Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

IAPP CIPP/US Exam - Topic 4 Question 97 Discussion

Privacy Is Hiring Inc., a CA-based company, is an online specialty recruiting firm focusing on placing privacy professionals in roles at major companies. Job candidates create online profilesoutlining their experience and credentials, and can pay $19.99/month via credit card to have their profiles promoted to potential employers. Privacy Is Hiring Inc. keeps all customer data at rest encrypted on its servers.Under what circumstances would Privacy Is Hiring Inc., need to notify affected individuals in the event of a data breach?
B) If the job candidates' credit card information and the encryption keys were among the information taken.
A) If law enforcement has completed its investigation and has authorized Privacy Is Hiring Inc. to provide the notification to clients and applicable regulators.
C) If Privacy Is Hiring Inc., reasonably believes that job candidates will be harmed by the data breach.
D) If the personal information stolen included the individuals' names and credit card pin numbers.

IAPP CIPP/US Exam - Topic 4 Question 97 Discussion

Actual exam question for IAPP's CIPP/US exam
Question #: 97
Topic #: 4
[All CIPP/US Questions]

Privacy Is Hiring Inc., a CA-based company, is an online specialty recruiting firm focusing on placing privacy professionals in roles at major companies. Job candidates create online profiles

outlining their experience and credentials, and can pay $19.99/month via credit card to have their profiles promoted to potential employers. Privacy Is Hiring Inc. keeps all customer data at rest encrypted on its servers.

Under what circumstances would Privacy Is Hiring Inc., need to notify affected individuals in the event of a data breach?

Show Suggested Answer Hide Answer
Suggested Answer: B

Under the California Consumer Privacy Act (CCPA), a business that collects personal information of California residents must notify them of a data breach if their personal information is subject to unauthorized access and exfiltration, theft, or disclosure as a result of the business's violation of the duty to implement and maintain reasonable security procedures and practices. However, the CCPA excludes encrypted or redacted personal information from the definition of personal information, unless the encryption key or security credential is also compromised. Therefore, Privacy Is Hiring Inc. would need to notify the affected individuals only if the encryption keys were also taken along with the credit card information, as this would render the encryption ineffective and expose

the personal information to unauthorized access. The other options are not relevant to the CCPA notification requirement, although they may be relevant to other laws or best practices.Reference:CCPA(Section 1798.150),IAPP CIPP/US Study Guide(p. 63-64)


by Celia at Jul 02, 2026, 04:00 AM

Limited Time Offer

25%

Off

Get Premium CIPP/US Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Jerry
I’d feel anxious if my data was compromised.
upvoted 0 times
...
Aleshia
5 days ago
Exactly! Transparency builds confidence in the platform.
upvoted 0 times
...
Dean
10 days ago
Right! Timely notifications are key for trust.
upvoted 0 times
...
Wilda
15 days ago
A seems too late. We need proactive measures.
upvoted 0 times
...
Lawrence
20 days ago
D is definitely a reason to notify. Personal info is at risk.
upvoted 0 times
...
Jerry
26 days ago
C makes sense too. Harm is subjective but important.
upvoted 0 times
...
Aleshia
1 month ago
Agreed! If encryption keys are gone, that's a big deal.
upvoted 0 times
...
Dean
1 month ago
I think B is crucial. Credit card info is sensitive.
upvoted 0 times
...
Lavelle
1 month ago
Not sure if they need to notify for every little thing, seems excessive.
upvoted 0 times
...
Melissia
2 months ago
A breach involving names and PINs is a must-notify situation.
upvoted 0 times
...
Jamey
2 months ago
Wait, they encrypt everything, right? How could there be a breach?
upvoted 0 times
...
Mira
2 months ago
I think they should notify if they believe harm could come to candidates.
upvoted 0 times
...
Miriam
2 months ago
They definitely need to notify if credit card info is compromised.
upvoted 0 times
...
Tamie
2 months ago
I’m not entirely clear on the legal thresholds, but I think if names and sensitive info like PINs are stolen, that would definitely require a notification.
upvoted 0 times
...
Bernardo
2 months ago
I feel like I’ve seen a similar question before, and it seems like if they believe candidates could be harmed, that might also necessitate notifying them.
upvoted 0 times
...
Lilli
3 months ago
I’m a bit unsure about the specifics, but I think if credit card info and encryption keys are involved, that definitely triggers a notification requirement, right?
upvoted 0 times
...
Clarence
3 months ago
I remember studying about data breach notifications, and I think it’s crucial to notify individuals if their personal information is compromised.
upvoted 0 times
...

Save Cancel