Certified Information Privacy Technologist (CIPT) — Questions and Answers

Question 1: What is the purpose of a data processing agreement (DPA) between a controller and a processor?

To allow the processor to sell data to third parties
To contractually bind the processor to process data only on documented instructions and implement adequate safeguards (Correct answer)
To transfer data ownership from controller to processor
To replace a privacy policy for end users

Correct answer: To contractually bind the processor to process data only on documented instructions and implement adequate safeguards

A DPA ensures the processor acts only on the controller's instructions, maintains confidentiality, and implements appropriate technical and organizational security measures.

Question 2: An organization must delete a customer's data upon request. Which governance process ensures all copies — including backups — are identified and removed?

Issuing a SQL DELETE command on the main database
Waiting for backup rotation to naturally overwrite data
Deleting only the primary production record
Data mapping combined with a defined erasure workflow (Correct answer)

Correct answer: Data mapping combined with a defined erasure workflow

Effective erasure requires a comprehensive data map to locate all copies — production, backup, archives, and third-party processors — followed by a documented deletion workflow.

Question 3: Which data anonymization weakness occurs when a dataset has only a few records per combination of quasi-identifiers, making individuals easy to re-identify?

Attribute inference
Membership inference
L-diversity failure
Data sparsity re-identification (Correct answer)

Correct answer: Data sparsity re-identification

Data sparsity re-identification happens when rare combinations of quasi-identifiers (e.g., ZIP code, birth date, sex) uniquely or nearly uniquely identify individuals.

Question 4: Under the EU-U.S. Data Privacy Framework, what must a U.S. organization do to legitimately receive personal data transferred from the EU?

Obtain explicit consent from every EU data subject
Execute standard contractual clauses with the EU exporter
Register with the European Data Protection Board
Self-certify with the U.S. Department of Commerce (Correct answer)

Correct answer: Self-certify with the U.S. Department of Commerce

Organizations must self-certify their adherence to the EU-U.S. Data Privacy Framework Principles with the U.S. Department of Commerce to lawfully receive personal data from EU entities.

Question 5: What does data protection in the US entail due to the absence of a comprehensive federal law?

State and federal laws regulating specific industries (Correct answer)
Strict federal regulations governing all sectors
International treaties for data handling
No data protection regulations in place

Correct answer: State and federal laws regulating specific industries

Unlike some other regions with overarching data protection laws (like GDPR in Europe), the United States has a sectoral approach to data privacy. This means there isn't one single federal law covering all personal data. Instead, data protection is governed by a patchwork of federal laws targeting specific industries (e.g., HIPAA for healthcare, GLBA for financial services) and numerous state laws that often provide broader or more specific protections.

Question 6: What does 'data sovereignty' mean in the context of data governance?

Data is subject to the laws of the country in which it is collected or stored (Correct answer)
Data must be stored on on-premises servers only
The organization owns all data it collects indefinitely
Users can export their data in any format they choose

Correct answer: Data is subject to the laws of the country in which it is collected or stored

Data sovereignty means that data is governed by the legal and regulatory framework of the jurisdiction where it resides, affecting cross-border transfer decisions.

Question 7: A data controller conducts profiling that produces legal or similarly significant effects on individuals. Under GDPR, what right do individuals have in this scenario?

The right to erasure of all profile data within 24 hours
The right to access the source code of the profiling algorithm
The right to data portability for all profiled data
The right not to be subject to solely automated decision-making (Correct answer)

Correct answer: The right not to be subject to solely automated decision-making

GDPR Article 22 gives individuals the right not to be subject to decisions based solely on automated processing, including profiling, that produce significant effects.

Question 8: Under the APEC Privacy Framework, which principle requires organizations to give individuals an opportunity to have inaccurate data corrected?

Integrity of Personal Information
Preventing Harm
Accountability
Access and Correction (Correct answer)

Correct answer: Access and Correction

The Access and Correction principle in the APEC Privacy Framework requires that individuals be able to access their data and correct inaccuracies.

Question 9: Which data protection law in Canada enforces regulations on specific sectors and includes breach reporting requirements?

Alberta: AB PIPA
Quebec: Quebec Private Sector Act
Federal: PIPEDA (Correct answer)
British Columbia: BC PIPA

Correct answer: Federal: PIPEDA

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal private sector privacy law. It governs how private sector organizations collect, use, and disclose personal information in the course of commercial activities across Canada, and includes mandatory breach reporting requirements for organizations subject to the act. While provinces have their own laws, PIPEDA is the federal standard.

Question 10: Under GDPR Article 33, within how many hours must a personal data breach be reported to the supervisory authority?

48 hours
24 hours
96 hours
72 hours (Correct answer)

Correct answer: 72 hours

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of the breach, where feasible.

Question 11: Which de-identification technique replaces direct identifiers with artificial keys while retaining a mapping table for re-identification?

Tokenization
Anonymization
Data masking
Pseudonymization (Correct answer)

Correct answer: Pseudonymization

Pseudonymization replaces identifiers with pseudonyms while keeping a mapping table, allowing re-identification by authorized parties.

Question 12: Which factor most commonly triggers the requirement to conduct a DPIA under GDPR?

Systematic and large-scale processing of sensitive personal data (Correct answer)
Storing employee email addresses
Processing data for payroll purposes
Publishing a public website privacy policy

Correct answer: Systematic and large-scale processing of sensitive personal data

GDPR Article 35 requires a DPIA when processing is likely to result in high risk, particularly for large-scale processing of special category data or systematic profiling.

Question 13: Which software development practice integrates privacy requirements into each sprint or iteration of an Agile project?

Post-launch privacy audits
Annual privacy policy updates
Waterfall privacy gate reviews
Privacy by Design in Agile (privacy user stories) (Correct answer)

Correct answer: Privacy by Design in Agile (privacy user stories)

Writing privacy user stories and including privacy acceptance criteria in each sprint embeds Privacy by Design into Agile workflows.

Question 14: Which GDPR article establishes the right to data portability?

Article 15
Article 17
Article 20 (Correct answer)
Article 22

Correct answer: Article 20

Article 20 of the GDPR grants data subjects the right to receive their personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Question 15: An organization implements automated data expiry rules that delete personal records when their retention period ends. What governance benefit does this provide?

Reduces the need for user consent mechanisms
Ensures HIPAA encryption requirements are met
Improves database query speed
Reduces risk of holding data beyond its legal or business justification (Correct answer)

Correct answer: Reduces risk of holding data beyond its legal or business justification

Automated retention enforcement ensures data is not held longer than necessary, reducing regulatory exposure and minimizing the dataset affected in a breach.

Question 16: A CIPT is reviewing a new mobile app. She recommends that the app request location permission only when a location-based feature is actively used. Which principle does this reflect?

Full functionality
Data portability
Context-aware data collection (purpose limitation) (Correct answer)
End-to-end encryption

Correct answer: Context-aware data collection (purpose limitation)

Context-aware data collection ensures personal data is gathered only when directly needed for a specific user action, limiting purpose and minimizing collection.

Question 17: In privacy risk management, what does 'risk tolerance' define?

The technical threshold for encryption key length
The number of data breaches an organization can absorb annually
The level of risk the organization is willing to accept without further treatment (Correct answer)
The maximum financial penalty a regulator can impose

Correct answer: The level of risk the organization is willing to accept without further treatment

Risk tolerance sets the boundary between acceptable and unacceptable risk, guiding decisions about whether residual risks require further mitigation or can be accepted.

Question 18: An organization applies different handling rules to 'confidential,' 'internal,' and 'public' data categories. What process created these distinctions?

Data normalization
Data masking
Data classification (Correct answer)
Data lineage tracking

Correct answer: Data classification

Data classification assigns sensitivity levels to data categories, enabling proportionate controls to be applied based on the level of privacy risk.

Question 19: From a privacy perspective, why is collecting biometric data for authentication considered higher risk than password-based authentication?

Biometric data is immutable — if compromised, the individual cannot change their fingerprint or iris scan (Correct answer)
Biometric systems are always less accurate than passwords
Biometrics are slower to verify than passwords
Biometric data is not covered by privacy laws

Correct answer: Biometric data is immutable — if compromised, the individual cannot change their fingerprint or iris scan

Unlike passwords, biometrics cannot be reset after a breach; the permanent nature of biometric identifiers makes their compromise a lifelong privacy harm.

Question 20: A privacy engineer is asked to implement a technique that replaces real user identifiers with pseudonyms in a dataset. What technique is being used?

Pseudonymization (Correct answer)
Anonymization
Data masking for testing
Tokenization of payment data

Correct answer: Pseudonymization

Pseudonymization replaces direct identifiers with artificial identifiers (pseudonyms) so that data can no longer be attributed to a specific individual without additional information.

Question 21: What is a data inventory (or data map) primarily used for in a privacy governance program?

Managing software licenses
Documenting where personal data is collected, stored, processed, and shared (Correct answer)
Tracking server uptime and performance metrics
Auditing user login activity

Correct answer: Documenting where personal data is collected, stored, processed, and shared

A data inventory catalogs all personal data assets, their locations, purposes, legal bases, and flows, forming the foundation for privacy compliance programs.

Question 22: Which Privacy by Design principle ensures that privacy coexists with other legitimate system goals without trade-offs?

Visibility and Transparency
Full Functionality — Positive-Sum, not Zero-Sum (Correct answer)
User-Centric Design
End-to-End Security

Correct answer: Full Functionality — Positive-Sum, not Zero-Sum

Full Functionality rejects the notion that privacy must be sacrificed for functionality, seeking a win-win outcome instead.

Question 23: What privacy risk does 'orphaned accounts' (accounts of former employees that were not deprovisioned) create?

Degraded single sign-on performance
Increased password reset ticket volume
Higher cloud storage costs
Unauthorized access to personal data by individuals who no longer have a legitimate need (Correct answer)

Correct answer: Unauthorized access to personal data by individuals who no longer have a legitimate need

Orphaned accounts can be used by former employees or attackers to access personal data without authorization, directly violating data access controls.

Question 24: What is the main goal of applying 'data separation' or 'compartmentalization' as a privacy engineering technique?

Encrypting data at rest
Speeding up database queries
Limiting the combination of data that could re-identify individuals (Correct answer)
Reducing cloud storage costs

Correct answer: Limiting the combination of data that could re-identify individuals

Data separation prevents linking datasets that together could re-identify individuals, limiting the risk of aggregation attacks.

Question 25: Which authentication method provides the strongest privacy protection by ensuring that even if a password is stolen, unauthorized access is prevented?

Long password requirements alone
IP address allowlisting alone
Security questions only
Multi-factor authentication (MFA) (Correct answer)

Correct answer: Multi-factor authentication (MFA)

MFA requires a second factor (e.g., TOTP code, hardware token) in addition to the password, significantly reducing the risk of unauthorized access from credential theft.

Question 26: What does 'End-to-End Security — Full Lifecycle Protection' require in Privacy by Design?

Encrypting only data in transit
Securing only the database layer
Applying security controls only during user authentication
Secure retention and deletion of data throughout its entire lifecycle (Correct answer)

Correct answer: Secure retention and deletion of data throughout its entire lifecycle

End-to-End Security means strong security measures protect data from collection through secure destruction at the end of its lifecycle.

Question 27: Which data governance document formally describes what personal data an organization collects, how it is used, and with whom it is shared?

Data retention schedule
Cookie consent banner
Records of processing activities (RoPA) (Correct answer)
Incident response plan

Correct answer: Records of processing activities (RoPA)

A Records of Processing Activities (RoPA) documents all personal data processing operations and is required under GDPR Article 30.

Question 28: Which concept describes the practice of collecting consent that is freely given, specific, informed, and unambiguous under GDPR?

Blanket consent
Valid consent (Correct answer)
Opt-out consent
Implied consent

Correct answer: Valid consent

GDPR Article 7 defines valid consent as freely given, specific, informed, and indicated by a clear affirmative action.

Question 29: What is a 'privacy program maturity model' used for?

Grading individual employee privacy knowledge
Measuring how advanced and effective an organization's privacy practices are across defined capability levels (Correct answer)
Calculating GDPR fines based on violation severity
Ranking countries by the strength of their privacy laws

Correct answer: Measuring how advanced and effective an organization's privacy practices are across defined capability levels

A maturity model (e.g., AICPA Privacy Maturity Model, NIST Privacy Framework) benchmarks the current state of a privacy program and provides a roadmap for improvement.

Question 30: What is the central objective of the Privacy by Design (PbD) framework?

To eliminate all data collection practices
To embed privacy into development from the outset (Correct answer)
To comply with security regulations
To prevent data breaches entirely

Correct answer: To embed privacy into development from the outset

The core objective of Privacy by Design is to proactively integrate privacy protections into the design and operation of information systems and business practices. Instead of addressing privacy as a reactive measure after a system is built, PbD ensures that privacy is a foundational element from the very beginning. This proactive approach aims to prevent privacy risks before they arise, making privacy an inherent part of the system's architecture.

Question 31: Which international standard provides guidance on privacy information management systems (PIMS) and is complementary to ISO/IEC 27001?

ISO/IEC 29134
ISO/IEC 29100
ISO/IEC 27701 (Correct answer)
ISO/IEC 27018

Correct answer: ISO/IEC 27701

ISO/IEC 27701 extends ISO 27001 by specifying requirements and guidance for establishing and continually improving a Privacy Information Management System (PIMS).

Question 32: Which access control model grants permissions based on a user's role within the organization rather than their individual identity?

Mandatory access control (MAC)
Attribute-based access control (ABAC)
Role-based access control (RBAC) (Correct answer)
Discretionary access control (DAC)

Correct answer: Role-based access control (RBAC)

RBAC assigns permissions to roles (e.g., HR analyst, system admin), and users inherit those permissions by being assigned to a role, simplifying least-privilege enforcement.

Question 33: During the data disposal phase, which method best ensures that magnetic hard drive data is unrecoverable?

Standard file deletion
Degaussing followed by physical destruction (Correct answer)
Formatting the drive once
Overwriting with zeros one time

Correct answer: Degaussing followed by physical destruction

Degaussing disrupts magnetic domains to erase data, and physical destruction ensures media cannot be reconstructed, together providing the highest assurance of unrecoverability.

Question 34: Which model explicitly uses 'contextual integrity' to evaluate whether information flows are appropriate?

The EU adequacy decision model
The NIST Cybersecurity Framework
The OECD Privacy Guidelines model
Helen Nissenbaum's privacy-as-contextual-integrity model (Correct answer)

Correct answer: Helen Nissenbaum's privacy-as-contextual-integrity model

Helen Nissenbaum's contextual integrity model holds that privacy is violated when information flows do not match the norms of the context in which data was shared.

Question 35: What does the principle of "Privacy as the Default Setting" suggest?

Making privacy settings optional for users
Disclosing personal information without consent
Limiting data collection and retention to the minimum necessary (Correct answer)
Collecting as much data as possible for analysis

Correct answer: Limiting data collection and retention to the minimum necessary

The "Privacy as the Default Setting" principle mandates that personal data should be automatically protected in any given system or business practice, without requiring individuals to take action. This means that data collection should be minimized to only what is essential for the specific purpose, and retained only for as long as necessary. It ensures that privacy is the default state for users, rather than an option they must actively select.

Question 36: What is a significant impact of data privacy regulations on businesses?

Increased business disruption (Correct answer)
Decreased compliance costs
Enhanced brand value
Simplified data management

Correct answer: Increased business disruption

Data privacy regulations often necessitate significant changes to business processes, IT systems, and data handling practices. Implementing new compliance measures, conducting data mapping, revising consent mechanisms, and responding to data subject requests can be complex and resource-intensive, leading to operational disruptions and increased costs as businesses adapt to new legal requirements.

Question 37: Which type of architecture ensures that no single server or administrator can access a user's complete personal data, distributing trust across multiple parties?

Monolithic database design
Single sign-on federation
Distributed or decentralized privacy architecture (Correct answer)
Centralized identity management

Correct answer: Distributed or decentralized privacy architecture

Distributed privacy architectures split data across multiple parties so no single point of failure or insider can access all personal data.

Question 38: Which engineering technique adds statistical noise to datasets to protect individual privacy while preserving overall data utility?

Access control lists
Differential privacy (Correct answer)
Homomorphic encryption
Data tokenization

Correct answer: Differential privacy

Differential privacy injects calibrated noise into query results so that individual records cannot be inferred from aggregate outputs.

Question 39: Which Privacy by Design principle emphasizes keeping systems open and verifiable so users can trust that stated privacy practices are actually being followed?

Proactive not Reactive
Privacy as the Default Setting
Visibility and Transparency (Correct answer)
User-Centric Design

Correct answer: Visibility and Transparency

Visibility and Transparency ensures that business practices and technologies are open to independent verification, building user trust.

Question 40: Which risk treatment option involves stopping a high-risk data processing activity because residual risk cannot be reduced to an acceptable level?

Risk transfer
Risk avoidance (Correct answer)
Risk acceptance
Risk mitigation

Correct answer: Risk avoidance

Risk avoidance means ceasing or not starting the processing activity entirely when the risk cannot be adequately controlled.

Question 41: Which risk management output formally documents an organization's decision to accept a specific privacy risk and who authorized that decision?

Risk acceptance record (or risk acceptance sign-off) (Correct answer)
Incident response plan
Vendor due diligence report
Privacy policy update

Correct answer: Risk acceptance record (or risk acceptance sign-off)

A risk acceptance record documents that the risk was reviewed, the residual risk level was understood, and a named accountable person formally approved accepting it.

Question 42: Which data governance artifact defines who can access specific datasets, under what conditions, and for what approved purposes?

System security plan
Privacy notice
Data access policy (Correct answer)
Data processing agreement

Correct answer: Data access policy

A data access policy specifies authorization rules, access conditions, and approved purposes for each data category, supporting both governance and privacy compliance.

Question 43: Which approach involves transferring privacy risk to a third party, such as through cyber liability insurance or vendor contractual indemnification?

Risk mitigation
Risk avoidance
Risk transfer (Correct answer)
Risk acceptance

Correct answer: Risk transfer

Risk transfer shifts financial or operational consequence of a privacy risk to another party but does not eliminate the underlying risk to data subjects.

Question 44: Under the US HIPAA Breach Notification Rule, how quickly must covered entities notify affected individuals of an unsecured PHI breach?

Within 24 hours of discovery
Only after completing a full forensic investigation, with no time limit
Within 14 days of discovery
Without unreasonable delay and no later than 60 days after discovery (Correct answer)

Correct answer: Without unreasonable delay and no later than 60 days after discovery

HIPAA's Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and within 60 days of discovering a breach of unsecured PHI.

Question 45: Which privacy risk factor specifically relates to the harm an individual may suffer if their personal data is exposed or misused?

Organizational reputational risk
Threat likelihood
Impact to data subjects (Correct answer)
Vulnerability severity

Correct answer: Impact to data subjects

Privacy risk assessment must center on the potential harm to individuals — including financial loss, discrimination, or reputational damage — not just organizational risk.

Question 46: Which element of the Privacy by Design framework highlights the significance of ensuring that decisions revolve around fulfilling the user's needs?

Privacy as the Default Setting
Respect for User Privacy – Keep it User-Centric (Correct answer)
End-to-End Protection – Lifecycle Security
Full Functionality – Positive-sum, not Zero-sum

Correct answer: Respect for User Privacy – Keep it User-Centric

The "Respect for User Privacy – Keep it User-Centric" principle underscores the importance of prioritizing the individual's interests and needs throughout the data lifecycle. It advocates for empowering users with control over their personal data and ensuring that their privacy preferences are respected. This principle emphasizes a user-focused approach, ensuring that privacy decisions are made with the individual in mind.

Question 47: A privacy impact assessment (PIA) is most valuable when conducted at which stage of a project?

After product launch
Early in the design phase (Correct answer)
During routine maintenance
When a breach occurs

Correct answer: Early in the design phase

Conducting a PIA early in design allows privacy risks to be mitigated before costly system changes are required.

Question 48: What does a 'privacy program gap analysis' involve?

Analyzing gaps in network firewall rules
Measuring the difference between budgeted and actual privacy costs
Comparing the current state of privacy practices against a target framework to identify deficiencies (Correct answer)
Reviewing employee performance reviews for privacy policy violations

Correct answer: Comparing the current state of privacy practices against a target framework to identify deficiencies

A gap analysis maps existing privacy controls against a regulatory framework or best-practice standard to identify where the program falls short and prioritize remediation.

Question 49: Which role is typically responsible for defining data classification levels and associated handling requirements in a data governance program?

Data custodian
Data processor
Data subject
Data owner (Correct answer)

Correct answer: Data owner

The data owner (usually a business unit leader) is accountable for data classification decisions and the rules governing how data at each level must be handled.

Question 50: Which NIST Privacy Framework core function focuses on developing and implementing organizational activities to identify privacy risk?

Protect-P
Govern-P
Control-P
Identify-P (Correct answer)

Correct answer: Identify-P

The Identify-P function in the NIST Privacy Framework helps organizations develop an organizational understanding of privacy risk to individuals.

Question 51: Which privacy model treats privacy as a resource that individuals can selectively grant or withdraw, analogous to property rights?

Privacy as a public good
Privacy as confidentiality
Privacy as control (property-rights model) (Correct answer)
Privacy as contextual integrity

Correct answer: Privacy as control (property-rights model)

The privacy-as-control or property-rights model views personal data as belonging to individuals who may grant licenses for its use.

Question 52: What is the primary purpose of data protection?

Generating large amounts of data
Safeguarding data from compromise (Correct answer)
Distributing data to unauthorized users
Analyzing data for insights

Correct answer: Safeguarding data from compromise

The fundamental goal of data protection is to ensure the confidentiality, integrity, and availability of data. This involves implementing measures to prevent unauthorized access, use, disclosure, disruption, modification, or destruction of information. Ultimately, its primary purpose is to safeguard data from any form of compromise, ensuring its security and privacy.

Question 53: Which concept describes tracking the origin, movement, and transformations of data across its entire lifecycle within an organization?

Data lineage (Correct answer)
Change data capture
Data provenance auditing
Database versioning

Correct answer: Data lineage

Data lineage documents where data comes from, how it moves through systems, and how it is transformed, enabling accountability and privacy compliance verification.

Question 54: Which process ensures that third-party vendors who access personal data meet the organization's privacy and security standards before contracting?

Vendor privacy due diligence (third-party risk assessment) (Correct answer)
Penetration testing
Data loss prevention (DLP) scanning
Security information and event management (SIEM)

Correct answer: Vendor privacy due diligence (third-party risk assessment)

Third-party privacy due diligence evaluates vendors' privacy practices, security controls, and compliance posture before sharing personal data with them.

Question 55: Data protection regulations vary from country to country, but what is the underlying concept common to all?

Making data available to everyone
Keeping data safe while allowing authorized access (Correct answer)
Encrypting all data for security
Sharing data without authorization

Correct answer: Keeping data safe while allowing authorized access

Despite geographical and legal differences, a universal principle underpins all data protection regulations: balancing security with utility. The core idea is to keep personal and sensitive data secure from unauthorized access or misuse, while simultaneously ensuring that legitimate users and processes can access and utilize the data when and where it is authorized. This balance is crucial for both privacy and business operations.

Question 56: Which US state law, effective January 2020, grants California consumers the right to know what personal information is collected about them and to request its deletion?

California Privacy Rights Act (CPRA)
California Data Breach Notification Law (SB-1386)
California Online Privacy Protection Act (CalOPPA)
California Consumer Privacy Act (CCPA) (Correct answer)

Correct answer: California Consumer Privacy Act (CCPA)

The CCPA, effective January 1, 2020, established rights for California consumers including access, deletion, and opt-out of sale of personal information.

Question 57: Which principle emphasizes the importance of accurate and up-to-date data?

Accuracy (Correct answer)
Lawfulness
Data Minimization
Storage Limitation

Correct answer: Accuracy

The principle of Accuracy in data protection mandates that personal data collected and processed must be accurate, complete, and kept up-to-date. This is crucial to prevent decisions being made about individuals based on incorrect information and to ensure the reliability and integrity of the data throughout its lifecycle.

Question 58: A privacy team implements a process to handle user requests to access, correct, or delete their personal data. What is this process called?

Vendor onboarding checklist
Privacy impact assessment workflow
Data Subject Rights (DSR) or Data Subject Access Request (DSAR) fulfillment process (Correct answer)
Breach notification procedure

Correct answer: Data Subject Rights (DSR) or Data Subject Access Request (DSAR) fulfillment process

A DSAR fulfillment process includes identity verification, data location, compilation, review, and timely response to requests from data subjects exercising their legal rights.

Question 59: Which data protection regulation applies specifically to websites targeted at children under 13 years of age?

COPPA (Correct answer)
GLBA
FCRA
HIPAA

Correct answer: COPPA

The Children's Online Privacy Protection Act (COPPA) is a US federal law that imposes specific requirements on operators of websites and online services directed to children under 13 years of age, or general audience sites that knowingly collect personal information from children under 13. It mandates parental consent for data collection and outlines how children's online privacy must be protected.

Question 60: A privacy risk assessment rates risks using 'likelihood' and 'impact'. What does the combination of these two factors produce?

A data flow diagram
A compliance checklist
A risk score or risk level (Correct answer)
A breach notification timeline

Correct answer: A risk score or risk level

Risk level = likelihood × impact; this score prioritizes which risks require immediate mitigation versus those that can be monitored.

Question 61: Which of Ann Cavoukian's seven foundational principles of Privacy by Design states that privacy should be the default setting?

End-to-End Security
Full Functionality
Proactive not Reactive
Privacy as the Default Setting (Correct answer)

Correct answer: Privacy as the Default Setting

Privacy as the Default Setting means users automatically receive maximum privacy without any required action on their part.

Question 62: Which document serves as the foundational governance instrument that describes an organization's privacy program scope, objectives, and senior management commitment?

Privacy policy (internal) (Correct answer)
Data processing agreement
Privacy notice (external)
Incident response plan

Correct answer: Privacy policy (internal)

An internal privacy policy establishes the organization's privacy program framework, assigns responsibilities, and documents management's commitment to privacy as an organizational value.

Question 63: In a privacy risk assessment, what is a 'threat' in relation to personal data?

A negative user review about data practices
Any potential cause of an unwanted event that could result in privacy harm to individuals (Correct answer)
A known vulnerability in software code
A regulatory fine imposed by a supervisory authority

Correct answer: Any potential cause of an unwanted event that could result in privacy harm to individuals

A threat is a potential event or action — such as unauthorized access or insider misuse — that could exploit a vulnerability and cause privacy harm.

Question 64: What is the difference between 'authentication' and 'authorization' in the context of personal data access?

Authorization verifies identity using biometrics; authentication uses passwords
Authentication verifies who you are; authorization determines what you are permitted to access (Correct answer)
Authentication grants access; authorization verifies identity
They are interchangeable terms for the same process

Correct answer: Authentication verifies who you are; authorization determines what you are permitted to access

Authentication confirms identity (who are you?), while authorization enforces access control (what are you allowed to do?); both are required to protect personal data.

Question 65: What is the primary purpose of a privacy incident response plan?

To provide a structured approach for detecting, containing, and recovering from privacy incidents (Correct answer)
To eliminate the need for cyber liability insurance
To avoid regulatory fines by demonstrating documented compliance
To transfer breach liability to third-party data processors

Correct answer: To provide a structured approach for detecting, containing, and recovering from privacy incidents

An incident response plan provides a systematic, pre-defined process to manage breaches efficiently and minimize harm to individuals.

Question 66: In the CIPT body of knowledge, which privacy-enhancing technology (PET) allows a verifier to confirm a fact about a user without learning the underlying data?

Role-based access control
Symmetric encryption
Zero-knowledge proof (Correct answer)
Transport Layer Security

Correct answer: Zero-knowledge proof

A zero-knowledge proof enables one party to prove knowledge of a value to another party without conveying any information beyond the validity of the statement.

Question 67: When building a consent management platform, which engineering requirement is most critical from a Privacy by Design perspective?

Storing consent in the same table as behavioral analytics
Granular, revocable consent with clear audit logs (Correct answer)
Requiring consent only for sensitive data categories
Defaulting all marketing preferences to opted-in

Correct answer: Granular, revocable consent with clear audit logs

A consent management platform must record granular per-purpose consent, allow withdrawal at any time, and maintain tamper-evident audit logs.

Question 68: Which US federal law specifically governs the privacy of student educational records and restricts their disclosure without consent?

COPPA
HIPAA
GLBA
FERPA (Correct answer)

Correct answer: FERPA

FERPA (Family Educational Rights and Privacy Act) protects the privacy of student education records and gives parents rights over those records.

Question 69: A company's privacy notice is written at a 16th-grade reading level. Which privacy principle does this most directly violate?

Data minimization
Transparency (right to clear, intelligible information) (Correct answer)
Purpose limitation
Storage limitation

Correct answer: Transparency (right to clear, intelligible information)

Privacy notices must be concise, transparent, and written in plain language so that data subjects can genuinely understand how their data is used.

Question 70: Differential privacy protects individual privacy by adding what to query results?

Pseudonymous identifiers
Encryption keys
Calibrated statistical noise (Correct answer)
Access control lists

Correct answer: Calibrated statistical noise

Differential privacy injects carefully calibrated noise into outputs so that no single individual's data can be inferred from results.

Question 71: In the context of Privacy by Design, what is a 'privacy impact assessment' (PIA) primarily used for during system development?

Identifying and mitigating privacy risks before system deployment (Correct answer)
Auditing user consent records quarterly
Measuring website analytics performance
Documenting data breaches after they occur

Correct answer: Identifying and mitigating privacy risks before system deployment

A PIA evaluates how a proposed system or process will affect individual privacy and enables teams to address risks before launch.

Question 72: A company wants to allow third-party analysis of its customer database without revealing individual records. Which technique best enables this?

Homomorphic encryption (Correct answer)
Multi-factor authentication
Role-based access control
Transport Layer Security

Correct answer: Homomorphic encryption

Homomorphic encryption allows computations to be performed on encrypted data without decrypting it, preserving privacy during analysis.

Question 73: A financial institution shares customer data with a third-party service provider for marketing purposes. Under the Gramm-Leach-Bliley Act (GLBA), what must customers receive before this sharing occurs?

A signed data processing agreement
A privacy notice with opt-out opportunity (Correct answer)
An opt-in consent form
A breach notification letter

Correct answer: A privacy notice with opt-out opportunity

GLBA requires financial institutions to provide customers with a clear privacy notice explaining their information-sharing practices and give customers an opportunity to opt out of sharing with non-affiliated third parties.

Question 74: In privacy risk analysis, 'likelihood' refers to the probability that a threat will exploit a vulnerability, while 'impact' refers to what?

The number of records involved in a breach
The harm to individuals if the privacy event occurs (Correct answer)
The time required to detect the privacy incident
The cost of implementing a privacy control

Correct answer: The harm to individuals if the privacy event occurs

Impact in privacy risk analysis measures the degree of harm — such as financial loss, reputational damage, or discrimination — that individuals would experience if the risk materializes.

Question 75: Which factor is most critical when determining whether a breach requires notification to affected individuals?

The size of the organization experiencing the breach
The cost of sending individual breach notifications
The likelihood and severity of harm to affected individuals (Correct answer)
Whether the media has already reported the incident

Correct answer: The likelihood and severity of harm to affected individuals

Most breach notification laws hinge on whether there is a reasonable risk of harm to individuals, making harm assessment the primary trigger.

Question 76: Which element must be included in a DPIA report according to GDPR Article 35?

Only the names of the data subjects affected
The organization's annual privacy budget
A list of all system vulnerabilities discovered during testing
A description of the processing, necessity assessment, risk evaluation, and planned mitigation measures (Correct answer)

Correct answer: A description of the processing, necessity assessment, risk evaluation, and planned mitigation measures

GDPR Article 35 specifies that a DPIA must include: a description of the processing, assessment of necessity and proportionality, risk assessment, and the measures to address risks.

Question 77: Which governance mechanism ensures that personal data collected for one purpose is not used for an incompatible second purpose?

Encryption at rest
Role-based access control
Data retention policies
Purpose limitation controls (Correct answer)

Correct answer: Purpose limitation controls

Purpose limitation controls — including technical restrictions and policy enforcement — prevent data from being repurposed beyond its original, consented-to use.

Question 78: Which privacy threat category involves an attacker combining publicly available data from multiple sources to re-identify an anonymized individual?

Aggregation attack (Correct answer)
SQL injection
Phishing attack
Man-in-the-middle attack

Correct answer: Aggregation attack

An aggregation attack combines individually harmless data elements from multiple sources to reconstruct a person's identity or sensitive information.

Question 79: What is the primary risk of 'data sprawl' from a privacy governance perspective?

Uncontrolled copies of personal data spread across systems, increasing breach surface and erasure complexity (Correct answer)
Difficulty in software version control
Increased storage costs
Slower database query performance

Correct answer: Uncontrolled copies of personal data spread across systems, increasing breach surface and erasure complexity

Data sprawl creates untracked copies of personal data that may not be covered by security controls or erasure workflows, elevating privacy risk.

Question 80: The 'Accountability' principle in the OECD Privacy Guidelines assigns responsibility for compliance to which party?

The data controller (Correct answer)
The data subject
The data processor
The supervisory authority

Correct answer: The data controller

Under the OECD Accountability principle, the data controller is responsible for ensuring the other principles are complied with.

Question 81: What is the key focus of the "Visibility and Transparency" principle?

Concealing privacy practices from stakeholders
Limiting user control over data
Demonstrating accountability and making policies accessible (Correct answer)
Maximizing data collection

Correct answer: Demonstrating accountability and making policies accessible

The "Visibility and Transparency" principle requires that organizations be open about their privacy practices and policies. It means that individuals should be informed about how their data is being collected, used, and shared, and that these practices should be verifiable. This fosters trust and allows for independent verification of privacy commitments, ensuring accountability.

Question 82: What is the primary purpose of a 'privacy by default' operational setting in a product or service?

Apply maximum data collection as the baseline
Disable all non-essential features on launch
Make all data publicly accessible unless users opt out
Ensure the most privacy-protective settings are active without any user action required (Correct answer)

Correct answer: Ensure the most privacy-protective settings are active without any user action required

Privacy by default means that, out of the box, the most privacy-restrictive settings are applied, so users who take no action still receive strong privacy protection.

Question 83: A healthcare organization conducts quarterly 'access reviews' where managers certify which employees need continued access to patient records. What privacy risk does this address?

Excessive data collection at point of entry
Privilege creep — accumulation of unnecessary access rights over time (Correct answer)
Data breach notification delays
Insecure data transmission protocols

Correct answer: Privilege creep — accumulation of unnecessary access rights over time

Access reviews identify and remediate privilege creep, ensuring that only individuals with a current, legitimate need retain access to sensitive personal data.

Question 84: A company automatically deletes personal data after a defined retention period using an automated policy engine. Which privacy principle does this technical control enforce?

Integrity and confidentiality
Purpose limitation
Storage limitation (Correct answer)
Lawfulness of processing

Correct answer: Storage limitation

Automated deletion enforces storage limitation by ensuring personal data is not kept longer than necessary for its stated purpose.

Question 85: What is the primary purpose of data minimization as a privacy engineering control?

Collect only the data necessary for the specified purpose (Correct answer)
Minimize the number of database tables
Delete all data older than 90 days
Reduce storage costs by compressing files

Correct answer: Collect only the data necessary for the specified purpose

Data minimization limits the collection of personal data to what is strictly necessary for a defined purpose, reducing privacy risk.

Question 86: Which US law focuses on safeguarding health-related personal information?

FCRA
HIPAA (Correct answer)
FERPA
GLBA

Correct answer: HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a landmark US federal law specifically designed to protect sensitive patient health information. It establishes national standards for the security, privacy, and integrity of protected health information (PHI) by covered entities and their business associates, ensuring the confidentiality of medical records.

Question 87: Which of the following best defines a 'personal data breach' under GDPR Article 4(12)?

Any unauthorized access to a computer system
The loss of any device containing encrypted data
A security incident resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data (Correct answer)
Any violation of an organization's internal data security policy

Correct answer: A security incident resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data

GDPR Article 4(12) defines a personal data breach as a security incident affecting the confidentiality, integrity, or availability of personal data.

Question 88: A privacy engineer proposes using 'k-anonymity' when publishing a dataset. What does this guarantee?

Each record is indistinguishable from at least k-1 other records on quasi-identifiers (Correct answer)
k users must consent before any data is published
Each field is masked with k random characters
Data is encrypted with k encryption keys

Correct answer: Each record is indistinguishable from at least k-1 other records on quasi-identifiers

k-anonymity ensures that any individual in a dataset cannot be uniquely identified because their quasi-identifier combination matches at least k-1 other individuals.

Question 89: What is a 'privacy champion' network within an organization?

A regulatory body that champions consumer privacy rights
Software agents that enforce data access policies automatically
External privacy consultants hired for annual reviews
Designated employees embedded in business units who advocate for privacy practices and serve as liaisons to the central privacy team (Correct answer)

Correct answer: Designated employees embedded in business units who advocate for privacy practices and serve as liaisons to the central privacy team

Privacy champions extend the reach of the central privacy team by embedding privacy knowledge and accountability into individual departments across the organization.

Question 90: An organization implements 'just-in-time' (JIT) privileged access, granting elevated permissions only for the duration of a specific task. What privacy benefit does this provide?

Minimizes the window of exposure for sensitive data by eliminating persistent privileged access (Correct answer)
Allows users to bypass MFA for privileged tasks
Reduces the cost of identity management systems
Eliminates the need for audit logs

Correct answer: Minimizes the window of exposure for sensitive data by eliminating persistent privileged access

JIT access ensures that elevated permissions exist only as long as the task requires, dramatically reducing the risk of insider misuse or credential theft of persistent admin accounts.

Certified Information Privacy Technologist (CIPT)

The CIPT certification, offered by IAPP, validates expertise in embedding privacy into technology systems and products. It covers privacy engineering, data lifecycle management, privacy risk management, privacy-enhancing technologies, and privacy by design principles.

Questions

150 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

assets.contentstack.io — Passing score, registration deadline, retake policy, score release, test dates, exam information · verified Nov 2026
iapp.org — Renewal, score validity, test delivery · verified Oct 2026
store.iapp.org — Fees, exam format · verified Oct 2026