DON'T WANT TO MISS A THING?

Certification Exam Passing Tips

Latest exam news and discount info

Curated and up-to-date by our experts

Yes, send me the newsletter

CIPP Exam Questions & Mock Exams, Certified International Purchasing Professional | SPOTO

Prepare effectively for your CIPP Exam with SPOTO's comprehensive resources, including Exam Questions & Mock Exams. Our diverse range of study materials encompasses practice tests, free tests, online exam questions, sample questions, and exam dumps tailored to enhance your exam preparation experience. With our meticulously crafted mock exams, you can simulate the exam environment and assess your readiness with precision. The Certified Information Privacy Professional/Europe (CIPP/E) certification requires a deep understanding of European privacy laws, regulations, and the intricate legal requirements governing the transfer of sensitive personal data across borders. SPOTO's exam materials are designed to equip you with the knowledge and skills necessary to excel in this certification. Utilize our latest practice tests to reinforce your learning and increase your chances of successfully passing the certification exam. Trust SPOTO as your reliable partner in achieving your goal of becoming a Certified International Purchasing Professional.

Take other online exams
Question #1
To provide evidence of GDPR compliance, a company performs an internal audit. As a result, it finds a data base, password-protected, listing all the social network followers of the client. Regarding the domain of the controller-processor relationships, how is this situation considered?
A. Compliant with the security principle, because the data base is password-protected
B. Non-compliant, because the storage of the data exceeds the tasks contractually authorized by the controller
C. Not applicable, because the data base is password protected, and therefore is not at risk of identifying any data subject
D. Compliant with the storage limitation principle, so long as the internal auditor permanently deletes the data base
View answer
Correct Answer: B
Question #2
SCENARIO Please use the following to answer the next question: ABC Hotel Chain and XYZ Travel Agency are U.S.-based multinational companies. They use an internet-based common platform for collecting and sharing their customer data with each other, in order to integrate their marketing efforts. Additionally, they agree on the data to be stored, how reservations will be booked and confirmed, and who has access to the stored data. Mike, an EU resident, has booked travel itineraries in the past through XYZ Trav
A. The request is to obtain access and correct inaccurate personal data in his profile
B. The request is to obtain access and information about the purpose of processing his personal data
C. The request is to obtain access and erasure of his personal data while keeping his rewards membership
D. The request is to obtain access and the categories of recipients who have received his personal data to process his rewards membership
View answer
Correct Answer: D
Question #3
Please use the following to answer the next question: WonderkKids provides an online booking service for childcare. Wonderkids is based in France, but hosts its website through a company in Switzerland. As part of their service, WonderKids will pass all personal data provided to them to the childcare provider booked through their system. The type of personal data collected on the website includes the name of the person booking the childcare, address and contact details, as well as information about the chil
A. No marketing information at all
B. Any marketing information at all
C. Marketing information related to other business operations of WonderKids
D. Marketing information for products or services similar to those purchased from WonderKids
View answer
Correct Answer: C
Question #4
SCENARIO Please use the following to answer the next question: Liem, an online retailer known for its environmentally friendly shoes, has recently expanded its presence in Europe. Anxious to achieve market dominance, Liem teamed up with another eco friendly company, EcoMick, which sells accessories like belts and bags. Together the companies drew up a series of marketing campaigns designed to highlight the environmental and economic benefits of their products. After months of planning, Liem and EcoMick ente
A. Processing the personal data upon documented instructions regarding data transfers outside of the EEA
B. Notification regarding third party requests for access to Liem and EcoMick’s personal data
C. Assistance to Liem and EcoMick in their compliance with data protection impact assessments
D. Returning or deleting personal data after the end of the provision of the services
View answer
Correct Answer: A
Question #5
What is the consequence if a processor makes an independent decision regarding the purposes and means of processing it carries out on behalf of a controller?
A. The controller will be liable to pay an administrative fine
B. The processor will be liable to pay compensation to affected data subjects
C. The processor will be considered to be a controller in respect of the processing concerned
D. The controller will be required to demonstrate that the unauthorized processing negatively affected oneor more of the parties involved
View answer
Correct Answer: B
Question #6
Many businesses print their employees’ photographs on building passes, so that employees can be identified by security staff. This is notwithstanding the fact that facial images potentially qualify as biometric data under the GDPR. Why would such practice be permitted?
A. Because use of biometric data to confirm the unique identification of data subjects benefits from an exemption
B. Because photographs qualify as biometric data only when they undergo a “specific technical processing”
C. Because employees are deemed to have given their explicit consent when they agree to be photographed by their employer
D. Because photographic ID is a physical security measure which is “necessary for reasons of substantial public interest”
View answer
Correct Answer: A
Question #7
With the issue of consent, the GDPR allows member states some choice regarding what?
A. The mechanisms through which consent may be communicated
B. The circumstances in which silence or inactivity may constitute consent
C. The age at which children must be required to obtain parental consent
D. The timeframe in which data subjects are allowed to withdraw their consent
View answer
Correct Answer: C
Question #8
An unforeseen power outage results in company Z’s lack of access to customer data for six hours. According to article 32 of the GDPR, this is considered a breach. Based on the WP 29’s February, 2018 guidance, company Z should do which of the following?
A. Notify affected individuals that their data was unavailable for a period of time
B. Document the loss of availability to demonstrate accountability
C. Notify the supervisory authority about the loss of availability
D. Conduct a thorough audit of all security systems
View answer
Correct Answer: A
Question #9
Article 5(1)(b) of the GDPR states that personal data must be “collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.” Based on Article 5(1)(b), what is the impact of a member state’s interpretation of the word “incompatible”?
A. It dictates the level of security a processor must follow when using and storing personal data for two different purposes
B. It guides the courts on the severity of the consequences for those who are convicted of the intentional misuse of personal data
C. It sets the standard for the level of detail a controller must record when documenting the purpose for collecting personal data
D. It indicates the degree of flexibility a controller has in using personal data in ways that may vary from its original intended purpose
View answer
Correct Answer: A
Question #10
A worker in a European Union (EU) member state has ceased his employment with a company. What should the employer most likely do in regard to the worker’s personal data?
A. Destroy sensitive information and store the rest per applicable data protection rules
B. Store all of the data in case the departing worker makes a subject access request
C. Securely store the data that is required to be kept under local law
D. Provide the employee the reasons for retaining the data
View answer
Correct Answer: A
Question #11
What obligation does a data controller or processor have after appointing a data protection officer?
A. To ensure that the data protection officer receives sufficient instructions regarding the exercise of his or her defined tasks
B. To provide resources necessary to carry out the defined tasks of the data protection officer and to maintain his or her expert knowledge
C. To ensure that the data protection officer acts as the sole point of contact for individuals’ Questions: about their personal data
D. To submit for approval to the data protection officer a code of conduct to govern organizational practices and demonstrate compliance with data protection principles
View answer
Correct Answer: D
Question #12
Which of the following was the first legally binding international instrument in the area of data protection?
A. Convention 108
B. General Data Protection Regulation
C. Universal Declaration of Human Rights
D. EU Directive on Privacy and Electronic Communications
View answer
Correct Answer: B
Question #13
SCENARIO Please use the following to answer the next question: Brady is a computer programmer based in New Zealand who has been running his own business for two years. Brady’s business provides a low-cost suite of services to customers throughout the European Economic Area (EEA). The services are targeted towards new and aspiring small business owners. Brady’s company, called Brady Box, provides web page design services, a Social Networking Service (SNS) and consulting services that help people manage their
A. The data is sensitive
B. The data is uncategorized
C. The data is being used for a new purpose
D. The data is being processed via a new means
View answer
Correct Answer: D
Question #14
Which aspect of the GDPR will likely have the most impact on the consistent implementation of data protection laws throughout the European Union?
A. That it essentially functions as a one-stop shop mechanism
B. That it takes the form of a Regulation as opposed to a Directive
C. That it makes notification of large-scale data breaches mandatory
D. That it makes appointment of a data protection officer mandatory
View answer
Correct Answer: D
Question #15
Why is advisable to avoid consent as a legal basis for an employer to process employee data?
A. Employee data can only be processed if there is an approval from the data protection officer
B. Consent may not be valid if the employee feels compelled to provide it
C. An employer might have difficulty obtaining consent from every employee
D. Data protection laws do not apply to processing of employee data
View answer
Correct Answer: A
Question #16
When hiring a data processor, which action would a data controller NOT be able to depend upon to avoid liability in the event of a security breach?
A. Documenting due diligence steps taken in the pre-contractual stage
B. Conducting a risk assessment to analyze possible outsourcing threats
C. Requiring that the processor directly notify the appropriate supervisory authority
D. Maintaining evidence that the processor was the best possible market choice available
View answer
Correct Answer: A
Question #17
Assuming that the “without undue delay” provision is followed, what is the time limit for complying with a data access request?
A. Within 40 days of receipt
B. Within 40 days of receipt, which may be extended by up to 40 additional days
C. Within one month of receipt, which may be extended by up to an additional month
D. Within one month of receipt, which may be extended by an additional two months
View answer
Correct Answer: C
Question #18
SCENARIO Please use the following to answer the next question: Zandelay Fashion (‘Zandelay’) is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company’s compliance with the General Data Protection Regulation (GDPR) and other privacy legislation. The company offers both male and female clothing lines across all age demographics, including childr
A. Information about DPIAs found in Articles 38 through 40 of the GDPR
B. Data breach documentation that data controllers are required to maintain
C. Existing DPIA guides published by local supervisory authorities
D. Records of processing activities that data controllers are required to maintain
View answer
Correct Answer: B
Question #19
A Spanish electricity customer calls her local supplier with Questions: about the company’s upcoming merger. Specifically, the customer wants to know the recipients to whom her personal data will be disclosed once the merger is final. According to Article 13 of the GDPR, what must the company do before providing the customer with the requested information?
A. Verify that the request is applicable to the data collected before the GDPR entered into force
B. Verify that the purpose of the request from the customer is in line with the GDPR
C. Verify that the personal data has not already been sent to the customer
D. Verify that the identity of the customer can be proven by other means
View answer
Correct Answer: C

View Answers after Submission

Please submit your email and WhatsApp to get the answers of questions.

Note: Please make sure your email ID and Whatsapp are valid so that you can get the correct exam results.

Email:
Whatsapp/phone number:


Copyright © 2024. Designer by SPOTO Official Website. All Rights Reserved.