Free Preparation Discussions
MENU
IAPP CIPP/E Exam Questions
- Topic 1: Information Systems Auditing Process: This section of the exam measures skills of an IT Auditor and covers how to plan, conduct, and report on audits of information systems. It tests ability to use audit standards, gather evidence, do sampling, manage audit engagements, and ensure audit quality.
- Topic 2: Governance & Management of IT: This section evaluates the capabilities of an IT Manager in overseeing IT governance, defining policies and procedures, aligning IT strategy with business objectives, handling enterprise risk management, and managing IT resources and vendor relationships.
- Topic 3: Information Systems Acquisition, Development & Implementation: Here, the exam assesses an IT Auditor’s knowledge about acquiring or building new systems, understanding project governance, evaluating development methodologies, ensuring systems are properly tested and implemented, and verifying that changes meet requirements.
- Topic 4: Information Systems Operations & Business Resilience: This domain focuses on an IT Manager’s responsibilities in operations: maintaining systems, managing assets, ensuring availability and capacity, handling incidents and changes, performing business continuity planning, disaster recovery, and ensuring resilience of IT services
- Topic 5: Protection of Information Assets: This part measures an IT Auditor’s expertise in protecting data and systems. It includes understanding of identity and access management, data encryption, endpoint and network security, physical/environmental controls, threat detection and incident response, and ensuring compliance with security frameworks.
Free IAPP CIPP/E Exam Actual Questions
Note: Premium Questions for CIPP/E were last updated On Oct. 25, 2026 (see below)
SCENARIO
Please use the following to answer the next question:
Jane Stan's her new role as a Data Protection Officer (DPO) at a Malta-based company that allows anyone to buy and sell cryptocurrencies via its online platform. The company stores and processes the personal data of its customers in a dedicated data center located in Malta |EU).
People wishing to trade cryptocurrencies are required to open an online account on the platform. They then must successfully pass a KYC due diligence procedure aimed at preventing money laundering and ensuring compliance with applicable financial regulations.
The non-European customers are also required to waive all their GDPR rights by reading a disclaimer written in bold and belong a checkbox on a separate page in order to get their account approved on the platform.
The customers must likewise accept the terms of service of the platform. The terms of service also include a privacy policy section, saying, among other things, that if a
Which of the following must be a component of the anti-money-laundering data-sharing practice of the platform?
According to Article 13 of the GDPR, when personal data are collected from the data subject, the controller shall provide the data subject with certain information, such as the purposes and legal basis of the processing, the recipients or categories of recipients of the personal data, and the existence of the data subject's rights. This information shall be provided at the time when personal data are obtained. The purpose of this requirement is to ensure that the data subject is informed and aware of how their personal data will be used and shared, and to enable them to exercise their rights accordingly. Therefore, customers shall receive a clear and conspicuous notice about such data sharing before submitting their data during the registration process.Reference:
Article 13 of the GDPR
IAPP CIPP/E Study Guide, page 32
Article 29 Working Party has emphasized that the GDPR forbids ''forum shopping'', which occurs when companies do what?
The GDPR aims to harmonize the data protection rules across the EU and to ensure consistent and effective enforcement of those rules. However, the GDPR also recognizes that there may be some differences in the interpretation and application of the law among the member states, depending on their national legislation, culture and practices.Therefore, the GDPR introduces the concept of the ''main establishment'' of a controller or processor, which is the place where the decisions on the purposes and means of the processing of personal data are taken in the EU1.The main establishment determines which national supervisory authority will act as the lead authority for the cross-border processing activities of that controller or processor, and which national law will apply in case of a dispute or a complaint2.The Article 29 Working Party, which is an advisory body composed of representatives of the national supervisory authorities, the European Data Protection Supervisor and the European Commission, has issued guidelines on how to identify the main establishment of a controller or processor under the GDPR3. The guidelines emphasize that the main establishment must reflect the reality of the processing activities and the effective and real exercise of management power over those activities. The guidelines also warn against the practice of ''forum shopping'', which occurs when a controller or processor designates its main establishment in a member state with the most flexible or lenient data protection regime, regardless of the actual location of the decision-making or the data processing. The guidelines state that such a practice is forbidden under the GDPR, and that the supervisory authorities will closely monitor and verify the criteria used by the controllers or processors to determine their main establishment.If the supervisory authorities find that the main establishment does not correspond to the factual situation, they may challenge the designation and apply the relevant corrective measures4.Reference:1Art.4 (16) GDPR -- Definitions - General Data Protection Regulation (GDPR)2Art.56-58 GDPR -- Cooperation and consistency - General Data Protection Regulation (GDPR)3Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) - European Data Protection Board4Ibid, p. 14-15.
Which of the following regulates the use of electronic communications services within the European Union?
Directive 2002/58/EC, also known as the ePrivacy Directive, regulates the use of electronic communications services within the European Union. It covers issues such as confidentiality of communications, processing of traffic and location data, spam, cookies, and security breaches. It complements and particularises Directive 95/46/EC, also known as the Data Protection Directive, which sets out the general principles for the protection of personal data in the EU. The ePrivacy Directive was amended by Directive 2009/136/EC, which introduced new provisions on consent, cookies, and breach notification. The ePrivacy Directive is currently under review and will be replaced by a new Regulation on Privacy and Electronic Communications (ePrivacy Regulation), which is still being negotiated by the EU institutions.Reference:Directive 2002/58/EC,Directive 2009/136/EC, [ePrivacy Regulation]
An employee of company ABCD has just noticed a memory stick containing records of client data, including their names, addresses and full contact details has disappeared. The data on the stick is unencrypted and in clear text. It is uncertain what has happened to the stick at this stage, but it likely was lost during the travel of an employee. What should the company do?
The GDPR requires that in the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons1.A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed2. In this scenario, the company ABCD is the controller of the client data, and the loss of the memory stick containing unencrypted and clear text personal data is a personal data breach that may pose a risk to the rights and freedoms of the data subjects, such as identity theft, fraud, financial loss, or reputational damage.Therefore, the company ABCD should notify the data protection supervisory authority as soon as possible, and provide the information specified in Article 33(3) of the GDPR, such as the nature of the breach, the categories and number of data subjects and personal data records concerned, the likely consequences of the breach, and the measures taken or proposed to address the breach1. Option A is the correct answer, as it reflects the obligation of the controller under the GDPR. Options B, C and D are incorrect, as they do not comply with the GDPR requirements.Option B would delay the notification beyond the 72-hour deadline, which could result in administrative fines or other sanctions3.Option C would misuse the ''disproportionate effort'' exception, which only applies to the communication of the breach to the data subjects, not to the notification to the supervisory authority, and only when the controller has implemented appropriate technical and organisational protection measures, such as encryption, that render the personal data unintelligible to any person who is not authorised to access it4.Option D would prematurely notify the customers of the company without first notifying the supervisory authority, and without assessing the level of risk and the necessity of such communication, which should be done in consultation with the supervisory authority5.Reference:1: Article 33(1) of the GDPR2: Article 4(12) of the GDPR3: Article 83(4)(a) of the GDPR4: Article 34(3)(a) of the GDPR5: Article 34(1) and (2) of the GDPR
After detecting an intrusion involving the theft of unencrypted personal data, who shall the breached company notify first under GDPR requirements?
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Karen Hernandez
1 month agoMichelle Morris
2 months agoNathan Murphy
2 months agoSusan Evans
3 months agoCarol Lopez
3 months agoThomas Smith
4 months agoSharon Rogers
4 months agoStephanie Collins
5 months agoPaul Bell
5 months agoDaniel Green
6 months agoNathan Turner
6 months agoSharon Baker
6 months agoSarah Wright
6 months agoRonald Moore
6 months agoSusan Johnson
6 months agoTimothy Walker
6 months agoGerman
7 months agoGeorgene
7 months agoLeonora
8 months agoXuan
8 months agoMaybelle
8 months agoChandra
8 months agoFrederic
9 months agoMarti
9 months agoBrandon
9 months agoDylan
9 months agoChaya
10 months agoRose
10 months agoValda
10 months agoMiesha
10 months agoTommy
10 months agoUla
11 months agoGary
11 months agoRoosevelt
11 months agoHyun
11 months agoRolf
12 months agoCyril
12 months agoBernardo
1 year agoAmmie
1 year agoAliza
1 year agoSylvia
1 year agoDarnell
1 year agoAdell
1 year agoYasuko
1 year agoRegenia
1 year agoBilly
1 year agoWhitney
1 year agoAvery
1 year agoIra
1 year agoJade
1 year agoDesiree
1 year agoVeda
2 years agoShawna
2 years agoLatrice
2 years agoKristian
2 years agoShawna
2 years agoTherese
2 years agoGwenn
2 years agoTerry
2 years agoRikki
2 years agoCatalina
2 years agoRemona
2 years agoGilberto
2 years agoTesha
2 years agoGolda
2 years agoCatarina
2 years agoRuthann
2 years agoLouisa
2 years agoEsteban
2 years agoAhmad
2 years agoFernanda
2 years agoClarence
2 years agoMerissa
2 years agoPhil
2 years agoLinsey
2 years agoAlida
2 years agoWillodean
2 years agoJosephine
2 years agoErinn
2 years agoVeronique
2 years agoWayne
2 years agoJill
2 years agoHector
2 years agoFlorencia
2 years agoRaelene
2 years agoJoesph
2 years agoFidelia
2 years agoHyun
2 years agoMireya
2 years ago