CIPP/E FINAL EXAM 2026 ACTUAL QUESTIONS AND
ANSWERS SCORED A+
✔✔Cookie Directive - ✔✔An *amendment* made *to* the European Union's *Directive
2002/58*, also known as (*a.k.a*) the *ePrivacy Directive*, that *requires* organizations
to get *consent before placing* and other tracking technologies on digital devices. With
the passage of the GDPR, this definition of consent has changed and *opt-out consent
is no longer viable in this area*.
✔✔Cooperation - ✔✔Part of the *consistency mechanism* of the GDPR, this is required
between *supervisory authorities* when working with controllers or processors handling
the personal data of *data subjects in multiple member states*. This is often referred to
as (*a.k.a.* the "*one-stop shop*," whereby a lead supervisory authority works with the
supervisory authorities of other member states with affected data subjects.
✔✔Copland v. United Kingdom - ✔✔A case in which the *ECHR* (European Court of
Human Rights) held that *monitoring* an applicant's *email at work* was *contrary to
Article 8* of the *Convention on Human Rights*.
✔✔Costeja - ✔✔Shorthand for (*a.k.a.*)the case where Costeja *successfully sued
Google Spain, Google Inc. and La Vanguardia newspaper*. When the Court of Justice
of the EU ruled that Google Spain must remove the links to the article, the "*right to be
forgotten*" was effectively established in the European Union. The GDPR subsequently
more formally granted data subjects the right to deletion in certain circumstances.
✔✔Council of Europe - ✔✔The CoE, launched in *1949*, is a *human rights
organization* with *47 member* countries, including the *28 member states* of the
European Union. The members have *all signed* the *European Convention on Human
Rights and* are *subject to the ECHR* (European Court of Human Rights). The
Council's *Convention 108* was the first legally binding international agreement to
protect the human right of privacy and data protection.
✔✔Council of the European Union - ✔✔A council of ministers from the 28 member
states, this is *the main decision-making body of the EU*, with a central role in both
political and legislative decisions. The council was established by the treaties of the
1950s, which laid the foundations for the EU, and *works with* the *European
Parliament* to *create EU law*.
✔✔Cross-border Data Transfers (EU specific) - ✔✔Transfers of personal data to any
country outside the European Economic Area (EEA) may only take place subject to the
condition that the third country ensures an adequate level of protection for the personal
data as determined by the European Commission. It *also applies to onward transfers*
— from one third country or international organisation to another (outside the EEA). In
the absence of an adequacy finding, organizations must use other mechanisms, such
as binding corporate rules, contractual clauses, or certification, for lawful transfer.
,✔✔Data Breach Notification (EU specific) - ✔✔The requirement that a data controller
notify regulators, potentially within *72 hours* of discovery, and/or victims, of incidents
affecting the confidentiality and security of personal data, depending on the assessed
risks to the rights and freedoms of affected data subjects.
✔✔Data Elements - ✔✔A *unit of data* that cannot be broken down further or has a
distinct meaning. This may be a *date of birth, a numerical identifier, or location
coordinates*. In the context of data protection, it is important to understand that these in
isolation *may* not be personal data but, *when combined, become personally
identifiable* and therefore personal data.
✔✔Data Controller - ✔✔The natural or legal person, public authority, agency or any
other body which alone or jointly with others *determines the purposes and means* of
the processing of personal data. Where the purposes and means of such processing
are determined by EU or member state law, this or the specific criteria for its nomination
may be provided for by EU or member state law.
✔✔Data Portability - ✔✔In certain circumstances, generally where data processing is
done on the basis of consent or a contract, data subjects have the right to receive their
personal data, which they have provided to a controller, in a *structured, commonly
used and machine-readable format* and have the right to transmit that data to another
controller without hindrance from the controller to which the personal data has been
provided.
✔✔Data Processor - ✔✔A natural or legal person (*other than an employee* of the
controller), public authority, agency or other body which *processes personal data on
behalf of the controller*. An organization can be both a controller and a processor at the
same time, depending on the function the organization is performing.
✔✔Data Protection Authority (EU specific) - ✔✔A term often used to refer to a
*supervisory authority*
✔✔Data Protection by Default - ✔✔The implementation of appropriate *technical and
organisational* measures for ensuring *that, by default, only* personal *data* which are
*necessary for each specific purpose* of the processing *are processed*. That
obligation *applies to* the *amount* of personal data collected, the *extent* of their
processing, the *period* of their storage and their *accessibility*. In particular, such
measures shall ensure that by default personal data are *not made accessible* without
the individual's intervention *to an indefinite number* of natural persons. Such
organizational *measures could consist*, inter alia, *of minimising* the processing of
personal data, *pseudonymising* personal data as soon as possible, *transparency*
with regard to the functions and processing of personal data, *and enabling the data
subject to monitor* the data processing.
, ✔✔Data Protection by Design - ✔✔When developing, designing, selecting and using
applications, services and products that are based on the processing of personal data
or process personal data to fulfil their task, producers of the products, services and
applications should be encouraged to *take into account the right to data protection
when developing and designing* such *products, services and applications* and, *with
due regard to* the *state of the art*, to make sure that controllers and processors are
able to fulfil their data protection obligations.
✔✔Data Protection Commissioner - ✔✔The *title* given in *some member states* to the
*supervisory authority*
✔✔EU Data Protection Directive (*95/46/EC*) - ✔✔Was replaced by the GDPR in 2018.
The Directive was adopted in 1995, became effective in 1998 and was the *first EU-
wide legislation that protected individuals' privacy* and personal data use.
✔✔Data Protection Impact Assessment - ✔✔The process by which companies can
*systematically assess and identify* the *privacy* and data protection *impacts of* any
*products* they offer *and services* they provide. It enables them to *identify the
impact* and *take* the *appropriate actions* to prevent or, at the very least, *minimise
the risk* of those impacts. *are required* by the General Data Protection Regulation in
some instances, particularly *where a* new *product or service is likely to result in a
high risk* to the rights and freedoms of natural persons.
✔✔Data Protection Officer - ✔✔While the title has long been in use, particularly in
Germany and France, the GDPR introduced a *new legal definition of this with specific
tasks*. Certain *organizations*, particularly those *that process personal data as part of
their business model or* those who *process special categories* of data as outlined in
Article 9, *are obligated to designate one* on the basis of *professional qualities* and, in
particular, *expert knowledge* of data protection law and practices. Has a variety of
*mandated tasks, including communication with* the *supervisory authority*,
*conducting DPIAs*, and *advising the organization on* the mandates of the *GDPR*
and how to comply with it.
✔✔Data Protection Policy - ✔✔Outline the basic contours of the measures an
organization takes in the processing and handling of personal data. Key matters the
*policy should address* include: *Scope*, which explains both to whom the internal
policy applies and the type of processing activities it covers; *Policy statement*;
*Employee responsibilities*; *Management responsibilities*; *Reporting incidents*;
*Policy compliance*.
✔✔Data Protection Principles - ✔✔Article 5 of the GDPR lists: *L*awfulness, fairness
and transparency; *P*urpose limitation; *D*ata minimisation; *A*ccuracy; *S*torage
limitation; *I*ntegrity and confidentiality. *LPD ASI*
ANSWERS SCORED A+
✔✔Cookie Directive - ✔✔An *amendment* made *to* the European Union's *Directive
2002/58*, also known as (*a.k.a*) the *ePrivacy Directive*, that *requires* organizations
to get *consent before placing* and other tracking technologies on digital devices. With
the passage of the GDPR, this definition of consent has changed and *opt-out consent
is no longer viable in this area*.
✔✔Cooperation - ✔✔Part of the *consistency mechanism* of the GDPR, this is required
between *supervisory authorities* when working with controllers or processors handling
the personal data of *data subjects in multiple member states*. This is often referred to
as (*a.k.a.* the "*one-stop shop*," whereby a lead supervisory authority works with the
supervisory authorities of other member states with affected data subjects.
✔✔Copland v. United Kingdom - ✔✔A case in which the *ECHR* (European Court of
Human Rights) held that *monitoring* an applicant's *email at work* was *contrary to
Article 8* of the *Convention on Human Rights*.
✔✔Costeja - ✔✔Shorthand for (*a.k.a.*)the case where Costeja *successfully sued
Google Spain, Google Inc. and La Vanguardia newspaper*. When the Court of Justice
of the EU ruled that Google Spain must remove the links to the article, the "*right to be
forgotten*" was effectively established in the European Union. The GDPR subsequently
more formally granted data subjects the right to deletion in certain circumstances.
✔✔Council of Europe - ✔✔The CoE, launched in *1949*, is a *human rights
organization* with *47 member* countries, including the *28 member states* of the
European Union. The members have *all signed* the *European Convention on Human
Rights and* are *subject to the ECHR* (European Court of Human Rights). The
Council's *Convention 108* was the first legally binding international agreement to
protect the human right of privacy and data protection.
✔✔Council of the European Union - ✔✔A council of ministers from the 28 member
states, this is *the main decision-making body of the EU*, with a central role in both
political and legislative decisions. The council was established by the treaties of the
1950s, which laid the foundations for the EU, and *works with* the *European
Parliament* to *create EU law*.
✔✔Cross-border Data Transfers (EU specific) - ✔✔Transfers of personal data to any
country outside the European Economic Area (EEA) may only take place subject to the
condition that the third country ensures an adequate level of protection for the personal
data as determined by the European Commission. It *also applies to onward transfers*
— from one third country or international organisation to another (outside the EEA). In
the absence of an adequacy finding, organizations must use other mechanisms, such
as binding corporate rules, contractual clauses, or certification, for lawful transfer.
,✔✔Data Breach Notification (EU specific) - ✔✔The requirement that a data controller
notify regulators, potentially within *72 hours* of discovery, and/or victims, of incidents
affecting the confidentiality and security of personal data, depending on the assessed
risks to the rights and freedoms of affected data subjects.
✔✔Data Elements - ✔✔A *unit of data* that cannot be broken down further or has a
distinct meaning. This may be a *date of birth, a numerical identifier, or location
coordinates*. In the context of data protection, it is important to understand that these in
isolation *may* not be personal data but, *when combined, become personally
identifiable* and therefore personal data.
✔✔Data Controller - ✔✔The natural or legal person, public authority, agency or any
other body which alone or jointly with others *determines the purposes and means* of
the processing of personal data. Where the purposes and means of such processing
are determined by EU or member state law, this or the specific criteria for its nomination
may be provided for by EU or member state law.
✔✔Data Portability - ✔✔In certain circumstances, generally where data processing is
done on the basis of consent or a contract, data subjects have the right to receive their
personal data, which they have provided to a controller, in a *structured, commonly
used and machine-readable format* and have the right to transmit that data to another
controller without hindrance from the controller to which the personal data has been
provided.
✔✔Data Processor - ✔✔A natural or legal person (*other than an employee* of the
controller), public authority, agency or other body which *processes personal data on
behalf of the controller*. An organization can be both a controller and a processor at the
same time, depending on the function the organization is performing.
✔✔Data Protection Authority (EU specific) - ✔✔A term often used to refer to a
*supervisory authority*
✔✔Data Protection by Default - ✔✔The implementation of appropriate *technical and
organisational* measures for ensuring *that, by default, only* personal *data* which are
*necessary for each specific purpose* of the processing *are processed*. That
obligation *applies to* the *amount* of personal data collected, the *extent* of their
processing, the *period* of their storage and their *accessibility*. In particular, such
measures shall ensure that by default personal data are *not made accessible* without
the individual's intervention *to an indefinite number* of natural persons. Such
organizational *measures could consist*, inter alia, *of minimising* the processing of
personal data, *pseudonymising* personal data as soon as possible, *transparency*
with regard to the functions and processing of personal data, *and enabling the data
subject to monitor* the data processing.
, ✔✔Data Protection by Design - ✔✔When developing, designing, selecting and using
applications, services and products that are based on the processing of personal data
or process personal data to fulfil their task, producers of the products, services and
applications should be encouraged to *take into account the right to data protection
when developing and designing* such *products, services and applications* and, *with
due regard to* the *state of the art*, to make sure that controllers and processors are
able to fulfil their data protection obligations.
✔✔Data Protection Commissioner - ✔✔The *title* given in *some member states* to the
*supervisory authority*
✔✔EU Data Protection Directive (*95/46/EC*) - ✔✔Was replaced by the GDPR in 2018.
The Directive was adopted in 1995, became effective in 1998 and was the *first EU-
wide legislation that protected individuals' privacy* and personal data use.
✔✔Data Protection Impact Assessment - ✔✔The process by which companies can
*systematically assess and identify* the *privacy* and data protection *impacts of* any
*products* they offer *and services* they provide. It enables them to *identify the
impact* and *take* the *appropriate actions* to prevent or, at the very least, *minimise
the risk* of those impacts. *are required* by the General Data Protection Regulation in
some instances, particularly *where a* new *product or service is likely to result in a
high risk* to the rights and freedoms of natural persons.
✔✔Data Protection Officer - ✔✔While the title has long been in use, particularly in
Germany and France, the GDPR introduced a *new legal definition of this with specific
tasks*. Certain *organizations*, particularly those *that process personal data as part of
their business model or* those who *process special categories* of data as outlined in
Article 9, *are obligated to designate one* on the basis of *professional qualities* and, in
particular, *expert knowledge* of data protection law and practices. Has a variety of
*mandated tasks, including communication with* the *supervisory authority*,
*conducting DPIAs*, and *advising the organization on* the mandates of the *GDPR*
and how to comply with it.
✔✔Data Protection Policy - ✔✔Outline the basic contours of the measures an
organization takes in the processing and handling of personal data. Key matters the
*policy should address* include: *Scope*, which explains both to whom the internal
policy applies and the type of processing activities it covers; *Policy statement*;
*Employee responsibilities*; *Management responsibilities*; *Reporting incidents*;
*Policy compliance*.
✔✔Data Protection Principles - ✔✔Article 5 of the GDPR lists: *L*awfulness, fairness
and transparency; *P*urpose limitation; *D*ata minimisation; *A*ccuracy; *S*torage
limitation; *I*ntegrity and confidentiality. *LPD ASI*
