CIPT Cheat Sheet 2026

The 30 highest-yield CIPT facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which individual developed the Seven Principles of Privacy by Design? → Ann Cavoukian
2. Which attack re-identifies anonymized data by combining it with publicly available auxiliary datasets? → Linkage attack
3. When building a consent management platform, which engineering requirement is most critical from a Privacy by Design perspective? → Granular, revocable consent with clear audit logs
4. Which phase of the data lifecycle involves determining what data to collect, for what purpose, and under what legal basis? → Data collection and creation
5. Which data anonymization weakness occurs when a dataset has only a few records per combination of quasi-identifiers, making individuals easy to re-identify? → Data sparsity re-identification
6. An organization must delete a customer's data upon request. Which governance process ensures all copies — including backups — are identified and removed? → Data mapping combined with a defined erasure workflow
7. A company's privacy notice is written at a 16th-grade reading level. Which privacy principle does this most directly violate? → Transparency (right to clear, intelligible information)
8. Which risk treatment option involves stopping a high-risk data processing activity because residual risk cannot be reduced to an acceptable level? → Risk avoidance
9. Under Virginia's Consumer Data Protection Act (VCDPA), which data processing activity requires a data protection assessment? → Processing sensitive data or data for targeted advertising
10. Data protection regulations vary from country to country, but what is the underlying concept common to all? → Keeping data safe while allowing authorized access
11. A company maintains records of all its data processing activities including purposes, categories of data, and retention periods. What is this record called? → Record of Processing Activities (RoPA)
12. Which element of the Privacy by Design framework highlights the significance of ensuring that decisions revolve around fulfilling the user's needs? → Respect for User Privacy – Keep it User-Centric
13. In Privacy by Design, what does the principle 'Proactive not Reactive' mean? → Anticipate and prevent privacy-invasive events before they occur
14. Which control requires that a minimum number of authorized personnel must cooperate to perform a sensitive operation, preventing unilateral action? → Multi-party authorization (M-of-N control)
15. What is the central objective of the Privacy by Design (PbD) framework? → To embed privacy into development from the outset
16. In the context of the ISO 29101 privacy architecture framework, what does the 'PII principal' refer to? → The individual to whom the PII relates
17. A privacy engineer proposes using 'k-anonymity' when publishing a dataset. What does this guarantee? → Each record is indistinguishable from at least k-1 other records on quasi-identifiers
18. Which data protection law in Canada enforces regulations on specific sectors and includes breach reporting requirements? → Federal: PIPEDA
19. An organization implements automated data expiry rules that delete personal records when their retention period ends. What governance benefit does this provide? → Reduces risk of holding data beyond its legal or business justification
20. An organization's privacy notice discloses that it shares data with 'partners for marketing purposes.' Under GDPR transparency requirements, what is missing? → The specific identities or categories of third-party recipients
21. A privacy team implements a process to handle user requests to access, correct, or delete their personal data. What is this process called? → Data Subject Rights (DSR) or Data Subject Access Request (DSAR) fulfillment process
22. Under GDPR Article 33, within how many hours must a personal data breach be reported to the supervisory authority? → 72 hours
23. Which term describes the risk that a machine learning model trained on sensitive data can inadvertently memorize and reveal specific training examples? → Data leakage through overfitting
24. Which engineering technique adds statistical noise to datasets to protect individual privacy while preserving overall data utility? → Differential privacy
25. Which threat model considers the scenario where a cloud provider's employees could access customer data stored on their platform? → Insider threat model
26. Which data governance document formally describes what personal data an organization collects, how it is used, and with whom it is shared? → Records of processing activities (RoPA)
27. Which authentication method provides the strongest privacy protection by ensuring that even if a password is stolen, unauthorized access is prevented? → Multi-factor authentication (MFA)
28. Which international standard provides guidance on privacy information management systems (PIMS) and is complementary to ISO/IEC 27001? → ISO/IEC 27701
29. A company collects only the data fields strictly required to fulfill a transaction. Which Privacy by Design principle does this practice reflect? → Data minimization
30. What is the primary objective of a Data Protection Impact Assessment (DPIA)? → Identify and mitigate privacy risks of high-risk processing activities before they begin