CIPP-E Exam Questions

SCENARIO Please use the following to answer the next question: BHealthy, a company based in Italy, is ready to launch a new line of natural products, with a focus on sunscreen. The...

Which of the following is NOT an explicit right granted to data subjects under the GDPR?

As per the GDPR, which legal basis would be the most appropriate for an online shop that wishes to process personal data for the purpose of fraud prevention?

The Planet 49 CJEU Judgement applies to?

Bioface is a company based in the United States. It has no servers, personnel or assets in the European Union. By collecting photographs from social media and other web-based servi...

SCENARIO Please use the following to answer the next question: Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA. Today, it is a multi-billion-dollar candy c...

SCENARIO Please use the following to answer the next question: Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA. Today, it is a multi-billion-dollar candy c...

SCENARIO Please use the following to answer the next question: Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA. Today, it is a multi-billion-dollar candy c...

SCENARIO Please use the following to answer the next question: Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA. Today, it is a multi-billion-dollar candy c...

SCENARIO Please use the following to answer the next question: Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA. Today, it is a multi-billion-dollar candy c...

Which of the following was the first legally binding international instrument in the area of data protection?

A multinational company is appointing a mandatory data protection officer. In addition to considering the rules set out in Article 37 (1) of the GDPR, which of the following action...

The European Parliament jointly exercises legislative and budgetary functions with which of the following?

A U.S. company's website sells widgets. Which of the following factors would NOT in itself subject the company to the GDPR?

When does the European Data Protection Board (EDPB) recommend reevaluating whether a transfer tool is effectively providing a level of personal data protection that is in complianc...

Which judicial body makes decisions on actions taken by individuals wishing to enforce their rights under EU law?

SCENARIO Please use the following to answer the next question: Sandy recently joined Market4U, an advertising technology company founded in 2016, as their VP of Privacy and Data Go...

SCENARIO Please use the following to answer the next question: Sandy recently joined Market4U, an advertising technology company founded in 2016, as their VP of Privacy and Data Go...

A data controller appoints a data protection officer. Which of the following conditions would NOT result in an infringement of Articles 37 to 39 of the GDPR?

Data retention in the EU was underpinned by a legal framework established by the Data Retention Directive (2006/24/EC). Why is the Directive no longer part of EU law?

Which of the following is the weakest lawful basis for processing employee personal data?

An organization receives a request multiple times from a data subject seeking to exercise his rights with respect to his own personal data. Under what condition can the organizatio...

To receive a preliminary interpretation on provisions of the GDPR, a national court will refer its case to which of the following?

A grade school is planning to use facial recognition to track student attendance. Which of the following may provide a lawful basis for this processing?

SCENARIO Please use the following to answer the next question: ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platf...

SCENARIO Please use the following to answer the next question: ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platf...

SCENARIO Please use the following to answer the next question: ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platf...

Which of the following Convention 108+ principles, as amended in 2018, is NOT consistent with a principle found in the GDPR?

If a data subject puts a complaint before a DPA and receives no information about its progress or outcome, how long does the data subject have to wait before taking action in the c...

For which of the following operations would an employer most likely be justified in requesting the data subject's consent?

An entity's website stores text files on EU users' computer and mobile device browsers. Prior to doing so, the entity is required to provide users with notices containing informati...

Which of the following is NOT considered a fair processing practice in relation to the transparency principle?

Which of the following was the first to implement national law for data protection in 1973?

The GDPR forbids the practice of "forum shopping", which occurs when companies do what?

What is the most frequently used mechanism for legitimizing cross-border data transfer?

If a French controller has a car-sharing app available only in Morocco, Algeria and Tunisia, but the data processing activities are carried out by the appointed processor in Spain,...

Select the answer below that accurately completes the following: "The right to compensation and liability under the GDPR...

Pursuant to Article 4(5) of the GDPR, data is considered "pseudonymized" if?

According to Article 84 of the GDPR, the rules on penalties applicable to infringements shall be laid down by?

A company plans to transfer employee health information between two of its entities in France. To maintain the security of the processing, what would be the most important security...

If a company chooses to ground an international data transfer on the contractual route, which of the following is NOT a valid set of standard contractual clauses?

Article 58 of the GDPR describes the power of supervisory authorities. Which of the following is NOT among those granted?

According to the European Data Protection Board, which of the following concepts or practices does NOT follow from the principles relating to the processing of personal data under...

According to the GDPR, when should the processing of photographs be considered processing of special categories of personal data?

The origin of privacy as a fundamental human right can be found in which document?

Which statement provides an accurate description of a directive?

Which of the following regulates the use of electronic communications services within the European Union?

What was the main failing of Convention 108 that led to the creation of the Data Protection Directive (Directive 95/46/EC)?

SCENARIO Please use the following to answer the next question: Jane Stan's her new role as a Data Protection Officer (DPO) at a Malta-based company that allows anyone to buy and se...

SCENARIO Please use the following to answer the next question: Jane Stan's her new role as a Data Protection Officer (DPO) at a Malta-based company that allows anyone to buy and se...