CIPP 3 UPDATED ACTUAL EXAM QUESTIONS CORRECT ANSWERS GRADED A PLUS
CIPP/E Exam 132 Questions and Answers | Complete
Review with Detailed Rationales | Grade A+
2026/2027
Question:
How many member states in the European Union?
Answer:
28 member states
Question:
What is the European Economic Area composed of?
Answer:
EU member states + Iceland + Liechtenstien + Norway
Question:
What are the key characteristics of the Data Protection Directive?
Answer:
- Places obligations on member states Is transposed into 28 national laws in the EU Differs across
member states Formed the Article 29 Working Party
Question:
In what ways is the GDPR different from the Data Protection Directive?
Answer:
The GDPR: is directly applicable and enforceable as law provides one set of data protection rules
for all allows member states a degree of tailoring forms the European Data Protection Board
(EDPB)
,Question:
What are the special categories of personal data?
Answer:
- racial origin ethic origin political opinions religious beliefs philosophical beliefs trade-union
membership genetic data biometric data health data sex life sexual orientation (- criminal
convictions and offences can only be processed by authorities with safeguards)
Question:
What is a supervisory authority?
Answer:
A Data Protection Authority (DPA) - an entity appointed to enforce privacy or data protection laws
and regulation in a particular jurisdiction.
Question:
What is the definition of data processing?
Answer:
Any operation or set of operations which is performed on personal data or on sets of personal data,
whether or not by automated means.
Question:
What are the GDPR data processing principles?
Answer:
- Lawfulness, fairness, and transparency of processing Purpose limitation Data minimization and
proportionality Data quality and accuracy Storage limitation Integrity and confidentiality
Accountability
Question:
What are the two types of scope needed for the GDPR to apply?
Answer:
, - territorial scope material scope
Question:
When is territorial scope satisfied?
Answer:
GDPR applies if a controller or processor: (1) is established in the EU, (2) offers goods or services
to EU residents, (3) monitors behavior of EU residents, (4) is outside the EU, but EU member state
law applies Companies without presence in the EU need to comply!
Question:
What is outside the material scope of the GDPR?
Answer:
- Activities outside the scope of EU law Investigating and detecting crimes Law enforcement,
national security, and defense Purely personal or household activities
Question:
What are the lawful bases for processing data?
Answer:
- Consent Contract Legal obligation Vital interests Public interest or official authority Legitimate
interests
Question:
What are the requirements for consent?
Answer:
- Freely given Clearly distinguishable Intelligible Unambiguous In clear and plain language Invalid
if clear imbalance between controller and data subject Service of contract cannot be conditional
upon consent Data subject must be informed of controller's identity Data subject must be informed
of purpose of processing Data subject must be informed of how processing may affect data subjects
Children: parent/guardian consent needed if under 16 (may be lowered by individual member states
to 13) Withdrawing consent must be as easy as giving it
CIPP/E Exam 132 Questions and Answers | Complete
Review with Detailed Rationales | Grade A+
2026/2027
Question:
How many member states in the European Union?
Answer:
28 member states
Question:
What is the European Economic Area composed of?
Answer:
EU member states + Iceland + Liechtenstien + Norway
Question:
What are the key characteristics of the Data Protection Directive?
Answer:
- Places obligations on member states Is transposed into 28 national laws in the EU Differs across
member states Formed the Article 29 Working Party
Question:
In what ways is the GDPR different from the Data Protection Directive?
Answer:
The GDPR: is directly applicable and enforceable as law provides one set of data protection rules
for all allows member states a degree of tailoring forms the European Data Protection Board
(EDPB)
,Question:
What are the special categories of personal data?
Answer:
- racial origin ethic origin political opinions religious beliefs philosophical beliefs trade-union
membership genetic data biometric data health data sex life sexual orientation (- criminal
convictions and offences can only be processed by authorities with safeguards)
Question:
What is a supervisory authority?
Answer:
A Data Protection Authority (DPA) - an entity appointed to enforce privacy or data protection laws
and regulation in a particular jurisdiction.
Question:
What is the definition of data processing?
Answer:
Any operation or set of operations which is performed on personal data or on sets of personal data,
whether or not by automated means.
Question:
What are the GDPR data processing principles?
Answer:
- Lawfulness, fairness, and transparency of processing Purpose limitation Data minimization and
proportionality Data quality and accuracy Storage limitation Integrity and confidentiality
Accountability
Question:
What are the two types of scope needed for the GDPR to apply?
Answer:
, - territorial scope material scope
Question:
When is territorial scope satisfied?
Answer:
GDPR applies if a controller or processor: (1) is established in the EU, (2) offers goods or services
to EU residents, (3) monitors behavior of EU residents, (4) is outside the EU, but EU member state
law applies Companies without presence in the EU need to comply!
Question:
What is outside the material scope of the GDPR?
Answer:
- Activities outside the scope of EU law Investigating and detecting crimes Law enforcement,
national security, and defense Purely personal or household activities
Question:
What are the lawful bases for processing data?
Answer:
- Consent Contract Legal obligation Vital interests Public interest or official authority Legitimate
interests
Question:
What are the requirements for consent?
Answer:
- Freely given Clearly distinguishable Intelligible Unambiguous In clear and plain language Invalid
if clear imbalance between controller and data subject Service of contract cannot be conditional
upon consent Data subject must be informed of controller's identity Data subject must be informed
of purpose of processing Data subject must be informed of how processing may affect data subjects
Children: parent/guardian consent needed if under 16 (may be lowered by individual member states
to 13) Withdrawing consent must be as easy as giving it
