IAPP CIPP/E — Certified Information Privacy Professional/Europe (GDPR) — Questions and Answers

Question 1: A healthcare app logs every API call including patient identifiers. What GDPR-compliant configuration change should be made?

Replace patient identifiers in logs with pseudonymous tokens or hash values (Correct answer)
Move logs to an encrypted S3 bucket
Require separate consent before writing any log entries
Delete all application logs immediately after each session

Correct answer: Replace patient identifiers in logs with pseudonymous tokens or hash values

Replacing direct identifiers with pseudonymous tokens in logs reduces exposure while preserving the ability to debug issues.

Question 2: Which of the following best describes the 'one-stop-shop' mechanism under GDPR?

Data subjects can lodge complaints with any EU supervisory authority
Controllers need only register with one national authority
All GDPR enforcement is centralized through the EDPB
A controller with cross-border processing has a single lead supervisory authority (Correct answer)

Correct answer: A controller with cross-border processing has a single lead supervisory authority

The one-stop-shop mechanism means that a controller operating in multiple EU Member States deals primarily with the supervisory authority of its main establishment.

Question 3: When integrating systems, what is an API contract?

A legal document between vendors
A user interface specification
A performance guarantee
A formal agreement on data formats, endpoints, and expected behaviors (Correct answer)

Correct answer: A formal agreement on data formats, endpoints, and expected behaviors

An API contract formally defines data formats, endpoints, and expected behaviors between integrated systems, ensuring reliable and predictable communication.

Question 4: Under Article 34(3), direct notification to data subjects may be waived if:

The DPO has certified the breach is low priority
The controller has implemented appropriate technical measures rendering data unintelligible to unauthorized persons (Correct answer)
The breach has already been covered in the news
The breach involves fewer than 100 individuals

Correct answer: The controller has implemented appropriate technical measures rendering data unintelligible to unauthorized persons

Article 34(3)(a) allows omitting direct notification if appropriate protection measures, such as encryption, were applied such that the data is unintelligible to unauthorized parties.

Question 5: When should performance testing be conducted?

Only after receiving user complaints
Once during initial deployment only
Only for applications with more than 1000 users
Throughout the development lifecycle and before major releases (Correct answer)

Correct answer: Throughout the development lifecycle and before major releases

Performance testing throughout the lifecycle catches issues early when they are cheaper to fix and prevents performance regressions in new releases.

Question 6: A SaaS company acting as a processor wants to engage a sub-processor to handle EU personal data. What does GDPR require?

Sub-processors only need to be registered with the relevant supervisory authority
Notification to the supervisory authority within 30 days of engaging a sub-processor
Prior specific or general written authorisation from the controller is required before engaging sub-processors (Correct answer)
Sub-processors are prohibited — only the original processor may handle the data

Correct answer: Prior specific or general written authorisation from the controller is required before engaging sub-processors

Article 28(2) requires processors to obtain prior specific or general written authorisation from the controller before engaging sub-processors.

Question 7: An e-commerce platform stores EU customer payment data on servers in the United States. Which mechanism legally permits this under GDPR Chapter V?

Using Standard Contractual Clauses (SCCs) approved by the European Commission (Correct answer)
Obtaining a one-time consent from each customer at checkout
Storing data in a US data center certified under ISO 27001
Encrypting the data before transfer

Correct answer: Using Standard Contractual Clauses (SCCs) approved by the European Commission

SCCs are a recognized transfer mechanism under GDPR Article 46 that provide appropriate safeguards for international data transfers.

Question 8: In a federated identity architecture, where does GDPR accountability for personal data in identity tokens primarily reside?

Shared between the identity provider as processor and each relying party as controller for their own processing (Correct answer)
With the OAuth 2.0 specification body that defines the token format
Solely with the identity provider who issues the tokens
With the end user who authenticates and generates the token

Correct answer: Shared between the identity provider as processor and each relying party as controller for their own processing

Each relying party acts as a controller for how it processes identity data received in tokens, while the IdP acts as a processor or independent controller depending on the relationship.

Question 9: A system uses a third-party CDN to serve web pages. Under GDPR, what is the PRIMARY data protection concern with this architecture?

Using a CDN automatically satisfies GDPR data residency requirements
CDNs store static content only and therefore never process personal data
CDNs reduce page load speed causing poor user experience
The CDN acts as a data processor receiving personal data (e.g., IP addresses) and must have a DPA in place (Correct answer)

Correct answer: The CDN acts as a data processor receiving personal data (e.g., IP addresses) and must have a DPA in place

CDNs receive requests containing IP addresses and other personal data, making them data processors that require a Data Processing Agreement under GDPR Article 28.

Question 10: When is a controller NOT required to notify data subjects about a personal data breach under Article 34?

When the affected data was protected by appropriate encryption (Correct answer)
When fewer than 100 individuals are affected
When a processor caused the breach
When the breach occurred more than 30 days ago

Correct answer: When the affected data was protected by appropriate encryption

Article 34(3)(a) exempts notification to data subjects when the controller has implemented appropriate technical protection measures (e.g., encryption) that render the data unintelligible.

Question 11: What is the maximum fine for serious GDPR infringements?

€100,000
€1 million
€20 million or 4% of global turnover (Correct answer)
5% of net profit

Correct answer: €20 million or 4% of global turnover

For serious GDPR infringements, such as violations of data subjects' rights or core processing principles, the maximum administrative fine can be up to €20 million or 4% of the company's total worldwide annual turnover from the preceding financial year, whichever is higher. This significant penalty underscores the importance of data protection and acts as a strong deterrent against non-compliance.

Question 12: A GDPR-compliant system design requires 'data minimization' at the collection layer. Which architectural control BEST enforces this at the API level?

Accepting all fields and filtering excess data in the database layer
Logging all received fields and discarding unused ones post-processing
Using strict input schemas that reject any fields not required for the stated purpose (Correct answer)
Compressing incoming payloads to reduce storage consumption

Correct answer: Using strict input schemas that reject any fields not required for the stated purpose

Strict input schema validation at the API layer prevents collection of unnecessary personal data before it enters the system.

Question 13: What does 'privacy by default' require specifically regarding access to personal data systems?

Access logs must be reviewed weekly by the DPO
All users must complete GDPR training before accessing any system
Systems must default to the most privacy-protective settings, limiting access to what is necessary (Correct answer)
Personal data must be encrypted by default for all users

Correct answer: Systems must default to the most privacy-protective settings, limiting access to what is necessary

Article 25(2) requires that by default, only personal data necessary for each specific purpose is processed, including limiting access scope.

Question 14: Which supervisory authority leads the BCR approval process for a multinational organization with its main EU establishment in Ireland?

European Data Protection Board
German DSK
Irish Data Protection Commission (Correct answer)
French CNIL

Correct answer: Irish Data Protection Commission

The Irish Data Protection Commission acts as lead supervisory authority for organizations whose main EU establishment is in Ireland, overseeing their BCR approval.

Question 15: Which architectural approach to consent management best supports GDPR's requirement that consent be as easy to withdraw as to give?

Storing consent in application code as hardcoded flags
Recording consent in a single database table checked manually by developers
Embedding consent logic within each individual service independently
A centralized consent management platform with real-time propagation to all downstream systems (Correct answer)

Correct answer: A centralized consent management platform with real-time propagation to all downstream systems

A centralized consent management platform with real-time propagation ensures withdrawal of consent is immediately reflected across all systems processing data under that consent.

Question 16: A SaaS analytics platform stores aggregated user-behavior data. The company claims the data is anonymous. Under GDPR, the data would still be personal data if:

The aggregated records contain more than 50 data fields
The company holds any separate key that could re-identify individuals (Correct answer)
The original collection did not have consent
The data is stored outside the EU

Correct answer: The company holds any separate key that could re-identify individuals

Recital 26 states that data is personal if the controller or any other person can re-identify the individual using reasonably available means, including a retained key.

Question 17: Under GDPR, when a system uses a data lake architecture, what is the PRIMARY architectural risk that must be mitigated?

High storage costs making the system economically unviable
Inability to run analytics queries at scale
Loss of data context making purpose limitation and erasure difficult to enforce (Correct answer)
Lack of support for structured data formats

Correct answer: Loss of data context making purpose limitation and erasure difficult to enforce

Data lakes aggregate raw data from multiple sources, making it difficult to track the original purpose of collection and enforce deletion rights without robust metadata management.

Question 18: Which GDPR article governs the right to data portability, and to whom does it apply?

Article 20 — applies to all lawful processing activities
Article 15 — applies when the data subject requests access
Article 20 — applies only when processing is based on consent or a contract (Correct answer)
Article 21 — applies when processing is based on legitimate interests

Correct answer: Article 20 — applies only when processing is based on consent or a contract

Article 20 GDPR grants portability rights only when processing relies on consent (Article 6(1)(a)) or a contract (Article 6(1)(b)).

Question 19: A company uses a multi-tenant SaaS architecture. Under GDPR, what is the MOST important architectural control to prevent one tenant's personal data from being accessible to another?

Relying on application-layer filtering to separate tenant data at query time
Using the same encryption key for all tenants to simplify key management
Storing all tenant data together and trusting staff not to query across tenants
Strict tenant isolation through separate encryption keys, row-level security, or schema separation (Correct answer)

Correct answer: Strict tenant isolation through separate encryption keys, row-level security, or schema separation

Strong tenant isolation prevents unauthorized cross-tenant data access, which could constitute a personal data breach under GDPR Article 33.

Question 20: A consent management platform (CMP) must record granular consent with timestamps at high throughput. Which storage approach best handles write-heavy consent logging under GDPR?

Store consent in browser cookies only to reduce server load
Use a relational database with full ACID transactions for every consent event
Aggregate consent events hourly to reduce write volume
Use an append-only event log (e.g., Kafka-backed) with periodic compaction to a consent store (Correct answer)

Correct answer: Use an append-only event log (e.g., Kafka-backed) with periodic compaction to a consent store

An append-only event log absorbs high write throughput efficiently and provides an immutable audit trail, while compaction builds the current consent state for reads.

Question 21: A data subject submits an access request to a controller but the controller suspects the request is manifestly unfounded. What evidence standard applies to justify refusing or charging a fee?

The data subject must first prove their identity before any assessment is made
The burden of proof lies with the controller to demonstrate the manifestly unfounded or excessive nature (Correct answer)
The supervisory authority must pre-approve any refusal before it is communicated
The controller only needs reasonable suspicion

Correct answer: The burden of proof lies with the controller to demonstrate the manifestly unfounded or excessive nature

Article 12(5) GDPR explicitly states that where the controller claims a request is manifestly unfounded or excessive, the burden of proof lies with the controller.

Question 22: Which scenario best demonstrates the principle of 'integrity and confidentiality' under GDPR Article 5(1)(f)?

Notifying individuals of how their data is used
Using encryption and access controls to prevent unauthorised processing (Correct answer)
Correcting inaccurate personal data upon request
Deleting personal data after its retention period expires

Correct answer: Using encryption and access controls to prevent unauthorised processing

Article 5(1)(f) requires processing personal data in a manner ensuring appropriate security, including protection against unauthorised access — achieved via encryption and access controls.

Question 23: If a controller notifies the DPA of a breach and later discovers additional affected data subjects, what must the controller do?

Update the notification with the additional information without undue delay, as permitted by Article 33(4) (Correct answer)
Notify each data subject individually before informing the DPA of the update
File a completely new breach notification and withdraw the original
Request EDPB approval before updating the notification

Correct answer: Update the notification with the additional information without undue delay, as permitted by Article 33(4)

Article 33(4) explicitly allows supplementary notifications when additional information becomes available, avoiding the need to restart the 72-hour clock for updates.

Question 24: When must a data breach be reported to the supervisory authority?

At the end of the month
Within 72 hours (Correct answer)
Within 24 hours
Within 7 days

Correct answer: Within 72 hours

In the event of a personal data breach, the data controller must notify the relevant supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it. This notification is required unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

Question 25: What is the purpose of data lineage tracking?

To track which users access data
To trace data origin, transformations, and movement through systems (Correct answer)
To create backup schedules
To measure data storage costs

Correct answer: To trace data origin, transformations, and movement through systems

Data lineage tracking traces data from origin through all transformations and movements, supporting audit requirements, troubleshooting, and impact analysis.

Question 26: Which network architecture principle helps meet GDPR's integrity and confidentiality requirement by assuming no implicit trust within the network perimeter?

Air-gapped networks with no external connectivity
VPN-only access with static IP whitelisting
Perimeter-based security with a trusted internal network
Zero trust architecture with continuous verification of every request (Correct answer)

Correct answer: Zero trust architecture with continuous verification of every request

Zero trust architecture enforces continuous authentication and authorization for every request regardless of network location, supporting GDPR's confidentiality and integrity obligations.

Question 27: A controller receives a valid erasure request under Article 17. In which scenario can the controller legitimately refuse?

When the data has been encrypted at rest
When the data subject originally gave consent
When the controller has appointed a DPO
When the data is necessary for exercising the right of freedom of expression (Correct answer)

Correct answer: When the data is necessary for exercising the right of freedom of expression

Article 17(3)(a) allows controllers to refuse erasure when processing is necessary for exercising the right of freedom of expression and information.

Question 28: What distinguishes a Data Protection Impact Assessment (DPIA) tracking tool from a general risk register in a GDPR context?

DPIA tools focus specifically on high-risk processing as required by Article 35 (Correct answer)
DPIA tools only apply to processors, not controllers
DPIAs are voluntary; risk registers are mandatory
Risk registers replace the need for DPIAs

Correct answer: DPIA tools focus specifically on high-risk processing as required by Article 35

DPIA tracking tools are scoped to the Article 35 obligation — identifying and managing high-risk processing operations before they begin.

Question 29: If a controller cannot provide all required breach notification information within 72 hours, what does GDPR permit?

Only the DPO may decide to withhold notification
The controller may delay notification entirely until the investigation is complete
The controller may provide information in phases without undue further delay (Correct answer)
The notification is invalid and must be re-submitted after full investigation

Correct answer: The controller may provide information in phases without undue further delay

Article 33(4) allows phased notification where full information is not yet available, provided additional information is supplied without undue further delay.

Question 30: A controller receives a data subject access request (DSAR) from a customer whose data is spread across eight integrated systems. The controller has one month to respond. What is the maximum extension period allowed under GDPR?

Two additional months if the request is complex or numerous (Correct answer)
No extension is permitted under any circumstances
One additional month
Three additional months for large data estates

Correct answer: Two additional months if the request is complex or numerous

Article 12(3) allows the response deadline to be extended by two further months where requests are complex or numerous, provided the data subject is informed within the original one-month period.

IAPP CIPP/E — Certified Information Privacy Professional/Europe (GDPR)

The CIPP/E certifies knowledge of European data protection law and privacy regulation, covering GDPR principles, lawful processing, data subject rights, international transfers, and compliance obligations under EU law.

Questions

35 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds