1 | Page
CIPM Questions and Answers
What are the 5 phases of a privacy program audit
Ans: Planning, Preparation, Audit, Report, Followup
What happens during the audit planning phase of PPARF?
Ans: Risk assessment, schedule, selecting auditor, pre-audit
questionnaire, preparatory meeting/visit and checklist
What happens during the Audit Preparation phase of PPARF?
Ans: Confirm schedule, confirm and prepare checklists, sampling
criteria and audit plan
What Happens during the Audit phase of PPARF?
Ans: Meeting and audit execution
What happens during the report phase of PPARF?
Ans: Noncompliance records and categories (major/minor), audit report,
closing meeting and distribution
What happens during the followup phase of PPARF?
Ans: Confirm scope, schedule, methodology and closure
What are the three types of privacy governance models? (privacy
governance may be "___, _____, or ______."
Ans: Centralized, Localized, or Hybrid
When creating your privacy office governance model, you should
consider what 4 factors?
© 2025 All rights reserved
, 2 | Page
Ans: 1. existing organisational structure,
2. position and authority of the privacy team,
3. involvement level of senior leadership and internal stakeholder
4. The development of internal partnerships.
What are the advantages/disadvantages of the hybrid governance
model?
Ans: Advantage: Resources of larger centralized org
Disadvantage: Decentralized decision making provides less big picture
vision
What are the 5 maturity levels of the GAPP Privacy Maturity
Model?
Ans: 1. Ad Hoc
2. Repeatable
3. Defined
4. Managed
5. Optimized (ARDMO)
What are the 5 mechanisms that allow organizations to transfer
data across borders? (there is something else you must also have)
© 2025 All rights reserved
, 3 | Page
Ans: 1. Adequacy Decisions
2. Ad Hoc Contracts
3. Standard Contractual Clauses
4.Binding Corporate Rules
5. Codes of Conduct/Self Certification Mechanisms
(You must also have legal basis for processing data in addition to any of
these prior to transfer)
What are the 5 useful stages of the effective Policy Lifecycle?
Ans: 1. Draft practical polices, working with legal, to draft aligned and
consistent policies.
2. Get approval from decision makers/stakeholders
3. Disseminate to all employees
4. Train and enforce policies
5. Review and revise policies (like after a breach or incident, or merger)
Describe the 5 GAPP program maturity levels in order
© 2025 All rights reserved
, 4 | Page
Ans: 1. Ad Hoc - Process & Procedures: Informal, Incomplete,
Inconsistently applied
2. Repeatable - Process & procedures: Not fully complete / Do not cover
all relevant aspects
3. Defined - Process & procedures: Fully Documented, implemented,
cover all relevant aspects
4. Managed - Reviews conducted to assess effectiveness of controls in
place
5. Optimized - Regular Reviews / Feedback are used to ensure continual
improvement toward optimisation of a given process
Describe Adequacy Decisions
Ans: "Adequacy" means that one country (or jurisdiction, such as the EU)
has deemed another country's data protection laws "adequate" to
safeguard its own data.
Describe Ad Hoc Contracts
Ans: Ad hoc contractual clauses may also be used for GDPR compliance,
although they must receive prior supervisory authority approval and
thus are potentially a less attractive option for controllers.
Describe Standard Contractual Clauses
Ans: A standard contractual clause (language written into a contract)
may be a way for organisations to facilitate cross-border transfers
(these have been challenged recently and decisions are pending in the
EUCJ)
Describe Binding Corporate Rules & the 5 things they must
include:
© 2025 All rights reserved
CIPM Questions and Answers
What are the 5 phases of a privacy program audit
Ans: Planning, Preparation, Audit, Report, Followup
What happens during the audit planning phase of PPARF?
Ans: Risk assessment, schedule, selecting auditor, pre-audit
questionnaire, preparatory meeting/visit and checklist
What happens during the Audit Preparation phase of PPARF?
Ans: Confirm schedule, confirm and prepare checklists, sampling
criteria and audit plan
What Happens during the Audit phase of PPARF?
Ans: Meeting and audit execution
What happens during the report phase of PPARF?
Ans: Noncompliance records and categories (major/minor), audit report,
closing meeting and distribution
What happens during the followup phase of PPARF?
Ans: Confirm scope, schedule, methodology and closure
What are the three types of privacy governance models? (privacy
governance may be "___, _____, or ______."
Ans: Centralized, Localized, or Hybrid
When creating your privacy office governance model, you should
consider what 4 factors?
© 2025 All rights reserved
, 2 | Page
Ans: 1. existing organisational structure,
2. position and authority of the privacy team,
3. involvement level of senior leadership and internal stakeholder
4. The development of internal partnerships.
What are the advantages/disadvantages of the hybrid governance
model?
Ans: Advantage: Resources of larger centralized org
Disadvantage: Decentralized decision making provides less big picture
vision
What are the 5 maturity levels of the GAPP Privacy Maturity
Model?
Ans: 1. Ad Hoc
2. Repeatable
3. Defined
4. Managed
5. Optimized (ARDMO)
What are the 5 mechanisms that allow organizations to transfer
data across borders? (there is something else you must also have)
© 2025 All rights reserved
, 3 | Page
Ans: 1. Adequacy Decisions
2. Ad Hoc Contracts
3. Standard Contractual Clauses
4.Binding Corporate Rules
5. Codes of Conduct/Self Certification Mechanisms
(You must also have legal basis for processing data in addition to any of
these prior to transfer)
What are the 5 useful stages of the effective Policy Lifecycle?
Ans: 1. Draft practical polices, working with legal, to draft aligned and
consistent policies.
2. Get approval from decision makers/stakeholders
3. Disseminate to all employees
4. Train and enforce policies
5. Review and revise policies (like after a breach or incident, or merger)
Describe the 5 GAPP program maturity levels in order
© 2025 All rights reserved
, 4 | Page
Ans: 1. Ad Hoc - Process & Procedures: Informal, Incomplete,
Inconsistently applied
2. Repeatable - Process & procedures: Not fully complete / Do not cover
all relevant aspects
3. Defined - Process & procedures: Fully Documented, implemented,
cover all relevant aspects
4. Managed - Reviews conducted to assess effectiveness of controls in
place
5. Optimized - Regular Reviews / Feedback are used to ensure continual
improvement toward optimisation of a given process
Describe Adequacy Decisions
Ans: "Adequacy" means that one country (or jurisdiction, such as the EU)
has deemed another country's data protection laws "adequate" to
safeguard its own data.
Describe Ad Hoc Contracts
Ans: Ad hoc contractual clauses may also be used for GDPR compliance,
although they must receive prior supervisory authority approval and
thus are potentially a less attractive option for controllers.
Describe Standard Contractual Clauses
Ans: A standard contractual clause (language written into a contract)
may be a way for organisations to facilitate cross-border transfers
(these have been challenged recently and decisions are pending in the
EUCJ)
Describe Binding Corporate Rules & the 5 things they must
include:
© 2025 All rights reserved
