Are You Ready for the CIPP/E Exam?

Let's try a practice test

Get your results instantly. Take our 10 practice questions and get an indication of where you stand!

1/10

Practice Questions

Each of the following is a building block to the definition of "personal data" under the GDPR, except:

If Company X acquires personal information about Person A and an employee of Company X improperly uses that data for his own use, which accurately describes each person's role?

Company X is a data controller, but the employee is only a processor.

Company X is a data controller, but the employee is neither a data controller nor a data processor.

Company X is a data processor, and the employee is a data controller.

Both Company X and the employee are data controllers.

What is the only international treaty with binding legal force related to data protection and privacy that is open to signature for every country throughout the world?

Which of the following is not true with respect to the security practices required to be implemented under the ePrivacy Directive?

Certain minimum security standards are required in every instance.

"Appropriate technical and organisational measures" must be implemented by electronic communication services.

Security controls must be "appropriate to the risk presented."

In determining the appropriate security controls to implement, electronic communication services must consider both cost and the state of the art.

According to the EDPB, a determination of whether a data subject is in the E.U. for purposes of applying Article 3(2) should be conducted at which point?

At the time of processing.

At the time of the triggering activity.

Every time data is subject to subsequent processing.

Whenever data is transferred outside the E.U.

Which processing principle under Article 5 of the GDPR will sometimes require controllers to authenticate and validate personal data prior to processing?

Anne purchases a gift for her close friend, Susan, from Company X and plans to have Company X deliver the product directly to Susan. Which of the following is true?

Company X has a lawful basis to process Susan's address because it is in Company X's legitimate interest to do so.

Company X has a lawful basis to process Susan's data because it is necessary for the performance of the contract between Company X and Anne.

Company X has a lawful basis to process Susan's address because it obtained consent from Anne.

Company X has a lawful basis to process Susan's address because it is necessary to comply with its legal obligations arising under the contract between Company X and Anne.

Which of the following best describes the efforts that data controllers must undertake to authenticate and verify the identity of a data subject before responding to a data subject request under the GDPR?

Data controllers must verify with certainty data subject identity before making any disclosures.

Data controllers must verify with certainty data subject identity before disclosures, but the requirements must be the minimum necessary to verify identity.

Data controllers need not verify the identity of data subjects, but implementing a process to do so will shield data controllers from liability.

Data controllers must implement reasonable and proportionate requirements to confirm data subject identity, which should be limited to the minimum necessary.

A cybercriminal has engaged in a ransomware attack on a data controller. After regaining access to the data, it becomes clear that the attacker never actually accessed personal data, which was fully encrypted in any event. Which of the following best describes the controller's disclosure obligations under the GDPR?

The controller must notify both the competent DPA under Article 33 and all effected data subjects under Article 34.

The controller likely need not notify the DPA under Article 33 nor the effected data subjects under Article 34.

The controller must notify the competent DPA under Article 33, but likely does not need to notify effected data subjects under Article 34.

The controller need not notify the competent DPA under Article 33, but likely must notify effected data subjects under Article 34.

Company X is an advertising network that collects data from third-party sources and creates user profiles on individual data subjects. It includes on its webpage an explanation of its privacy practices, and it requires all publishers that it works with to include a link to that page within their own terms and conditions. Which of the following is true?

Company X has failed to satisfy its information provision obligations under the GDPR because it did not provide direct notice of its privacy practices to individual data subjects.

Company X has not satisfied its information provision obligations under the GDPR because it does not include a link to its privacy notice on every advertisement that it hosts.

Company X has likely satisfied its information provision obligations under the GDPR because providing individual notice would be impossible or involve disproportionate effort.

It is not clear on these facts whether Company X has satisfied its information provision obligations under the GDPR.

Create a Privacy Bootcamp account to submit your exam and receive your score.

GET A COMPLETE CIPP/E CERTIFICATION PREPARATION PACKAGE

EVERYTHING YOU NEED TO PASS YOUR CIPP/E EXAM

The CIPP/E credential indicates that you are an expert in European privacy laws and regulations, including how those laws and regulations are applied. It is the Gold Standard for privacy professionals.

$499

Pass Risk Free - ENROLL NOW

✔ 120+ Guided e-Study Modules

✔ 650+ Practice Questions

✔ Practice and Assessment Tools

✔ Lifetime Access to All Materials

✔ Full Money-Back Guarantee*

✔ Industry-Leading Pass Rate

✔ Instant Access Upon Purchase

All you need to pass your CIPP/E Exam...