IAPP CIPP/E — Certified Information Privacy Professional/Europe (GDPR) — Questions and Answers

Question 1: A GDPR-compliant system design requires 'data minimization' at the collection layer. Which architectural control BEST enforces this at the API level?

Accepting all fields and filtering excess data in the database layer
Using strict input schemas that reject any fields not required for the stated purpose (Correct answer)
Compressing incoming payloads to reduce storage consumption
Logging all received fields and discarding unused ones post-processing

Correct answer: Using strict input schemas that reject any fields not required for the stated purpose

Strict input schema validation at the API layer prevents collection of unnecessary personal data before it enters the system.

Question 2: Under GDPR, which lawful basis is often described as the 'gold standard' but is frequently misapplied by organizations?

Legitimate interests
Consent (Correct answer)
Public task
Legal obligation

Correct answer: Consent

Consent is described as the gold standard for data protection but is frequently overused; many situations are better served by another lawful basis such as contract or legitimate interests.

Question 3: When implementing data integration across multiple countries within the EU, which concept allows a multinational company to deal with a single supervisory authority for cross-border processing?

Mutual recognition agreements
The one-stop-shop mechanism under Article 56 (Correct answer)
Data localisation
The European Data Protection Board (EDPB) central filing

Correct answer: The one-stop-shop mechanism under Article 56

Article 56 establishes the one-stop-shop mechanism, letting controllers with cross-border operations engage primarily with the supervisory authority of their EU main establishment.

Question 4: Why is documenting troubleshooting steps important?

It is only needed for warranty claims
It slows down the resolution process
It creates a knowledge base for future similar issues and tracks what was tried (Correct answer)
It is optional for experienced technicians

Correct answer: It creates a knowledge base for future similar issues and tracks what was tried

Documentation creates a valuable knowledge base, prevents repeating unsuccessful approaches, and provides accountability for changes made during troubleshooting.

Question 5: In event-driven architectures, how should personal data included in events be handled to support GDPR compliance?

Encrypt all event payloads with a single shared key accessible to all consumers
Use event references with IDs and let consumers fetch personal data from authoritative sources under access control (Correct answer)
Include full personal data in every event to ensure consumers have complete context
Store events in perpetuity to enable full audit replay of all personal data changes

Correct answer: Use event references with IDs and let consumers fetch personal data from authoritative sources under access control

Referencing data by ID rather than embedding it limits personal data propagation across the event bus and ensures access-controlled retrieval from the authoritative source.

Question 6: A data engineering team proposes storing a hash of each customer's email address as a unique key in an integrated dataset. Under GDPR, this hashed value is most accurately classified as:

Anonymous data, fully outside GDPR scope
Data that may be freely shared with third parties
Personal data if the hash can be reversed or if the original email is also held (Correct answer)
Special-category data requiring explicit consent

Correct answer: Personal data if the hash can be reversed or if the original email is also held

A hash is pseudonymous personal data if the original email is still held elsewhere, because re-identification is possible using the retained plaintext and the same hash function.

Question 7: What does 'privacy by default' require specifically regarding access to personal data systems?

Personal data must be encrypted by default for all users
Systems must default to the most privacy-protective settings, limiting access to what is necessary (Correct answer)
Access logs must be reviewed weekly by the DPO
All users must complete GDPR training before accessing any system

Correct answer: Systems must default to the most privacy-protective settings, limiting access to what is necessary

Article 25(2) requires that by default, only personal data necessary for each specific purpose is processed, including limiting access scope.

Question 8: What does the right to be forgotten entail?

The right to share all data
The right to delete their personal data (Correct answer)
The right to forget passwords
The right to ignore consent

Correct answer: The right to delete their personal data

The right to be forgotten, or the right to erasure, allows individuals to request the deletion or removal of their personal data where there is no compelling reason for its continued processing. This right applies in specific circumstances, such as when data is no longer necessary for its original purpose or consent is withdrawn.

Question 9: An organization profiles website visitors to deliver targeted advertising without obtaining valid consent. Which legal basis deficiency does this most directly illustrate?

Inadequate data retention schedule
Lack of a legitimate interest balancing test
Failure to appoint a DPO
Absence of a lawful basis for processing under Article 6 (Correct answer)

Correct answer: Absence of a lawful basis for processing under Article 6

Behavioral advertising via profiling requires a valid legal basis under Article 6; without one, the processing itself is unlawful regardless of other compliance measures.

Question 10: What is capacity planning?

Buying maximum resources upfront
Only planning for current usage levels
Predicting future resource needs based on growth trends and requirements (Correct answer)
Waiting until resources are exhausted to add more

Correct answer: Predicting future resource needs based on growth trends and requirements

Capacity planning uses growth trends and requirements to predict future needs, ensuring adequate resources are available without over-provisioning.

Question 11: A processor optimizes throughput by pooling database connections that hold personal data. What GDPR-relevant security measure must accompany connection pooling?

Disable TLS on pooled connections to reduce handshake overhead
Connection pooling is prohibited under GDPR because it shares resources across tenants
Log every pooled connection to the supervisory authority
Ensure tenant isolation so pooled connections never expose one controller's data to another (Correct answer)

Correct answer: Ensure tenant isolation so pooled connections never expose one controller's data to another

Connection pools shared across multiple controllers require strict tenant isolation to prevent cross-contamination of personal data, satisfying Article 32's confidentiality requirement.

Question 12: Which of the following correctly describes the 'purpose limitation' principle as it applies to a data controller?

Personal data collected for specified purposes must not be further processed in a manner incompatible with those purposes (Correct answer)
Purpose limitation applies only to sensitive data categories
Controllers may repurpose data freely if they obtain a new privacy notice
Data may be used for any purpose as long as it remains within the same organisation

Correct answer: Personal data collected for specified purposes must not be further processed in a manner incompatible with those purposes

Article 5(1)(b) requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in an incompatible manner.

Question 13: When a controller restricts processing under Article 18 GDPR, what must it do before lifting the restriction?

Inform the data subject before lifting the restriction (Correct answer)
File a report with the supervisory authority
Conduct a new DPIA to re-assess risks
Obtain fresh consent from the data subject

Correct answer: Inform the data subject before lifting the restriction

Article 18(3) GDPR requires the controller to inform the data subject before lifting any restriction on processing.

Question 14: Under GDPR, how must a controller respond to a right-of-access request when a large volume of information is involved?

The controller may ask the data subject to specify which information or processing activities they are concerned with (Correct answer)
The controller must provide all data within 72 hours
The controller may refuse the request entirely due to disproportionate effort
The controller must delegate the response to the DPO regardless of circumstances

Correct answer: The controller may ask the data subject to specify which information or processing activities they are concerned with

Recital 63 GDPR allows controllers to request that data subjects narrow their request when a large amount of information is held about them.

Question 15: If a data subject withdraws consent that was the sole lawful basis for processing, what must the controller do?

Transfer the data to another controller who holds a different lawful basis
Continue processing until the end of the pre-defined retention period
Cease processing for the purpose the consent covered, unless another lawful basis applies (Correct answer)
Notify the supervisory authority immediately upon withdrawal

Correct answer: Cease processing for the purpose the consent covered, unless another lawful basis applies

Article 7(3) provides that withdrawal invalidates consent as a basis, so the controller must stop processing unless it can identify and rely on an alternative lawful basis.

Question 16: When optimizing GDPR-regulated data exports for portability (Article 20), which format choice best satisfies the 'structured, commonly used, machine-readable' requirement while optimizing file size?

Proprietary binary format optimized for the controller's own systems
PDF, because it is universally readable
XML without compression, as it is the only GDPR-approved format
JSON or CSV with optional gzip compression, as these are structured, machine-readable, and widely supported (Correct answer)

Correct answer: JSON or CSV with optional gzip compression, as these are structured, machine-readable, and widely supported

Article 20 requires a structured, commonly used, machine-readable format; JSON and CSV satisfy this, and gzip compression reduces transfer size without affecting compliance.

Question 17: What is the benefit of using a layered architecture approach?

Elimination of all dependencies
Reduced hardware requirements
Separation of concerns enabling independent development and testing (Correct answer)
Faster execution speed

Correct answer: Separation of concerns enabling independent development and testing

Layered architecture separates concerns so each layer can be developed, tested, and modified independently, improving maintainability and team productivity.

Question 18: Which lawful basis applies when processing is necessary to fulfill a legal obligation to which the controller is subject?

Legal obligation (Correct answer)
Vital interests
Consent
Legitimate interests

Correct answer: Legal obligation

Article 6(1)(c) covers processing necessary for compliance with a legal obligation to which the controller is subject.

Question 19: Which GDPR Article specifically governs the conditions under which data subjects can seek compensation from controllers or processors for damages?

Article 77 — right to lodge a complaint
Article 83 — general conditions for imposing fines
Article 82 — right to compensation and liability (Correct answer)
Article 79 — right to effective judicial remedy against controller

Correct answer: Article 82 — right to compensation and liability

Article 82 establishes the right of data subjects to receive compensation from controllers or processors for material or non-material damage resulting from GDPR infringement.

Question 20: When designing a system that transfers personal data to a third-party analytics provider, which architecture pattern best maintains GDPR compliance?

Pre-processing data to anonymize or pseudonymize it before transmission (Correct answer)
Delaying transfers until the provider requests data manually
Granting the analytics provider direct database access
Sending raw personal data directly to the analytics provider's API

Correct answer: Pre-processing data to anonymize or pseudonymize it before transmission

Pre-processing to anonymize or pseudonymize reduces the risk to data subjects and may remove the transfer from GDPR scope entirely if true anonymization is achieved.

Question 21: An organisation encrypts all personal data such that a breach results in ciphertext that cannot be decrypted by attackers. How does GDPR treat this scenario regarding individual notification?

The organisation must notify individuals within 24 hours as a precaution
Individual notification may not be required if the data was rendered unintelligible to unauthorised persons (Correct answer)
Individual notification is always required when encryption is compromised
Encryption does not affect notification obligations — all breaches require full notification

Correct answer: Individual notification may not be required if the data was rendered unintelligible to unauthorised persons

Article 34(3)(a) exempts controllers from individual notification when appropriate technical measures like encryption rendered the data unintelligible to unauthorised persons.

Question 22: When should an issue be escalated to a higher support level?

Only after exhausting every possible solution
Immediately, before attempting any resolution
When the issue exceeds your technical expertise or authorization level (Correct answer)
Never, all issues should be resolved at the first level

Correct answer: When the issue exceeds your technical expertise or authorization level

Issues should be escalated when they exceed the current level technical expertise or authorization, ensuring timely resolution while maintaining appropriate support boundaries.

Question 23: Under GDPR Article 83, what is the maximum administrative fine for a violation of the basic principles for processing personal data?

€50 million or 10% of global annual turnover
€5 million or 1% of global annual turnover
€10 million or 2% of global annual turnover
€20 million or 4% of global annual turnover (Correct answer)

Correct answer: €20 million or 4% of global annual turnover

Violations of basic processing principles (Articles 5, 6, 7, 9) carry the highest tier fine: €20 million or 4% of total worldwide annual turnover, whichever is higher.

Question 24: A SaaS analytics platform stores aggregated user-behavior data. The company claims the data is anonymous. Under GDPR, the data would still be personal data if:

The company holds any separate key that could re-identify individuals (Correct answer)
The data is stored outside the EU
The aggregated records contain more than 50 data fields
The original collection did not have consent

Correct answer: The company holds any separate key that could re-identify individuals

Recital 26 states that data is personal if the controller or any other person can re-identify the individual using reasonably available means, including a retained key.

Question 25: How should configuration changes be tracked?

Only in emergency situations
In personal notes
Verbally between team members
Through version control systems with documented change rationale (Correct answer)

Correct answer: Through version control systems with documented change rationale

Version control with documented rationale provides an audit trail, enables rollbacks, and ensures team visibility into all configuration changes.

Question 26: A processor is asked by a law enforcement authority to disclose personal data it holds on behalf of a controller. What should the processor do first?

Anonymize the data before providing it to the authority
Refuse the request entirely as processors cannot disclose data
Notify the controller before disclosing, unless prohibited by law (Correct answer)
Immediately provide all requested data to the authority

Correct answer: Notify the controller before disclosing, unless prohibited by law

Processors should inform the controller of law enforcement requests before disclosing data, unless legally prohibited from doing so, as the controller holds the primary relationship with the data.

Question 27: Which approach to API design best supports GDPR's right of portability under Article 20?

Providing data exports only in proprietary binary formats to maintain competitive advantage
Limiting exports to a summary of account activity rather than raw personal data
Offering structured, commonly-used, machine-readable export formats such as JSON or CSV via an authenticated API (Correct answer)
Requiring data subjects to submit written requests by postal mail for data exports

Correct answer: Offering structured, commonly-used, machine-readable export formats such as JSON or CSV via an authenticated API

GDPR Article 20 requires personal data to be provided in a structured, commonly used, and machine-readable format, making open API-based exports in JSON or CSV the correct approach.

Question 28: Under GDPR, which of the following is a valid lawful basis for processing personal data related to a natural person's criminal convictions and offences?

Legitimate interests of the controller
Explicit consent alone is always sufficient
Processing only under the control of official authority or when authorised by member state law (Correct answer)
Vital interests of the data subject

Correct answer: Processing only under the control of official authority or when authorised by member state law

Article 10 restricts processing of criminal convictions data to circumstances under official authority or as authorised by member state law providing appropriate safeguards.

Question 29: In a cloud-native architecture, which mechanism BEST supports GDPR data residency requirements when deploying across multiple regions?

Replicating all data globally for high availability regardless of origin
Using a CDN to cache all data at edge nodes worldwide
Storing data in the cheapest available region by default
Geo-fencing with data sovereignty controls that restrict replication to approved regions (Correct answer)

Correct answer: Geo-fencing with data sovereignty controls that restrict replication to approved regions

Geo-fencing with data sovereignty controls ensures personal data of EU residents remains within approved jurisdictions, supporting GDPR's data transfer restrictions.

Question 30: Under GDPR, 'special categories of personal data' require a stricter lawful basis. Which of the following is NOT classified as a special category?

Biometric data used for identification
Data revealing religious beliefs
Genetic data
Financial data (e.g., credit card numbers) (Correct answer)

Correct answer: Financial data (e.g., credit card numbers)

Article 9 lists special categories including health, racial/ethnic origin, religion, genetic/biometric, sexual orientation, and political opinions — financial data is not included.

Question 31: Which right under GDPR allows a data subject to have inaccurate personal data corrected without undue delay?

Right to data portability (Article 20)
Right to rectification (Article 16) (Correct answer)
Right to erasure (Article 17)
Right to restriction (Article 18)

Correct answer: Right to rectification (Article 16)

Article 16 GDPR provides the right to rectification of inaccurate or incomplete personal data.

Question 32: Under GDPR's 'data minimisation' principle, what is a controller obligated to ensure?

Data is deleted within 30 days of collection
Personal data is encrypted at all times
Data subjects consent to every category of data collected
Only personal data adequate, relevant, and limited to what is necessary for the purpose is collected (Correct answer)

Correct answer: Only personal data adequate, relevant, and limited to what is necessary for the purpose is collected

Article 5(1)(c) requires that personal data be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

Question 33: How does GDPR ensure accountability?

Through mandatory documentation and audits (Correct answer)
Through randomized inspections
By allowing flexible interpretation
Via annual tax reports

Correct answer: Through mandatory documentation and audits

GDPR ensures accountability by requiring organizations to maintain comprehensive documentation of their data processing activities, such as records of processing, data protection impact assessments, and data breach notifications. Furthermore, supervisory authorities can conduct audits to verify compliance. This mandatory documentation and the potential for audits compel organizations to not only implement data protection measures but also to be able to demonstrate their effectiveness.

Question 34: A processor subcontracts data processing to a third party without the controller's prior written authorization. Which GDPR provision has the processor violated?

Article 30 — records of processing activities
Article 37 — designation of DPO
Article 28(2) — restrictions on sub-processing (Correct answer)
Article 32 — security of processing

Correct answer: Article 28(2) — restrictions on sub-processing

Article 28(2) prohibits a processor from engaging another processor without prior specific or general written authorization from the controller.

Question 35: Under GDPR, what is the maximum timeframe for notifying a supervisory authority after discovering a personal data breach that poses a risk to individuals?

72 hours (Correct answer)
24 hours
48 hours
7 days

Correct answer: 72 hours

Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach, where feasible.

Question 36: A data subject asks a controller to supply their personal data in a 'commonly used, machine-readable format' under Article 20 GDPR. Which scenario correctly applies this right?

A patient requests paper copies of hospital records held for legal compliance purposes
A user requests their social media profile data exported as a JSON or CSV file (Correct answer)
A customer requests erasure of their purchase history from an e-commerce site
An employee requests their HR file held under a collective agreement

Correct answer: A user requests their social media profile data exported as a JSON or CSV file

Article 20 portability applies to data provided by the subject to a controller under consent or contract, and the format must be machine-readable (e.g., JSON, CSV).

Question 37: Under GDPR enforcement, what is the significance of a controller being able to prove a 'reasonable doubt' regarding fault?

It triggers a mandatory EDPB review
It can exempt a processor from liability under Article 82(3) if they were not at fault (Correct answer)
It reduces the fine to the lower tier under Article 83(4)
It eliminates liability for administrative fines entirely

Correct answer: It can exempt a processor from liability under Article 82(3) if they were not at fault

Article 82(3) exempts a controller or processor from liability for compensation if they can prove that the event causing damage is not attributable to them — effectively a fault-based defence.

Question 38: Which document must processors maintain under GDPR?

Tax returns
Visitor log
Salary records
Record of processing activities (Correct answer)

Correct answer: Record of processing activities

Under GDPR, data processors are required to maintain a record of all categories of processing activities carried out on behalf of a controller. This record serves as a crucial accountability tool, detailing information such as the name and contact details of the processor, categories of processing, and security measures implemented.

Question 39: An organization processes 10 million records for GDPR compliance audits nightly. Which database strategy best reduces processing time while maintaining data minimization principles?

Replicate the entire dataset to an in-memory database
Partition tables by processing date and index only audit-relevant columns (Correct answer)
Index all columns for maximum query speed
Store all data in a single denormalized table for faster reads

Correct answer: Partition tables by processing date and index only audit-relevant columns

Date partitioning limits scan scope to relevant records, and selective indexing balances query speed with storage overhead while avoiding unnecessary data retention.

Question 40: An organisation discovers that a former employee's credentials were used to access personal data after their contract ended. Which access management failure does this represent?

Inadequate offboarding and access revocation procedures (Correct answer)
Lack of data loss prevention (DLP) tools
Insufficient encryption standards
Failure to implement multi-factor authentication

Correct answer: Inadequate offboarding and access revocation procedures

Using terminated employee credentials indicates the organisation failed to revoke access during offboarding, a fundamental access lifecycle management failure.

Question 41: A controller in the US transfers EU personal data to a cloud provider in India without any transfer mechanism in place. What is the most immediate compliance problem?

Failure to conduct a DPIA before the transfer
Non-compliance with Article 28 processor obligations
An unlawful third-country transfer in violation of Chapter V GDPR (Correct answer)
A breach of the data minimisation principle

Correct answer: An unlawful third-country transfer in violation of Chapter V GDPR

Chapter V of the GDPR prohibits transfers to third countries lacking adequacy decisions unless appropriate safeguards such as SCCs are in place.

Question 42: What can supervisory authorities do when a GDPR violation occurs?

Close the business permanently
Recommend a vacation
Award company bonuses
Impose corrective measures and fines (Correct answer)

Correct answer: Impose corrective measures and fines

When a GDPR violation occurs, supervisory authorities have significant powers to impose corrective measures and administrative fines. These measures can include warnings, reprimands, orders to rectify or erase data, and substantial financial penalties. The aim is to ensure compliance, deter future infringements, and protect the rights of data subjects.

Question 43: A controller receives a complaint that an individual's right to data portability request was fulfilled by providing data in a proprietary, machine-unreadable format. What went wrong?

The controller failed to provide data in a structured, commonly used, machine-readable format as required by Article 20(1) (Correct answer)
The controller charged a fee for portability contrary to Article 12(5)
The controller transferred the data to the wrong controller designated by the data subject
The controller failed to respond within 72 hours of the portability request

Correct answer: The controller failed to provide data in a structured, commonly used, machine-readable format as required by Article 20(1)

Article 20(1) requires that portable data be provided in a structured, commonly used, and machine-readable format such as CSV or JSON.

Question 44: Which architectural pattern for handling data subject access requests (DSARs) is most scalable for large enterprise systems with dozens of data stores?

Manual spreadsheet tracking of all data store locations
Storing all personal data in a single monolithic database for easy retrieval
A data discovery and metadata catalog integrated with automated DSAR orchestration (Correct answer)
Requiring each team to respond independently when requests arrive

Correct answer: A data discovery and metadata catalog integrated with automated DSAR orchestration

A metadata catalog combined with automated orchestration enables systematic, auditable, and timely responses to DSARs across many data stores.

Question 45: What must a controller demonstrate to prove compliance under GDPR's accountability principle?

Only that a DPO has been appointed
That data subjects have been informed via a privacy notice
That appropriate technical and organizational measures have been implemented and documented (Correct answer)
That all processing is based on consent

Correct answer: That appropriate technical and organizational measures have been implemented and documented

Article 5(2) requires controllers to be able to demonstrate compliance through documented technical and organizational measures.

Question 46: Under GDPR, what distinguishes a 'processor' from a 'controller'?

A controller determines the purposes and means of processing; a processor acts on the controller's instructions (Correct answer)
A processor must always be appointed via a written contract
A controller processes data for commercial gain only
A processor is always a third party outside the EU

Correct answer: A controller determines the purposes and means of processing; a processor acts on the controller's instructions

Article 4(7) and 4(8) define controllers as those who determine purposes and means, while processors process data on behalf of and under instructions from the controller.

Question 47: When architecting a system to support GDPR's right to erasure, which database design decision creates the MOST difficulty?

Indexing columns that contain personal data
Using immutable append-only event sourcing without a deletion strategy (Correct answer)
Using primary keys for record identification
Storing data in third normal form

Correct answer: Using immutable append-only event sourcing without a deletion strategy

Immutable event logs make erasure inherently complex because overwriting or deleting historical events breaks the integrity of the event stream.

Question 48: Which of the following statements about consent as a lawful basis is correct under GDPR?

Consent can be bundled with general terms and conditions
Silence or pre-ticked boxes constitute valid consent
Consent, once given, cannot be withdrawn
Withdrawal of consent must be as easy as giving it (Correct answer)

Correct answer: Withdrawal of consent must be as easy as giving it

Article 7(3) explicitly states that the data subject shall have the right to withdraw consent at any time, and withdrawal must be as easy as giving consent.

Question 49: A data governance team is assessing data retention in an integrated environment. Under GDPR's storage limitation principle, personal data must be kept in identifiable form for:

A maximum of five years in all cases
Until the data subject explicitly requests deletion
No longer than is necessary for the purposes for which it was collected (Correct answer)
As long as the controller can demonstrate legitimate interests

Correct answer: No longer than is necessary for the purposes for which it was collected

Article 5(1)(e) requires that personal data not be kept in a form that permits identification for longer than necessary for the specified processing purpose.

Question 50: Under GDPR, is a controller generally permitted to switch from one lawful basis to another after processing has already begun?

Yes, if the supervisory authority approves the switch
Yes, but only if the data subject consents
Yes, at any time without restriction
No, switching lawful bases mid-processing is generally not permitted (Correct answer)

Correct answer: No, switching lawful bases mid-processing is generally not permitted

Controllers must identify and document the lawful basis before processing begins; retrospectively changing the basis undermines transparency and data subject rights.

Question 51: Under GDPR, when a system uses a data lake architecture, what is the PRIMARY architectural risk that must be mitigated?

Inability to run analytics queries at scale
Lack of support for structured data formats
Loss of data context making purpose limitation and erasure difficult to enforce (Correct answer)
High storage costs making the system economically unviable

Correct answer: Loss of data context making purpose limitation and erasure difficult to enforce

Data lakes aggregate raw data from multiple sources, making it difficult to track the original purpose of collection and enforce deletion rights without robust metadata management.

Question 52: What is the maximum fine for serious GDPR infringements?

€100,000
€1 million
5% of net profit
€20 million or 4% of global turnover (Correct answer)

Correct answer: €20 million or 4% of global turnover

For serious GDPR infringements, such as violations of data subjects' rights or core processing principles, the maximum administrative fine can be up to €20 million or 4% of the company's total worldwide annual turnover from the preceding financial year, whichever is higher. This significant penalty underscores the importance of data protection and acts as a strong deterrent against non-compliance.

Question 53: A controller's legitimate interest legal basis is challenged by a data subject who objects to processing. Under Article 21, when must the controller cease processing?

Only after a supervisory authority orders it to stop
When the data subject provides written objection notarized by a solicitor
Unless the controller demonstrates compelling legitimate grounds that override the data subject's interests (Correct answer)
Immediately upon receiving any objection

Correct answer: Unless the controller demonstrates compelling legitimate grounds that override the data subject's interests

Article 21(1) allows controllers to continue processing despite an objection only if they demonstrate compelling legitimate grounds that override the data subject's interests, rights, and freedoms.

Question 54: A data subject exercises their right to erasure. The controller has made the data public (e.g., on a website). What additional obligation does Article 17(2) GDPR impose?

The controller must notify the supervisory authority within 72 hours of the erasure request
The controller must obtain a court order before removing publicly available content
The controller must take reasonable steps to inform other controllers processing the data that the subject has requested erasure of links, copies, or replications (Correct answer)
The controller must immediately shut down the website pending full erasure

Correct answer: The controller must take reasonable steps to inform other controllers processing the data that the subject has requested erasure of links, copies, or replications

Article 17(2) GDPR requires a controller who has made data public to take reasonable steps, including technical measures, to inform third-party controllers of the erasure request.

Question 55: A data pipeline anonymizes personal data before analytics processing. To optimize throughput, engineers propose deferring anonymization to after initial processing. What is the GDPR risk?

It only creates a risk if the data crosses EU borders
Personal data would be processed without a lawful basis during the deferred window (Correct answer)
The risk is limited to storage costs, not regulatory compliance
No risk; anonymization timing does not affect GDPR obligations

Correct answer: Personal data would be processed without a lawful basis during the deferred window

Processing identifiable personal data before anonymization requires a lawful basis; deferring anonymization means personal data is processed without that basis during the pipeline stage.

Question 56: Under GDPR, when is a Data Protection Impact Assessment (DPIA) mandatory?

Only when processing special category data
For all processing of personal data regardless of risk
Whenever a Data Protection Officer is appointed
When processing is likely to result in a high risk to the rights and freedoms of natural persons (Correct answer)

Correct answer: When processing is likely to result in a high risk to the rights and freedoms of natural persons

Article 35 mandates a DPIA when processing is likely to result in a high risk to individuals' rights and freedoms, particularly for new technologies or large-scale profiling.

Question 57: Which technical feature of a Privacy Information Management System (PIMS) most directly supports Article 30 compliance?

A ticketing system for handling data subject requests
An automated Record of Processing Activities (RoPA) that stays synchronized with actual systems (Correct answer)
Intrusion detection alerts for unauthorized access
Single sign-on integration for employee login

Correct answer: An automated Record of Processing Activities (RoPA) that stays synchronized with actual systems

Article 30 requires controllers and processors to maintain accurate records of processing activities, which a synchronized RoPA module directly supports.

Question 58: Under GDPR, a data breach notification to the supervisory authority must be made within what timeframe after the controller becomes aware of it?

48 hours
72 hours (Correct answer)
7 days
24 hours

Correct answer: 72 hours

Article 33(1) requires notification to the supervisory authority within 72 hours of the controller becoming aware of the breach, where feasible.

Question 59: Which lawful basis permits processing when the controller or a third party has a legitimate interest, provided it is not overridden by the data subject's interests?

Legal obligation
Legitimate interests (Correct answer)
Contract
Consent

Correct answer: Legitimate interests

Article 6(1)(f) allows processing based on legitimate interests, subject to a balancing test against the rights and freedoms of data subjects.

Question 60: Why is change management important during implementation?

It replaces the need for training
It is only needed for large organizations
It ensures smooth transitions and user adoption of new systems (Correct answer)
It slows down the project unnecessarily

Correct answer: It ensures smooth transitions and user adoption of new systems

Change management facilitates smooth transitions by addressing user concerns, providing training, and ensuring organizational readiness for new systems.

Question 61: What is the primary purpose of the EDPB's binding opinions under Article 64?

To approve new Standard Contractual Clauses
To adjudicate data subject rights disputes
To set fines for cross-border violations
To ensure consistent application of GDPR across Member States (Correct answer)

Correct answer: To ensure consistent application of GDPR across Member States

Article 64 consistency mechanism opinions from the EDPB aim to ensure that supervisory authorities apply GDPR consistently across the EU.

Question 62: Which network architecture principle helps meet GDPR's integrity and confidentiality requirement by assuming no implicit trust within the network perimeter?

Air-gapped networks with no external connectivity
Zero trust architecture with continuous verification of every request (Correct answer)
VPN-only access with static IP whitelisting
Perimeter-based security with a trusted internal network

Correct answer: Zero trust architecture with continuous verification of every request

Zero trust architecture enforces continuous authentication and authorization for every request regardless of network location, supporting GDPR's confidentiality and integrity obligations.

Question 63: Which pseudonymization technique replaces a direct identifier with a reversible token stored in a separate, access-controlled mapping table?

Aggregation
Generalization
Tokenization (Correct answer)
Data suppression

Correct answer: Tokenization

Tokenization substitutes identifiers with surrogate tokens while maintaining a secure mapping table, allowing re-identification only by authorized parties with access to the vault.

Question 64: When must a controller notify the supervisory authority of a personal data breach?

Without undue delay and within 72 hours of becoming aware (Correct answer)
Within 30 days of detection
Within 24 hours of becoming aware
Only if the breach affects more than 1,000 individuals

Correct answer: Without undue delay and within 72 hours of becoming aware

Article 33 requires controllers to notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach.

Question 65: Under GDPR, when a processor implements security measures, who bears ultimate responsibility for ensuring those measures are appropriate?

Both share equal responsibility with no primary party
The controller, who must ensure processor compliance via contract (Correct answer)
The processor alone, as they control the infrastructure
The supervisory authority, which sets minimum standards

Correct answer: The controller, who must ensure processor compliance via contract

Under Article 28, controllers must only use processors providing sufficient guarantees and must contractually require appropriate security measures.

Question 66: Under GDPR, what is the consequence if a controller fails to designate a DPO when one is mandatory?

The controller must appoint a supervisory authority representative instead
The controller's processing activities are automatically suspended
The controller may be subject to administrative fines under Article 83(4) (Correct answer)
Processing can continue only if the controller self-certifies compliance

Correct answer: The controller may be subject to administrative fines under Article 83(4)

Failure to designate a mandatory DPO falls under Article 83(4), which provides for fines of up to €10 million or 2% of global annual turnover.

Question 67: When designing a microservices architecture that processes personal data, which pattern best ensures GDPR compliance by minimizing data exposure across services?

CQRS pattern without any data isolation between read and write models
Saga pattern where all services share a common event bus with full payloads
Data ownership pattern where each service owns its own data store (Correct answer)
Shared database pattern where all services access one central DB

Correct answer: Data ownership pattern where each service owns its own data store

The data ownership pattern ensures each microservice controls its own data store, limiting personal data exposure to only the services that legitimately need it.

Question 68: An ETL pipeline automatically enriches customer records by joining internal data with purchased third-party datasets. What GDPR obligation is most likely triggered?

Immediate notification to the supervisory authority
Conducting a Data Protection Impact Assessment due to systematic combination of data (Correct answer)
Automatic pseudonymisation of all output records
A new Data Processing Agreement with every customer

Correct answer: Conducting a Data Protection Impact Assessment due to systematic combination of data

Article 35 and Recital 91 require a DPIA when systematic and extensive profiling or combination of personal data occurs at scale.

Question 69: A company discovers that a data integration script has been sending customer email addresses to an incorrect third-party server for 48 hours. Under GDPR, within what timeframe must it notify the supervisory authority?

Within 30 days of becoming aware
Only if more than 1,000 individuals are affected
Without undue delay and, where feasible, within 72 hours of becoming aware (Correct answer)
Immediately, within 12 hours of discovery

Correct answer: Without undue delay and, where feasible, within 72 hours of becoming aware

Article 33 requires notification to the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of a personal data breach.

Question 70: Under GDPR, which enforcement tool allows a supervisory authority to temporarily or permanently ban processing?

Judicial remedy under Article 78
Corrective power under Article 58(2)(f) (Correct answer)
Advisory power under Article 58(3)
Investigative power under Article 58(1)

Correct answer: Corrective power under Article 58(2)(f)

Article 58(2)(f) grants supervisory authorities the corrective power to impose a temporary or permanent ban on processing.

Question 71: Under the GDPR accountability framework, which practice best demonstrates that an organisation's data integration processes comply with the principle of integrity and confidentiality?

Filing integration architecture diagrams with the supervisory authority
Obtaining ISO 9001 quality certification
Implementing role-based access controls, audit logging, and encryption across all integrated systems (Correct answer)
Publishing annual transparency reports

Correct answer: Implementing role-based access controls, audit logging, and encryption across all integrated systems

Article 5(1)(f) requires appropriate technical and organisational measures; role-based access, audit trails, and encryption collectively protect data against unauthorised or unlawful processing.

Question 72: Which approach best embeds the GDPR principle of integrity and confidentiality into an automated data processing script?

Running the script only during business hours
Restricting the script to process no more than 1,000 records at a time
Implementing encryption in transit and at rest, access controls, and audit logging (Correct answer)
Storing all outputs in a password-protected spreadsheet

Correct answer: Implementing encryption in transit and at rest, access controls, and audit logging

Article 5(1)(f) requires appropriate security measures such as encryption, access controls, and logging to protect against unauthorised processing and accidental loss.

Question 73: When designing audit logging for GDPR compliance, which characteristic is MOST important for the logs themselves?

Logs should capture all data in full fidelity including complete PII values
Logs should be deleted weekly to minimize storage of personal data
Logs should be human-readable and stored in plain text files
Logs must be tamper-evident, access-controlled, and retained for an appropriate period (Correct answer)

Correct answer: Logs must be tamper-evident, access-controlled, and retained for an appropriate period

Audit logs must be tamper-evident to serve as trustworthy accountability records, access-controlled to prevent unauthorized modification, and retained to support breach investigation and regulatory inquiries.

Question 74: Under GDPR, which right gives a data subject the ability to not be subject to a decision based solely on automated processing that produces significant legal effects?

Right to object (Article 21)
Right not to be subject to automated individual decision-making (Article 22) (Correct answer)
Right to erasure (Article 17)
Right to restriction (Article 18)

Correct answer: Right not to be subject to automated individual decision-making (Article 22)

Article 22 GDPR specifically addresses automated individual decision-making, including profiling, that significantly affects the data subject.

Question 75: What is the value of isolating variables during troubleshooting?

It makes the process take longer
It only applies to hardware problems
It identifies the specific cause by changing one factor at a time (Correct answer)
It is unnecessary with modern diagnostic tools

Correct answer: It identifies the specific cause by changing one factor at a time

Isolating variables by changing one factor at a time enables precise identification of the root cause, preventing incorrect conclusions from multiple simultaneous changes.

Question 76: What is the 80/20 rule as applied to performance optimization?

80% of performance gains come from optimizing 20% of the code or configuration (Correct answer)
Optimize 80% of components and ignore 20%
Performance should be 80% of the project budget
Spend 80% of time optimizing and 20% testing

Correct answer: 80% of performance gains come from optimizing 20% of the code or configuration

The 80/20 rule (Pareto principle) in optimization means focusing on the critical 20% of areas that will yield 80% of performance improvements, maximizing efficiency.

Question 77: What is the primary consideration when designing system architecture?

Minimizing the number of components
Matching competitor architectures
Scalability, reliability, and alignment with business requirements (Correct answer)
Using the newest technology available

Correct answer: Scalability, reliability, and alignment with business requirements

System architecture must prioritize scalability, reliability, and alignment with business requirements to ensure long-term viability and value delivery.

Question 78: In the context of special categories of data, what additional safeguard applies to automated decision-making under Article 22(4) GDPR?

Such decisions are only permitted with explicit consent or for reasons of substantial public interest, and suitable measures to protect rights must be in place (Correct answer)
Automated decisions involving special categories are always prohibited regardless of safeguards
Special category data may be used in automated decisions only after pseudonymization
Controllers must obtain approval from the national supervisory authority before each automated decision

Correct answer: Such decisions are only permitted with explicit consent or for reasons of substantial public interest, and suitable measures to protect rights must be in place

Article 22(4) GDPR restricts automated decisions involving special categories to explicit consent or substantial public interest bases, coupled with suitable safeguards.

Question 79: A compliance dashboard tracks 'processing activities involving automated decision-making with legal effects.' Controllers must ensure these activities comply primarily with which Article?

Article 20 — data portability
Article 22 — automated individual decision-making (Correct answer)
Article 34 — communication of breach to data subjects
Article 17 — right to erasure

Correct answer: Article 22 — automated individual decision-making

Article 22 restricts automated decision-making that produces legal or similarly significant effects and grants data subjects rights to human review.

Question 80: Under GDPR, a data subject files a complaint with a supervisory authority. If no action is taken within three months, what can the data subject do?

Request the controller to self-report
Escalate directly to the EDPB
Seek a judicial remedy against the supervisory authority under Article 78 (Correct answer)
File a complaint with the European Ombudsman

Correct answer: Seek a judicial remedy against the supervisory authority under Article 78

Article 78(2) grants data subjects the right to an effective judicial remedy if the supervisory authority does not handle a complaint or fails to inform them within three months.

Question 81: A company uses pseudonymisation when integrating datasets. According to GDPR, pseudonymised data is best described as:

Personal data that can no longer be attributed to a specific individual without additional information (Correct answer)
Data that may only be stored within the EU
Fully anonymous and outside the scope of GDPR
Data that requires explicit consent to process

Correct answer: Personal data that can no longer be attributed to a specific individual without additional information

Recital 26 and Article 4(5) define pseudonymised data as personal data that cannot be attributed to a specific data subject without additional information held separately.

Question 82: How does GDPR treat the right to object when processing is carried out for scientific or historical research purposes under Article 21(6)?

The right to object is permanently waived once the data subject has consented to research participation
Researchers must always honor objections unless they obtain explicit consent from each subject
The right to object is fully applicable with no restrictions for research processing
The right to object may be restricted where necessary for the performance of a task carried out for reasons of public interest (Correct answer)

Correct answer: The right to object may be restricted where necessary for the performance of a task carried out for reasons of public interest

Article 21(6) GDPR permits Member States to restrict the right to object for research/statistical purposes where such restriction is necessary to achieve those objectives.

Question 83: A US-based company markets goods to EU residents and monitors their behavior online. Is the company subject to GDPR?

Only if the company has annual revenue exceeding €10 million
No, because the company is not established in the EU
Yes, under Article 3(2) extra-territorial scope provisions (Correct answer)
Only if it processes more than 5,000 EU residents' data

Correct answer: Yes, under Article 3(2) extra-territorial scope provisions

Article 3(2) extends GDPR to non-EU establishments that offer goods/services to EU data subjects or monitor their behavior within the EU.

Question 84: A data subject reports that an organization has not responded to their rectification request after 45 days. Under GDPR, what standard applies?

The controller had 30 days with a possible 60-day extension (90 days total) for complex requests
The controller had 30 days with a possible two-month extension, totalling three months (Correct answer)
The controller had 45 days, which has now expired with no further extension allowed
The controller had 14 days and is already in breach of Article 12(3)

Correct answer: The controller had 30 days with a possible two-month extension, totalling three months

Article 12(3) sets a one-month deadline extendable by a further two months for complex or numerous requests, meaning 45 days falls within the initial one-month window only if extended notice was given.

Question 85: Which scenario best demonstrates the principle of 'integrity and confidentiality' under GDPR Article 5(1)(f)?

Using encryption and access controls to prevent unauthorised processing (Correct answer)
Correcting inaccurate personal data upon request
Deleting personal data after its retention period expires
Notifying individuals of how their data is used

Correct answer: Using encryption and access controls to prevent unauthorised processing

Article 5(1)(f) requires processing personal data in a manner ensuring appropriate security, including protection against unauthorised access — achieved via encryption and access controls.

Question 86: During a master data management (MDM) initiative, an organisation plans to create a 'golden record' consolidating personal data from five source systems. What GDPR principle requires that only necessary data fields be included in the golden record?

Accuracy
Data minimisation (Correct answer)
Storage limitation
Transparency

Correct answer: Data minimisation

Article 5(1)(c) data minimisation requires that personal data be adequate, relevant, and limited to what is necessary for the specified purpose.

Question 87: Under GDPR Article 17, which of the following is NOT a valid ground for the right to erasure ('right to be forgotten')?

The personal data has been unlawfully processed
The data subject withdraws consent and no other legal basis exists
The data subject simply prefers their data not be stored any longer without other grounds (Correct answer)
The personal data is no longer necessary for the purpose it was collected

Correct answer: The data subject simply prefers their data not be stored any longer without other grounds

The right to erasure requires specific grounds under Article 17; a mere preference without a qualifying ground is insufficient.

Question 88: A system architect proposes logging full user request payloads for 90 days to support debugging. How should the DPO respond?

Approve it because debugging is a legitimate interest
Require a shortened retention period and payload sanitization to remove personal data from logs (Correct answer)
Reject all logging because it violates the storage limitation principle
Require explicit consent from each user before their payloads are logged

Correct answer: Require a shortened retention period and payload sanitization to remove personal data from logs

Storage limitation and data minimization require that logs retain data only as long as necessary and contain no more personal data than needed for the debugging purpose.

Question 89: Under GDPR, what internal record must controllers maintain for ALL personal data breaches, including those not reported to the DPA?

A breach log submitted to the EDPB annually
A breach summary forwarded to each affected data subject
An internal breach register documenting facts, effects, and remedial action under Article 33(5) (Correct answer)
A public breach register on their website

Correct answer: An internal breach register documenting facts, effects, and remedial action under Article 33(5)

Article 33(5) requires controllers to document all breaches internally, enabling supervisory authorities to verify compliance even for low-risk breaches not escalated to the DPA.

Question 90: When designing a system to detect and respond to personal data breaches within GDPR's 72-hour notification window, which architectural component is MOST critical?

A weekly batch report summarizing system errors for management review
Annual penetration testing to identify potential breach vectors proactively
Real-time security information and event management (SIEM) with automated alerting and incident classification (Correct answer)
A manual breach register updated by employees when they notice anomalies

Correct answer: Real-time security information and event management (SIEM) with automated alerting and incident classification

A SIEM with real-time automated alerting enables detection and classification of breaches quickly enough to investigate and notify the supervisory authority within 72 hours as required by GDPR Article 33.

IAPP CIPP/E — Certified Information Privacy Professional/Europe (GDPR)

The CIPP/E certifies knowledge of European data protection law and privacy regulation, covering GDPR principles, lawful processing, data subject rights, international transfers, and compliance obligations under EU law.

Questions

150 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds