Free IAPP CIPP-E Exam Questions

Become IAPP Certified with updated CIPP-E exam questions and correct answers

Page: 1 / 64

Total 320 Questions | Updated On: Apr 29, 2026

Add To Cart

Question 1

The European Parliament jointly exercises legislative and budgetary functions with which of the following?

A : European Commission

B : Article 29 Working Party.

C : Council of the European Union

D : European Data Protection Board.

Answer: C

Question 2

The GDPR requires controllers to supply data subjects with detailed information about the processing of their data. Where a controller obtains data directly from data subjects, which of the following items of information does NOT legally have to be supplied?

A : recipients or categories of recipients.

B : categories of personal data concerned.

C : rights of access, erasure, restriction, and portability.

D : right to lodge a complaint with a supervisory authority.

Answer: B

Question 3

Bioface is a company based in the United States. It has no servers, personnel or assets in the European Union. By collecting photographs from social media and other web-based services, such as newspapers and blogs, it uses machine learning to develop a facial recognition algorithm. The algorithm identifies individuals in photographs who are not in its data set based the algorithm and its existing data.

The service collects photographs of data subjects in the European Union and will identify them if presented with their photographs. Bioface offers its service to government agencies and companies in the United States and Canada, but not to those in the European Union. Bioface does not offer the service to individuals.

Why is Bioface subject to the territorial scope of the General Data Protection Regulation?

A : collects data from European Union websites, which constitutes an establishment in the European Union.

B : offers services in the European Union by identifying data subjects in the European Union

C : collects data from subjects and uses it for automated processing.

D : It monitors the behavior of data subjects in the European Union.

Answer: A

Question 4

What is the primary purpose of Convention 108+, which amends the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data?

A : To issue updated guidelines for data transfers from the EU to third-country signatories to the Convention.

B : To modify the process for third countries to obtain an adequacy decision from the European Commission.

C : To strengthen data protection in line with the European and international regulatory framework.

D : To establish new data subject rights and safeguards for consumers in the EU member states.

Answer: C

Question 5

Through a combination of hardware failure and human error, the decryption key for a bank’s customer account transaction database has been lost. An investigation has determined that this was not the result of hacking or malfeasance, simply an unfortunate combination of circumstances. Which of the following accurately indicates the nature of this incident?

A : A data breach has not occurred because the loss was not the result of hacking.

B : A data breach has not occurred because no data was exposed to any unauthorized individual.

C : A data breach has occurred because the loss of the key has resulted in the data no longer being accessible.

D : A data breach has occurred because the loss of the key has resulted in the loss of confidentiality or integrity of the data.

Answer: D

Page: 1 / 64

Total 320 Questions | Updated On: Apr 29, 2026

Add To Cart