Free Preparation Discussions
MENU
IAPP CIPP-E Exam Questions
- Topic 1: Information Systems Auditing Process: This section of the exam measures skills of an IT Auditor and covers how to plan, conduct, and report on audits of information systems. It tests ability to use audit standards, gather evidence, do sampling, manage audit engagements, and ensure audit quality.
- Topic 2: Governance & Management of IT: This section evaluates the capabilities of an IT Manager in overseeing IT governance, defining policies and procedures, aligning IT strategy with business objectives, handling enterprise risk management, and managing IT resources and vendor relationships.
- Topic 3: Information Systems Acquisition, Development & Implementation: Here, the exam assesses an IT Auditor’s knowledge about acquiring or building new systems, understanding project governance, evaluating development methodologies, ensuring systems are properly tested and implemented, and verifying that changes meet requirements.
- Topic 4: Information Systems Operations & Business Resilience: This domain focuses on an IT Manager’s responsibilities in operations: maintaining systems, managing assets, ensuring availability and capacity, handling incidents and changes, performing business continuity planning, disaster recovery, and ensuring resilience of IT services
- Topic 5: Protection of Information Assets: This part measures an IT Auditor’s expertise in protecting data and systems. It includes understanding of identity and access management, data encryption, endpoint and network security, physical/environmental controls, threat detection and incident response, and ensuring compliance with security frameworks.
Free IAPP CIPP-E Exam Actual Questions
Note: Premium Questions for CIPP-E were last updated On Mar. 19, 2026 (see below)
What is an important difference between the European Court of Human Rights (ECHR) and the Court of Justice of the European Union (CJEU) in relation to their roles and functions?
In which situation would a data controller most likely be able to justify the processing of the data of a child without parental consent?
Under the GDPR, the processing of personal data of a child on the basis of consent requires the consent of the holder of parental responsibility over the child, unless the child is at least 16 years old or the applicable national law provides for a lower age (not below 13 years). However, there are some situations where the processing of personal data of a child without parental consent may be justified by other lawful grounds, such as the performance of a contract, the compliance with a legal obligation, the protection of vital interests, the performance of a task carried out in the public interest, or the legitimate interests of the controller or a third party. One of these situations is when the processing is necessary for providing preventive or counselling services to the child, especially in the context of information society services. This is recognised by Recital 38 of the GDPR, which states that:
''Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to the use of personal data of children for the purposes of marketing or creating personality or user profiles and the collection of personal data with regard to children when using services offered directly to a child. The consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child.''
Therefore, the processing of personal data of a child without parental consent may be lawful if it is necessary for providing preventive or counselling services to the child, such as health, education, social or legal services, that are offered directly to the child and that aim to protect the child's well-being, safety, development or rights. This may include, for example, online counselling platforms, sexual health advice services, anti-bullying or mental health support services, or child protection helplines. In such cases, the controller should ensure that the processing is fair, transparent, proportionate and respectful of the child's best interests, and that appropriate safeguards are in place to protect the child's personal data and rights.
Which GDPR requirement will present the most significant challenges for organizations with Bring Your Own Device (BYOD) programs?
SCENARIO
Please use the following to answer the next question:
T-Craze, a German-headquartered specialty t-shirt company, was successfully selling to large German metropolitan cities. However, after a recent merger with another German-based company that was selling to a broader European market, T-Craze revamped its marketing efforts to sell to a wider audience. These efforts included a complete redesign of its logo to reflect the recent merger, and improvements to its website meant to capture more information about visitors through the use of cookies.
T-Craze also opened various office locations throughout Europe to help expand its business. While Germany continued to host T-Craze's headquarters and main product-design office, its French affiliate became responsible for all marketing and sales activities. The French affiliate recently procured the services of Right Target, a renowned marketing firm based in the Philippines, to run its latest marketing campaign. After thorough research, Right Target determined that T-Craze is most successful with customers between the ages of 18 and 22. Thus, its first campaign targeted university students in several European capitals, which yielded nearly 40% new customers for T-Craze in one quarter. Right Target also ran subsequent campaigns for T- Craze, though with much less success.
The last two campaigns included a wider demographic group and resulted in countless unsubscribe requests, including a large number in Spain. In fact, the Spanish data protection authority received a complaint from Sofia, a mid-career investment banker. Sofia was upset after receiving a marketing communication even after unsubscribing from such communications from the Right Target on behalf of T-Craze.
Why does the Spanish supervisory authority notify the French supervisory authority when it opens an investigation into T-Craze based on Sofia's complaint?
A data controller appoints a data protection officer. Which of the following conditions would NOT result in an infringement of Articles 37 to 39 of the GDPR?
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Xuan
16 hours agoMaybelle
8 days agoChandra
16 days agoFrederic
23 days agoMarti
1 month agoBrandon
1 month agoDylan
2 months agoChaya
2 months agoRose
2 months agoValda
2 months agoMiesha
2 months agoTommy
3 months agoUla
3 months agoGary
3 months agoRoosevelt
3 months agoHyun
4 months agoRolf
4 months agoCyril
4 months agoBernardo
4 months agoAmmie
5 months agoAliza
5 months agoSylvia
5 months agoDarnell
5 months agoAdell
6 months agoYasuko
6 months agoRegenia
6 months agoBilly
6 months agoWhitney
6 months agoAvery
8 months agoIra
8 months agoJade
9 months agoDesiree
9 months agoVeda
11 months agoShawna
11 months agoLatrice
12 months agoKristian
12 months agoShawna
1 year agoTherese
1 year agoGwenn
1 year agoTerry
1 year agoRikki
1 year agoCatalina
1 year agoRemona
1 year agoGilberto
1 year agoTesha
1 year agoGolda
1 year agoCatarina
1 year agoRuthann
1 year agoLouisa
1 year agoEsteban
1 year agoAhmad
1 year agoFernanda
1 year agoClarence
1 year agoMerissa
1 year agoPhil
1 year agoLinsey
1 year agoAlida
1 year agoWillodean
1 year agoJosephine
1 year agoErinn
1 year agoVeronique
1 year agoWayne
2 years agoJill
2 years agoHector
2 years agoFlorencia
2 years agoRaelene
2 years agoJoesph
2 years agoFidelia
2 years agoHyun
2 years agoMireya
2 years ago