Free IAPP CIPP-E Practice Exam Questions and Answers 2026

Start Learning with the Newest and 100% Free CIPP-E Exam Dumps Questions

Page: 1 / 64

Total 320 Questions | Updated On: Apr 02, 2026

Add To Cart

Question 1

Under the GDPR, which essential pieces of information must be provided to data subjects before collecting their personal data?

A : The authority by which the controller is collecting the data and the third parties to whom the data will be sent.

B : The name/s of relevant government agencies involved and the steps needed for revising the data.

C : The identity and contact details of the controller and the reasons the data is being collected.

D : The contact information of the controller and a description of the retention policy.

Answer: C

Question 2

What is an important difference between the European Court of Human Rights (ECHR) and the Court of Justice of the European Union (CJEU) in relation to their roles and functions?

A : ECHR can rule on issues concerning privacy as a fundamental right, while the CJEU cannot.

B : CJEU can force national governments to implement and honor EU law, while the ECHR cannot.

C : CJEU can hear appeals on human rights decisions made by national courts, while the ECHR cannot.

D : ECHR can enforce human rights laws against governments that fail to implement them, while the CJEU cannot.

Answer: B

Question 3

When hiring a data processor, which action would a data controller NOT be able to depend upon to avoid liability in the event of a security breach?

A : Documenting due diligence steps taken in the pre-contractual stage.

B : Conducting a risk assessment to analyze possible outsourcing threats.

C : Requiring that the processor directly notify the appropriate supervisory authority.

D : Maintaining evidence that the processor was the best possible market choice available.

Answer: A

Question 4

Which failing of Privacy Shield, cited by the CJEU as a reason for its invalidation, is the Trans-Atlantic Data Privacy Framework intended to address?

A : Data Subject Rights.

B : Right of Action.

C : Necessity.

D : Consent.

Answer: B

Question 5

When assessing the level of risk created by a data breach, which of the following would NOT have to be taken into consideration?

A : The ease of identification of individuals.

B : The size of any data processor involved.

C : The special characteristics of the data controller.

D : The nature, sensitivity and volume of personal data.

Answer: B

Page: 1 / 64

Total 320 Questions | Updated On: Apr 02, 2026

Add To Cart