Official Bank
0/295
Page
1/4
Certified Information Privacy Professional/Europe (CIPP/E) Exam (CIPP-E) - IAPP Exam Questions
Last updated on June 20, 2026
97%
Exam Compliance
295
Total Questions
1
Question
SCENARIO
Please use the following to answer the next question: Jane Stan's her new role as a Data Protection Officer (DPO) at a Malta-based company that allows anyone to buy and sell cryptocurrencies via its online platform. The company stores and processes the personal data of its customers in a dedicated data center located m Malta |EU). People wishing to trade cryptocurrencies are required to open an online account on the platform. They then must successfully pass a KYC due diligence procedure aimed at preventing money laundering and ensuring compliance with applicable financial regulations. The non-European customers are also required to waive all their GDPR rights by reading a disclaimer written in bold and belong a checkbox on a separate page in order to get their account approved on the platform. The customers must likewise accept the terms of service of the platform. The terms of service also include a privacy policy section, saying, among other things, that if a
What is potentially wrong with the backup system operated in the AWS cloud?
Please use the following to answer the next question: Jane Stan's her new role as a Data Protection Officer (DPO) at a Malta-based company that allows anyone to buy and sell cryptocurrencies via its online platform. The company stores and processes the personal data of its customers in a dedicated data center located m Malta |EU). People wishing to trade cryptocurrencies are required to open an online account on the platform. They then must successfully pass a KYC due diligence procedure aimed at preventing money laundering and ensuring compliance with applicable financial regulations. The non-European customers are also required to waive all their GDPR rights by reading a disclaimer written in bold and belong a checkbox on a separate page in order to get their account approved on the platform. The customers must likewise accept the terms of service of the platform. The terms of service also include a privacy policy section, saying, among other things, that if a
What is potentially wrong with the backup system operated in the AWS cloud?
Options
A
It is unlawful to process any personal data in a cloud unless the cloud is certified as GOPR- compliant by a competent supervisory authority.
B
The AWS servers are located in the EU but in a country different than the location of the corporate headquarters.
C
AWS is a U S company, and no personal data of European residents may be transferred to it without explicit written consent from data subjects.
D
The data storage period has to be revised, and a data processing agreement w*h AWS must be signed
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
2
Question
How can the relationship between the GDPR and the Digital Services Act, the Data Governance Act and the Digital Markets Act most accurately be described?
Options
A
The aforementioned legal acts apply without prejudice (i.e., in parallel) to the GDPR.
B
The aforementioned legal acts do not refer to (i.e., do not mention) the GDPR.
C
The aforementioned legal acts change specific provisions (i.e., certain articles) of the GDPR.
D
The aforementioned legal acts contain some sector-specific exemptions (i.e., only for certain businesses) from the GDPR.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
3
Question
A private company has establishments in France, Poland, the United Kingdom and, most prominently, Germany, where its headquarters is established. The company offers its services worldwide. Most of the services are designed in Germany and supported in the other establishments. However, one of the services, a Software as a Service (SaaS) application, was defined and implemented by the Polish establishment. It is also supported by the other establishments.
What is the lead supervisory authority for the SaaS service?
What is the lead supervisory authority for the SaaS service?
Options
A
The supervisory authority of Germany at regional level.
B
The supervisory authority of Germany at federal level.
C
The supervisory authority of the Republic of Poland.
D
The supervisory authority of the European Union.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
4
Question
Higher fines are assessed for GDPR violations due to which of the following?
Options
A
Violations of a data controller's obligations to obtain a child's consent
B
Failure to notify a supervisory authority and data subjects of a personal data breach
C
Failure to appoint a data protection officer.
D
Violations of a data subject"s rights
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
5
Question
SCENARIO
Please use the following to answer the next question: Zandelay Fashion (‘Zandelay’) is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company’s compliance with the General Data Protection Regulation (GDPR) and other privacy legislation. The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers. In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company’s customers by analyzing their purchases. Martin tells the CEO that: (a) the potential risks of such activities means that Zandelay needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures. Zandelay may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme. Jerry tells Martin that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Zandelay’s business plan and associated processing activities.
What must Zandelay provide to the supervisory authority during the prior consultation?
Please use the following to answer the next question: Zandelay Fashion (‘Zandelay’) is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company’s compliance with the General Data Protection Regulation (GDPR) and other privacy legislation. The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers. In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company’s customers by analyzing their purchases. Martin tells the CEO that: (a) the potential risks of such activities means that Zandelay needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures. Zandelay may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme. Jerry tells Martin that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Zandelay’s business plan and associated processing activities.
What must Zandelay provide to the supervisory authority during the prior consultation?
Options
A
An explanation of the purposes and means of the intended processing.
B
An evaluation of the complexity of the intended processing.
C
Records showing that customers have explicitly consented to the intended profiling activities.
D
Certificates that prove Martin’s professional qualities and expert knowledge of data protection law.
Discussion
(0 comments)
to join the discussion
Community Discussion
No discussions yet. Be the first to ask!
Delete Comment
Are you sure? This action cannot be undone.
Finish Practice?
Are you sure you want to finish? This will end your practice session.