Free Preparation Discussions
MENU
IAPP CIPP/US Exam Questions
- Topic 1: Introduction to the U.S. Privacy Environment: This topic equips IAPP Information Privacy Professionals with foundational knowledge of the structure of U.S. law, focusing on its fragmented nature. It also explains enforcement mechanisms for privacy and security laws across the federal and state levels. Lastly, it highlights the U.S. perspective on managing information, offering a comprehensive framework for understanding privacy dynamics critical to professional practice.
- Topic 2: Limits on Private-Sector Collection and Use of Data: Information Privacy Professionals gain insights into sector-specific data protection frameworks, including the FTC's cross-sector guidelines and rules for healthcare, financial, and educational institutions. These regulations limit data collection and usage practices, emphasizing compliance and consumer protection.
- Topic 3: Government and Court Access to Private-Sector Information: This topic provides an overview of government and legal system access to private-sector data, addressing privacy challenges related to law enforcement, national security, and civil litigation. It equips Information Privacy Professionals to assess privacy risks and ensure compliance when responding to governmental or judicial data requests.
- Topic 4: Workplace Privacy: Workplace privacy is explored through its lifecycle before, during, and after employment, providing Information Privacy Professionals with the knowledge to manage employee data responsibly. The topic emphasizes balancing organizational needs with compliance obligations, ensuring privacy standards are upheld in employment settings.
- Topic 5: State Privacy Laws: This topic examines the interplay between federal and state authority in privacy regulation, highlighting diverse data privacy and security laws. Information Privacy Professionals also learn about state-specific data breach notification laws.
Free IAPP CIPP/US Exam Actual Questions
Note: Premium Questions for CIPP/US were last updated On Jul. 18, 2026 (see below)
SCENARIO
Please use the following to answer the next QUESTION:
A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer's data handling practices.
The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her
withdrawal of consent and request for erasure of her personal dat
a. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: ''Please act immediately by identifying all personal data received from our company.''
This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup's rapid market penetration.
As the Company's data privacy leader, you are sensitive to the criticality of the relationship with the retailer.
Under the General Data Protection Regulation (GDPR), how would the U.S.-based startup company most likely be classified?
The data privacy leader needs to identify all the personal data that the Company has received from the retailer, as well as the purposes, retention periods, and sharing practices of such data. Since the data inventory is obsolete, the data privacy leader cannot rely on it to provide accurate and complete information. Therefore, the next best source of information is to interview the key marketing personnel who are responsible for the partnership with the retailer and the use of the personal data. The marketing personnel can provide insights into the data flows, the data categories, the data processing activities, and the data protection measures that the Company has implemented. They can also help the data privacy leader to locate the relevant documents, contracts, and records that can support the investigation.Reference:[IAPP CIPP/US Study Guide], Chapter 5: Data Management, p. 97-98;IAPP Privacy Tech Vendor Report, Data Mapping and Inventory, p. 9-10.
Privacy Is Hiring Inc., a CA-based company, is an online specialty recruiting firm focusing on placing privacy professionals in roles at major companies. Job candidates create online profiles
outlining their experience and credentials, and can pay $19.99/month via credit card to have their profiles promoted to potential employers. Privacy Is Hiring Inc. keeps all customer data at rest encrypted on its servers.
Under what circumstances would Privacy Is Hiring Inc., need to notify affected individuals in the event of a data breach?
Under the California Consumer Privacy Act (CCPA), a business that collects personal information of California residents must notify them of a data breach if their personal information is subject to unauthorized access and exfiltration, theft, or disclosure as a result of the business's violation of the duty to implement and maintain reasonable security procedures and practices. However, the CCPA excludes encrypted or redacted personal information from the definition of personal information, unless the encryption key or security credential is also compromised. Therefore, Privacy Is Hiring Inc. would need to notify the affected individuals only if the encryption keys were also taken along with the credit card information, as this would render the encryption ineffective and expose
the personal information to unauthorized access. The other options are not relevant to the CCPA notification requirement, although they may be relevant to other laws or best practices.Reference:CCPA(Section 1798.150),IAPP CIPP/US Study Guide(p. 63-64)
SCENARIO
Please use the following to answer the next QUESTION:
Declan has just started a job as a nursing assistant in a radiology department at Woodland Hospital. He has also started a program to become a registered nurse.
Before taking this career path, Declan was vaguely familiar with the Health Insurance Portability and Accountability Act (HIPAA). He now knows that he must help ensure the security of his patients' Protected Health Information (PHI). Therefore, he is thinking carefully about privacy issues.
On the morning of his first day, Declan noticed that the newly hired receptionist handed each patient a HIPAA privacy notice. He wondered if it was necessary to give these privacy notices to returning patients, and if the radiology department could reduce paper waste through a system of one-time distribution.
He was also curious about the hospital's use of a billing company. He questioned whether the hospital was doing all it could to protect the privacy of its patients if the billing company had details about patients' care.
On his first day Declan became familiar with all areas of the hospital's large radiology department. As he was organizing equipment left in the halfway, he overheard a conversation between two hospital administrators. He was surprised to hear that a portable hard drive containing non-encrypted patient information was missing. The administrators expressed relief that the hospital would be able to avoid liability. Declan was surprised, and wondered whether the hospital had plans to properly report what had happened.
Despite Declan's concern about this issue, he was amazed by the hospital's effort to integrate Electronic Health Records (EHRs) into the everyday care of patients. He thought about the potential for streamlining care even more if they were accessible to all medical facilities nationwide.
Declan had many positive interactions with patients. At the end of his first day, he spoke to one patient, John, whose father had just been diagnosed with a degenerative muscular disease. John was about to get blood work done, and he feared that the blood work could reveal a genetic predisposition to the disease that could affect his ability to obtain insurance coverage. Declan told John that he did not think that was possible, but the patient was wheeled away before he could explain why. John plans to ask a colleague about this.
In one month, Declan has a paper due for one his classes on a health topic of his choice. By then, he will have had many interactions with patients he can use as examples. He will be pleased to give credit to John by name for inspiring him to think more carefully about genetic testing.
Although Declan's day ended with many Questions, he was pleased about his new position.
What is the most likely way that Declan might directly violate the Health Insurance Portability and Accountability Act (HIPAA)?
Declan might directly violate the HIPAA Privacy Rule by using John's name and personal health information (PHI) in his paper without his written authorization. The Privacy Rule protects the confidentiality of PHI that is created, received, maintained, or transmitted by a covered entity or its business associate.PHI includes any information that relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and that identifies the individual or for which there is a reasonable basis to believe can be used to identify the individual1. Declan, as a nursing assistant, is part of the covered entity's workforce and must comply with the Privacy Rule. He cannot disclose John's PHI to anyone, including his classmates or instructors, without John's authorization or a valid exception under the Privacy Rule. Even if he does not use John's full name, he may still reveal enough information to make John identifiable, such as his diagnosis, his father's condition, or his location. This would be an impermissible use and disclosure of PHI, and a potential HIPAA violation.Declan should either obtain John's written authorization to use his PHI in his paper, or de-identify the information according to the Privacy Rule's standards2.Reference:
Summary of the HIPAA Privacy Rule
Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule
The rules for ''e-discovery'' mainly prevent which of the following?
E-discovery is the process by which parties share, review, and collect electronically stored information (ESI) to use as evidence in a legal matter1.The rules for e-discovery mainly prevent a conflict between business practice and technological safeguards, because they establish the standards and procedures for preserving, collecting, reviewing, and producing ESI in a way that balances the needs of litigation with the realities of technology2.For example, the Federal Rules of Civil Procedure (FRCP) provide guidance on the scope, timing, format, and methods of e-discovery, as well as the sanctions for failing to comply with e-discovery obligations3.The rules also encourage cooperation and communication among parties and courts to resolve e-discovery issues efficiently and effectively4. By following the rules for e-discovery, parties can avoid disputes, delays, and costs that may arise from incompatible or inconsistent business and technological practices.
The other options are not the main purpose of the rules for e-discovery, although they may be related or affected by them.The rules for e-discovery do not directly prevent the loss of information due to poor data retention practices, although they do impose a duty to preserve relevant ESI when litigation is reasonably anticipated5.The rules for e-discovery do not directly prevent the practice of employees using personal devices for work, although they do require parties to identify and disclose the sources of ESI that may be subject to discovery, including personal devices6.The rules for e-discovery do not directly prevent a breach of an organization's data retention program, although they do require parties to produce ESI in a reasonably usable form and to protect privileged or confidential information7.
Under state breach notification laws, which is NOT typically included in the definition of personal information?
Under state breach notification laws, personal information is typically defined as an individual's first name or first initial and last name plus one or more other data elements, such as Social Security number, state identification number, account number, medical information, etc. However, first and last name alone are not usually considered personal information, unless they are combined with other data elements that could identify the individual or compromise their security or privacy.Therefore, option B is the correct answer, as it is not typically included in the definition of personal information under state breach notification laws.Reference: https://www.ncsl.org/technology-and-communication/security-breach-notification-laws https://iapp.org/resources/article/state-data-breach-notification-chart/
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
David Bailey
1 day agoBetty Allen
29 days agoRobert Mitchell
1 month agoEmily Edwards
2 months agoLaura Rogers
2 months agoBarbara Brown
3 months agoAndrew Perez
3 months agoDennis Davis
3 months agoCharles Cooper
3 months agoHarold Perez
3 months agoDaniel Miller
2 months agoDavid Hill
2 months agoNieves
4 months agoBlondell
4 months agoTasia
4 months agoSkye
4 months agoHarris
5 months agoElvera
5 months agoMadalyn
5 months agoKatina
5 months agoJules
6 months agoCarey
6 months agoJohnna
6 months agoCarylon
6 months agoClaudia
7 months agoVan
7 months agoEulah
7 months agoShantell
7 months agoMaile
8 months agoAshlyn
8 months agoMose
8 months agoGeorgiann
8 months agoMarya
9 months agoCarey
9 months agoLeslie
9 months agoRikki
9 months agoReena
10 months agoJohana
10 months agoJade
10 months agoFranklyn
10 months agoTran
11 months agoPhil
11 months agoBarb
1 year agoErasmo
1 year agoCasie
1 year agoJohana
1 year agoMirta
1 year agoLonny
2 years agoDerick
2 years agoBettina
2 years agoDevorah
2 years agoStephania
2 years agoRosio
2 years agoDonte
2 years agoQuentin
2 years agoJacklyn
2 years agoMurray
2 years agoRodolfo
2 years agoCristal
2 years agoHerschel
2 years agoHyman
2 years agoFrancisca
2 years agoEllen
2 years agoNoe
2 years agoDeonna
2 years agoFranklyn
2 years agoGilberto
2 years agoCrista
2 years ago