Certified Information Privacy Professional/United States (CIPP/US) — Questions and Answers

Question 1: Under CCPA, how long does a business have to respond to a verifiable consumer request to know or delete?

60 days with no extensions
30 days with no extensions
45 days, extendable by another 45 days with notice (Correct answer)
90 days, extendable to 180 days

Correct answer: 45 days, extendable by another 45 days with notice

Businesses have 45 days to respond to verifiable consumer requests, with the ability to extend by an additional 45 days if they notify the consumer.

Question 2: The Driver's Privacy Protection Act (DPPA) restricts state DMVs from disclosing what type of information?

Personal information from motor vehicle records, such as names, addresses, and SSNs (Correct answer)
Traffic enforcement records and citations
Accident and insurance claim data only
Vehicle mechanical inspection records

Correct answer: Personal information from motor vehicle records, such as names, addresses, and SSNs

The DPPA restricts state DMVs from disclosing personal information in motor vehicle records — like names, addresses, SSNs, and photos — except for specified permissible uses.

Question 3: The FTC's enforcement authority over privacy primarily derives from which legal provision?

COPPA Rule authority only
The Electronic Communications Privacy Act
The Privacy Act of 1974
Section 5 of the FTC Act prohibiting unfair or deceptive acts (Correct answer)

Correct answer: Section 5 of the FTC Act prohibiting unfair or deceptive acts

The FTC uses Section 5 of the FTC Act, which prohibits unfair or deceptive practices, as its primary tool to enforce privacy commitments.

Question 4: Which of the following protections provided to job seekers by the FCRA is not one?

Job applicants have the right to receive an additional free report from the company if they request it within 2 years (Correct answer)
Job applicants have the right to appeal decisions if the applicant feels a decision was made unfairly
Job applicants have the right to review the information that references their personal and financial information
Job applicants have the right to be informed of a background check

Correct answer: Job applicants have the right to receive an additional free report from the company if they request it within 2 years

According to the Federal Trade Commission, job seekers have various protections thanks to the Fair Credit Reporting Act. Job candidates have the right to request a written background check, to examine information about their personal and financial affairs, to rectify any errors found in the report, and to challenge any potentially unjust conclusions. They also have the right to be notified about background checks. <br> <br> Employers must notify job applicants of any adverse actions they may take if they decide to take them based on information from background check reports. This notification is provided to clarify the job applicant's rights to see the report and have any inaccuracies in the report corrected. The person must be advised that if asked within 60 days, the business will offer a free report. Employers are required by the Equal Employment Opportunity Commission to keep background checks for a year after the requested date or until the employer takes corrective action. After a year from that date, employers must discard the consumer report.

Question 5: Under HIPAA, patients have the right to access their PHI within how many days of requesting it?

30 days, extendable once by 30 additional days (Correct answer)
7 days
60 days with no extension
90 days with one 30-day extension

Correct answer: 30 days, extendable once by 30 additional days

Covered entities must provide access to PHI within 30 days, with the ability to extend once by an additional 30 days with written explanation.

Question 6: Under the Gramm-Leach-Bliley Act (GLBA), what must financial institutions provide to customers at the time of establishing a customer relationship?

A written consent form for all data sharing
A data retention schedule
An initial privacy notice (Correct answer)
A data breach notification

Correct answer: An initial privacy notice

GLBA requires financial institutions to deliver an initial privacy notice to customers at the time the customer relationship is established.

Question 7: Which federal agency has primary enforcement authority over national banks under GLBA's privacy provisions?

Securities and Exchange Commission (SEC)
Consumer Financial Protection Bureau (CFPB)
Federal Trade Commission (FTC)
Office of the Comptroller of the Currency (OCC) (Correct answer)

Correct answer: Office of the Comptroller of the Currency (OCC)

The OCC has primary supervisory and enforcement authority over national banks, including compliance with GLBA privacy requirements.

Question 8: What is the name of the legal document that formalizes an agreement between a government agency and an opposing party and is approved by a judge?

Stare decisis decree
Common law judgment
A judgment rider
A consent decree (Correct answer)

Correct answer: A consent decree

A legal document approved by a judge that formalizes an agreement between a governmental agency and an adverse party is called a "consent decree."

Question 9: Which principle from the Fair Information Practice Principles (FIPPs) requires that personal data be collected only for specified purposes and not used in ways incompatible with those purposes?

Data minimization
Purpose limitation (Correct answer)
Individual participation
Accuracy

Correct answer: Purpose limitation

Purpose limitation restricts the use of personal data to the specific purposes disclosed at the time of collection.

Question 10: What is the 'routine use' exception under the Privacy Act of 1974?

A published SORN exception allowing disclosure compatible with the purpose for which the data was collected (Correct answer)
An exception allowing any government agency to share data freely
An exception for disclosures made in emergencies without SORN publication
A rule permitting agencies to sell data to commercial entities

Correct answer: A published SORN exception allowing disclosure compatible with the purpose for which the data was collected

Routine use exceptions, published in a system's SORN, allow agencies to disclose records for purposes compatible with the reason the information was originally collected.

Question 11: Which federal law requires employers to keep I-9 employment eligibility verification forms and prohibits using them for discriminatory purposes?

HIPAA
Immigration Reform and Control Act (IRCA) (Correct answer)
Privacy Act of 1974
FERPA

Correct answer: Immigration Reform and Control Act (IRCA)

IRCA requires employers to verify employment eligibility via I-9 forms and prohibits discriminatory use of this verification process.

Question 12: The CPRA strengthened opt-out rights by expanding the concept of 'sale' to also include what?

Sharing personal information for cross-context behavioral advertising (Correct answer)
Internal analytics uses
All business transfers
Sharing within wholly-owned subsidiaries

Correct answer: Sharing personal information for cross-context behavioral advertising

The CPRA added 'sharing' personal information for cross-context behavioral advertising as a separate opt-out right, covering data shared for targeted advertising without money changing hands.

Question 13: Which federal law gives US citizens and legal permanent residents the right to access and correct federal agency records about themselves?

Privacy Act of 1974 (Correct answer)
Freedom of Information Act
E-Government Act of 2002
Federal Records Act

Correct answer: Privacy Act of 1974

The Privacy Act of 1974 grants US citizens and lawful permanent residents the right to access and request correction of federal agency records maintained in systems of records.

Question 14: Which US federal agency serves as the primary enforcer of financial institution data breach obligations under the GLBA Safeguards Rule?

OCC
CFPB
SEC
FTC (for non-bank financial institutions) (Correct answer)

Correct answer: FTC (for non-bank financial institutions)

The FTC enforces the GLBA Safeguards Rule for non-bank financial institutions, while banking regulators enforce it for banks.

Question 15: Which GLBA exception permits financial institutions to share NPI with unaffiliated third parties without offering consumers an opt-out right?

Customer analytics exception
Joint marketing agreement exception (Correct answer)
General marketing exception
Promotional partners exception

Correct answer: Joint marketing agreement exception

The joint marketing agreement exception allows sharing NPI with unaffiliated companies for joint product or service marketing purposes without triggering the opt-out requirement.

Question 16: What are the civil monetary penalty tiers under HIPAA, reflecting the level of culpability?

Penalties range from $1 to $1,000 per violation
Flat $10,000 per violation regardless of culpability
Only criminal penalties apply; no civil monetary penalties exist
Did not know, reasonable cause, willful neglect corrected, willful neglect not corrected — escalating from $100 to $50,000 per violation (Correct answer)

Correct answer: Did not know, reasonable cause, willful neglect corrected, willful neglect not corrected — escalating from $100 to $50,000 per violation

HIPAA's tiered civil monetary penalty structure ranges from $100/violation (did not know) to $50,000/violation (willful neglect not corrected), with annual caps per violation category.

Question 17: What is the phrase used to describe the situation where a federal statute overrides a state privacy legislation?

Federal enforcement action
Jurisdiction
Veto
Preemption (Correct answer)

Correct answer: Preemption

State legislation addressing common problems, such as the unauthorized gathering and exploitation of personal information, may occasionally be preempted by federal law. Regarding applying privacy and data protection legislation at the federal and state levels, preemption is among the most challenging legal rulings. <br> <br> In rare instances, district court judges have used their discretion to rule that a claim alleging breaches of federal privacy law does not preempt or invalidate a right of action under a state's privacy legislation. For instance, a district court judge for the sixth circuit determined that claims of invasion of privacy made under state law were not preempted by the claim made under federal law in a case citing claims of the federal Stored Communications Act (18 U.S.C. 2701, et seq.). According to this ruling, the plaintiff, in this instance, has the right to pursue redress under both federal and state tort law.

Question 18: Under the 2023 FTC Safeguards Rule amendment, non-banking financial institutions must notify the FTC of breaches affecting how many customers?

1,000 or more customers
100 or more customers
500 or more customers (Correct answer)
All breaches regardless of size

Correct answer: 500 or more customers

The 2023 amendment requires non-banking financial institutions to notify the FTC within 30 days of discovering a breach involving 500 or more customers.

Question 19: Under the Privacy Act of 1974, federal agency employees have the right to:

Access and correct their records held in agency systems of records (Correct answer)
Receive compensation for any unauthorized disclosure
Block any use of their data for employment decisions
Opt out of all system of records disclosures

Correct answer: Access and correct their records held in agency systems of records

The Privacy Act gives federal employees the right to access and request correction of records about themselves maintained in federal agency systems of records.

Question 20: What is the HIPAA Privacy Rule's general rule on the use of PHI for marketing?

PHI may be used for marketing under a business associate agreement
PHI can be used freely for marketing if the covered entity benefits patients
PHI cannot be used for marketing without written patient authorization (Correct answer)
Marketing using PHI requires only an opt-out opportunity

Correct answer: PHI cannot be used for marketing without written patient authorization

The HIPAA Privacy Rule requires covered entities to obtain prior written authorization before using PHI for most marketing communications.

Question 21: What is a 'limited data set' under HIPAA?

Data restricted to internal use only
PHI that has been fully anonymized
Any data set with fewer than 50 records
PHI with most direct identifiers removed, used for research, public health, or healthcare operations under a data use agreement (Correct answer)

Correct answer: PHI with most direct identifiers removed, used for research, public health, or healthcare operations under a data use agreement

A limited data set has direct identifiers like names and SSNs removed but may still include dates and geographic data at the zip code level or above, shared via data use agreement.

Question 22: What FCRA requirement must employers fulfill BEFORE taking adverse action based on a background check report?

Destroy all copies of the report
File a report with the FTC
Provide the applicant with a copy of the report and a pre-adverse action notice (Correct answer)
Notify the state labor department

Correct answer: Provide the applicant with a copy of the report and a pre-adverse action notice

FCRA requires employers to provide applicants with a copy of the consumer report and a pre-adverse action notice giving them opportunity to dispute inaccuracies before taking adverse action.

Question 23: Under the ADA, when may an employer require an employee to undergo a medical examination?

Only during annual performance reviews
At any time for any reason
Only when job-related and consistent with business necessity (Correct answer)
Only when the employee requests it

Correct answer: Only when job-related and consistent with business necessity

ADA restricts post-hire medical examinations to situations where they are job-related and consistent with business necessity, such as when an employee's ability to perform job functions is in question.

Question 24: Under the Privacy Act, what remedy is available to an individual whose records are wrongly disclosed by a federal agency?

A refund of any fees paid to the agency
Mandatory deletion of the record from all government systems
Civil lawsuit for actual damages, attorney's fees, and court costs; criminal penalties for willful disclosure (Correct answer)
Only a complaint to the agency's Inspector General

Correct answer: Civil lawsuit for actual damages, attorney's fees, and court costs; criminal penalties for willful disclosure

The Privacy Act allows individuals to bring civil lawsuits for actual damages when agencies wrongfully disclose records; criminal penalties apply to agency employees who willfully disclose protected records.

Question 25: Which of the following is excluded from the definition of 'nonpublic personal information' (NPI) under GLBA?

Publicly available information from government records (Correct answer)
Account balances
Transaction histories
Social Security numbers

Correct answer: Publicly available information from government records

GLBA explicitly excludes publicly available information from government records from the definition of NPI, since it is already accessible to the general public.

Question 26: What standard does the CAN-SPAM Act establish for commercial email senders?

Opt-in consent required before any commercial email
Prohibition on all unsolicited commercial email
Opt-out framework requiring unsubscribe mechanisms and accurate sender information (Correct answer)
Email marketing governed solely by state law

Correct answer: Opt-out framework requiring unsubscribe mechanisms and accurate sender information

CAN-SPAM establishes an opt-out framework, requiring accurate headers, functioning unsubscribe mechanisms, and physical address disclosure but not prior consent.

Question 27: Under HIPAA's Breach Notification Rule, which standard determines whether an incident is a 'breach' requiring notification?

Whether any employee viewed the data
Whether the breach was reported in the news
Whether the PHI was accessed in an unauthorized manner posing low probability of compromise (Correct answer)
Whether the organization's revenue exceeded $1 million

Correct answer: Whether the PHI was accessed in an unauthorized manner posing low probability of compromise

HIPAA uses a 'low probability of compromise' standard—if a risk assessment shows low probability that PHI was compromised, it is not a reportable breach.

Question 28: Under GLBA, which entities qualify as 'financial institutions' subject to its privacy provisions?

Only entities registered with the SEC
Only publicly traded financial companies
Only federally chartered banks and credit unions
Businesses significantly engaged in financial activities (Correct answer)

Correct answer: Businesses significantly engaged in financial activities

GLBA defines financial institutions broadly to include any business significantly engaged in financial activities, encompassing banks, mortgage lenders, insurers, investment advisors, and similar entities.

Question 29: What is 'pseudonymization' in the context of privacy-enhancing technologies?

Replacing direct identifiers with artificial identifiers so data cannot be attributed to an individual without additional information held separately (Correct answer)
Encrypting all data at rest and in transit
Using a pseudonym on public-facing communications
Deleting all personal identifiers from a data set permanently

Correct answer: Replacing direct identifiers with artificial identifiers so data cannot be attributed to an individual without additional information held separately

Pseudonymization replaces identifying information with artificial identifiers, reducing re-identification risk while preserving data utility for analytics or research.

Question 30: Which HIPAA right allows a patient to request that a covered entity not disclose their PHI to their health plan for services paid out-of-pocket?

Right to amend PHI
Right to request restrictions on disclosures to health plans (Correct answer)
Right to access and portability
Right to file a complaint

Correct answer: Right to request restrictions on disclosures to health plans

HIPAA requires covered entities to honor a patient's request to restrict disclosure to a health plan when the patient pays out-of-pocket in full for a service.

Certified Information Privacy Professional/United States (CIPP/US)

The CIPP/US certifies knowledge of U.S. privacy laws and regulations, covering federal and state privacy frameworks, private-sector data collection limits, government access to information, workplace privacy, and state-level privacy laws including CCPA/CPRA.

Questions

150 min

Time Limit

68%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

iapp.org — Score validity, test delivery · verified Oct 2026
assets.contentstack.io — Passing score, retake policy, score release, exam information · verified Oct 2026
store.iapp.org — Fees, exam format · verified Oct 2026