Free Preparation Discussions
MENU
IAPP CIPP-E Exam Questions
- Topic 1: Information Systems Auditing Process: This section of the exam measures skills of an IT Auditor and covers how to plan, conduct, and report on audits of information systems. It tests ability to use audit standards, gather evidence, do sampling, manage audit engagements, and ensure audit quality.
- Topic 2: Governance & Management of IT: This section evaluates the capabilities of an IT Manager in overseeing IT governance, defining policies and procedures, aligning IT strategy with business objectives, handling enterprise risk management, and managing IT resources and vendor relationships.
- Topic 3: Information Systems Acquisition, Development & Implementation: Here, the exam assesses an IT Auditor’s knowledge about acquiring or building new systems, understanding project governance, evaluating development methodologies, ensuring systems are properly tested and implemented, and verifying that changes meet requirements.
- Topic 4: Information Systems Operations & Business Resilience: This domain focuses on an IT Manager’s responsibilities in operations: maintaining systems, managing assets, ensuring availability and capacity, handling incidents and changes, performing business continuity planning, disaster recovery, and ensuring resilience of IT services
- Topic 5: Protection of Information Assets: This part measures an IT Auditor’s expertise in protecting data and systems. It includes understanding of identity and access management, data encryption, endpoint and network security, physical/environmental controls, threat detection and incident response, and ensuring compliance with security frameworks.
Free IAPP CIPP-E Exam Actual Questions
Note: Premium Questions for CIPP-E were last updated On May. 03, 2026 (see below)
A well-known video production company, based in Spain but specializing in documentaries filmed worldwide, has just finished recording several hours of footage featuring senior citizens in the streets of Madrid. Under what condition would the company NOT be required to obtain the consent of everyone whose image they use for their documentary?
According to the GDPR, consent is one of the six lawful bases for processing personal data, but not the only one. The other five are: contract, legal obligation, vital interests, public task and legitimate interests. Legitimate interests can be invoked by controllers who process personal data for their own benefit or for the benefit of third parties, as long as such processing does not override the rights and freedoms of the data subjects, especially if they are children. The GDPR also recognizes that processing personal data for journalistic purposes or the purposes of academic, artistic or literary expression may be necessary for the exercise of the right to freedom of expression and information, which is a legitimate interest. Therefore, the company may not need to obtain the consent of everyone whose image they use for their documentary, if they can demonstrate that their processing is necessary for the purposes of their journalistic, artistic or literary expression, and that they have taken into account the reasonable expectations of the data subjects and the potential impact on their privacy. The company should also comply with any relevant national laws or codes of conduct that may apply to such processing.Reference:
GDPR, Article 6(1)(a)-(f)
GDPR, Recital 47
GDPR, Article 85
What was the main failing of Convention 108 that led to the creation of the Data Protection Directive (Directive 95/46/EC)?
Convention 108 was the first legally binding international instrument in the data protection field, adopted by the Council of Europe in 19811.However, it had some limitations that led to the creation of the Data Protection Directive (Directive 95/46/EC) by the European Union in 19952.One of the main failings of Convention 108 was that it was implemented in a fragmented manner by a small number of states, resulting in divergent and inconsistent national laws and practices3.The Data Protection Directive aimed to harmonize the data protection rules within the EU and to ensure a high level of protection for individuals' rights and freedoms2. Therefore, option C is the correct answer.Option A is incorrect because Convention 108 did account for the rapid growth of the Internet by allowing for amendments and protocols to adapt to technological developments1.Option B is incorrect because Convention 108 did include protections for sensitive personal data, such as those revealing racial origin, political opinions, religious beliefs, health, or sexual life1.Option D is incorrect because Convention 108 did not prescribe specific penalties for violations of data protection rights, but left it to the Parties to adopt appropriate sanctions and remedies1.Reference:
Convention 108 and Protocols
CIPP/E Certification
Convention 108+ and the Data Protection Framework of the EU
What is an important difference between the European Court of Human Rights (ECHR) and the Court of Justice of the European Union (CJEU) in relation to their roles and functions?
The ECHR and the CJEU are part of two different legal systems: the Council of Europe and the European Union, respectively. The ECHR is a treaty that guarantees human rights and fundamental freedoms to individuals within the jurisdiction of its 47 member states. The CJEU is the judicial branch of the EU that ensures the uniform interpretation and application of EU law within its 27 member states. The ECHR can only hear complaints from individuals or states alleging violations of the rights enshrined in the convention, and it can only issue judgments that are binding on the respondent state. The CJEU, on the other hand, can hear cases from individuals, states, EU institutions, or national courts on any matter of EU law, and it can issue rulings that are binding on all EU member states and institutions. The CJEU can also impose sanctions or penalties on states that fail to comply with its judgments or EU law in general. Therefore, the CJEU has more power and authority to enforce EU law than the ECHR has to enforce human rights law.Reference:CIPP/E Certification,ECHR and the CJEU,The UK, the EU and a British Bill of Rights
In which situation would a data controller most likely be able to justify the processing of the data of a child without parental consent?
Under the GDPR, the processing of personal data of a child on the basis of consent requires the consent of the holder of parental responsibility over the child, unless the child is at least 16 years old or the applicable national law provides for a lower age (not below 13 years). However, there are some situations where the processing of personal data of a child without parental consent may be justified by other lawful grounds, such as the performance of a contract, the compliance with a legal obligation, the protection of vital interests, the performance of a task carried out in the public interest, or the legitimate interests of the controller or a third party. One of these situations is when the processing is necessary for providing preventive or counselling services to the child, especially in the context of information society services. This is recognised by Recital 38 of the GDPR, which states that:
''Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to the use of personal data of children for the purposes of marketing or creating personality or user profiles and the collection of personal data with regard to children when using services offered directly to a child. The consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child.''
Therefore, the processing of personal data of a child without parental consent may be lawful if it is necessary for providing preventive or counselling services to the child, such as health, education, social or legal services, that are offered directly to the child and that aim to protect the child's well-being, safety, development or rights. This may include, for example, online counselling platforms, sexual health advice services, anti-bullying or mental health support services, or child protection helplines. In such cases, the controller should ensure that the processing is fair, transparent, proportionate and respectful of the child's best interests, and that appropriate safeguards are in place to protect the child's personal data and rights.
The other options are not likely to justify the processing of personal data of a child without parental consent, as they do not meet the criteria of necessity, proportionality or legitimacy. The processing of personal data of a child for market research purposes is not necessary for the performance of a contract, the compliance with a legal obligation, the protection of vital interests, the performance of a task carried out in the public interest, or the legitimate interests of the controller or a third party, and may pose significant risks to the child's privacy and autonomy. Therefore, such processing requires the consent of the holder of parental responsibility over the child, unless the child is old enough to give their own consent. The provision of materials purely for educational use to a child may not require the processing of personal data of the child at all, or may only require the processing of minimal personal data, such as the child's name or email address. In such cases, the processing may be based on the consent of the child, if the child is old enough to understand the implications of their consent, or on the legitimate interests of the controller, if the processing is necessary for the provision of the educational materials and does not override the interests or rights of the child. However, the controller should still inform the child and the holder of parental responsibility about the processing and provide them with the opportunity to object or withdraw their consent. The existence of a legitimate business interest does not automatically justify the processing of personal data of a child without parental consent, as the controller must also consider the impact of the processing on the rights and freedoms of the child, and whether the processing is necessary and proportionate for the pursuit of that interest. Moreover, the controller must balance the legitimate business interest against the interests or rights of the child, and ensure that the processing does not cause any harm or disadvantage to the child. If the processing involves the use of personal data of a child for the purposes of marketing or creating personality or user profiles, the controller must obtain the consent of the holder of parental responsibility over the child, unless the child is old enough to give their own consent, as these purposes pose a high risk to the child's privacy and autonomy.Reference:GDPR Article 6,GDPR Article 8,GDPR Recital 38,Children and the UK GDPR | ICO,Guidelines on consent under Regulation 2016/679 - European Data Protection Board
Which GDPR requirement will present the most significant challenges for organizations with Bring Your Own Device (BYOD) programs?
According to theFree CIPP/E Study Guide, page 12, ''the GDPR requires data controllers to implement appropriate technical and organizational measures to ensure and to be able to demonstrate that processing is performed in accordance with the GDPR. These measures should take into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons.'' The GDPR also requires data controllers to ensure the security of personal data, to notify data breaches to the supervisory authorities and data subjects, and to cooperate with the supervisory authorities in providing any information necessary for the performance of their tasks. Therefore, the GDPR requirement that data controllers must be in control of the data they hold at all times will present the most significant challenges for organizations with BYOD programs, as they will have to deal with the increased risks of data loss, theft, unauthorized access, or misuse that may arise from the use of personal devices by employees or contractors. The other options are not necessarily more challenging for organizations with BYOD programs, although they may involve other obligations under the GDPR, such as obtaining a valid legal basis, providing adequate safeguards, or informing the data subjects.Reference:
Free CIPP/E Study Guide, page 12
GDPR, Articles 24, 25, 28, 32, 33, 34 and 58
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Nathan Turner
7 days agoGerman
25 days agoGeorgene
1 month agoLeonora
1 month agoXuan
2 months agoMaybelle
2 months agoChandra
2 months agoFrederic
2 months agoMarti
3 months agoBrandon
3 months agoDylan
3 months agoChaya
3 months agoRose
4 months agoValda
4 months agoMiesha
4 months agoTommy
4 months agoUla
4 months agoGary
5 months agoRoosevelt
5 months agoHyun
5 months agoRolf
5 months agoCyril
6 months agoBernardo
6 months agoAmmie
6 months agoAliza
7 months agoSylvia
7 months agoDarnell
7 months agoAdell
7 months agoYasuko
7 months agoRegenia
8 months agoBilly
8 months agoWhitney
8 months agoAvery
10 months agoIra
10 months agoJade
10 months agoDesiree
11 months agoVeda
1 year agoShawna
1 year agoLatrice
1 year agoKristian
1 year agoShawna
1 year agoTherese
1 year agoGwenn
1 year agoTerry
1 year agoRikki
1 year agoCatalina
1 year agoRemona
1 year agoGilberto
1 year agoTesha
1 year agoGolda
1 year agoCatarina
1 year agoRuthann
1 year agoLouisa
1 year agoEsteban
1 year agoAhmad
1 year agoFernanda
1 year agoClarence
1 year agoMerissa
1 year agoPhil
2 years agoLinsey
2 years agoAlida
2 years agoWillodean
2 years agoJosephine
2 years agoErinn
2 years agoVeronique
2 years agoWayne
2 years agoJill
2 years agoHector
2 years agoFlorencia
2 years agoRaelene
2 years agoJoesph
2 years agoFidelia
2 years agoHyun
2 years agoMireya
2 years ago