

I thought a simple notice was enough?

Man 1 year ago

Totally agree, compliance is key!

Annamae 1 year ago

The processor needs to get the controller's consent first.

Johana 1 year ago

I believe the processor must get the controller's consent, but I’m uncertain if it also needs to provide annual reports on the sub-processor's performance.

Rickie 1 year ago

I practiced a similar question where the focus was on the controller's authorization. I feel like that might be important here too.

Mickie 1 year ago

I think the processor has to ensure the sub-processor complies with the same obligations, but I'm not sure if it needs the controller's consent first.

Alesia 1 year ago

I remember something about needing a written agreement with the sub-processor, but I can't recall if it was specifically about liability or just compliance.

Aliza 1 year ago

Hmm, I'm not entirely sure about this one. The question mentions the "Use Print as Master for Web Channel" option, so I'm wondering if the answer might be related to that in some way. I'll have to think this through carefully.

Oren 1 year ago

Hmm, I'm a bit torn between options A and D. Cloud Functions could be a more lightweight solution, but Stackdriver Monitoring might have better integration with the rest of the Google Cloud ecosystem. I'll need to weigh the pros and cons of each approach.

Ruth 1 year ago

Hmm, this looks like a straightforward question about the types of employment tracked in the HR Profile table. I'll need to carefully read through the options and select the three that apply.

Kristofer 1 year ago

Okay, let's see... I think I remember seeing "lost MC" and "bad pkts" on that page, but I'm not sure about the third one.

IAPP CIPP/E Exam - Topic 2 Question 27 Discussion