CIPP/E CORE EXAM 2026 TEST QUESTIONS AND ANSWERS
SCORED A+
✔✔A processor is responsible for implementing appropriate technical and
organisational measures to keep personal data secure. True or false? - ✔✔True
✔✔A processor may process personal data only on documented instructions from the
controller. True or false? - ✔✔True
✔✔A controller must notify the supervisory authority of a personal data breach if
__________.
-A breach is likely to result in a risk to the rights and freedoms of natural persons
-A breach is likely to result in a high risk for the rights and freedoms of natural persons -
✔✔A breach likely to result in risk to the rights and freedoms of natural persons.
✔✔A controller must notify the data subjects of a personal data breach if the breach is
likely to result in a high risk to the rights and freedoms of those individuals
unless_________. Pick all that apply:
-Individual notice require disproportionate effort
-Prior implementation of appropriate technical
and organisational measures rendered the personal data unintelligible or encrypted
-Post-breach actions greatly reduce the risk to the rights and freedoms of the data
subjects. - ✔✔All
✔✔Which of the following data subject rights provides data subjects with entitlements to
certain information, obtainable from the controller upon request? Pick all that apply.
-right of access
-right of erasure
-right to object
-right to restriction of processing - ✔✔right of access
✔✔Right of access grants data subjects access to which of the following types of
information? Select all that apply.
-The means of data storage
-Retention periods
_The purpose of processing
-Locations where the date is being processed - ✔✔-The purpose of processing
-Retention periods
, -Locations where the data is being processed
✔✔The right to be forgotten is part of what data subjectc right?
-Right to data portability
-Right to erasure
-Right to restriction of processing
-Right to rectification - ✔✔Right to erasure
✔✔Which of the following is not a method listed by the GDPR as a method for
restricting processing of personal data. Select all that apply.
-Noting the restriction in the system
-Moving the data to a separate system
-Temporarily blocking a website
-Disabling the data management system - ✔✔Disabling the data management system
✔✔Which of the following are categories under which a data subject may object to
processing his or her personal data? Select all that apply.
-Establishment, exercise or defense of legal claims
-Direct marketing
-Public interest or legitimate interest
-Research or statistical purposes - ✔✔All EXCEPT Establishment, exercise or defense
of legal claims.
✔✔What is profiling?
-the processing of personal data gathered from social media sites
-a form of automated decision making
-The act of enabling cookies
-All of the above - ✔✔A form of automated decision making
✔✔True or false. Both controllers and processors have accountability obligations under
GDPR. - ✔✔True
✔✔True or false: Data protection by design begins prior to processing and incorporates
data protection considerations into the planning phase. - ✔✔True
✔✔What are the main values of data protection impact assessment (DPIA)? Select all
that apply.
-Demonstrating compliance to supervisory authorities
-Incorporating data protection consideration into organisational planning
SCORED A+
✔✔A processor is responsible for implementing appropriate technical and
organisational measures to keep personal data secure. True or false? - ✔✔True
✔✔A processor may process personal data only on documented instructions from the
controller. True or false? - ✔✔True
✔✔A controller must notify the supervisory authority of a personal data breach if
__________.
-A breach is likely to result in a risk to the rights and freedoms of natural persons
-A breach is likely to result in a high risk for the rights and freedoms of natural persons -
✔✔A breach likely to result in risk to the rights and freedoms of natural persons.
✔✔A controller must notify the data subjects of a personal data breach if the breach is
likely to result in a high risk to the rights and freedoms of those individuals
unless_________. Pick all that apply:
-Individual notice require disproportionate effort
-Prior implementation of appropriate technical
and organisational measures rendered the personal data unintelligible or encrypted
-Post-breach actions greatly reduce the risk to the rights and freedoms of the data
subjects. - ✔✔All
✔✔Which of the following data subject rights provides data subjects with entitlements to
certain information, obtainable from the controller upon request? Pick all that apply.
-right of access
-right of erasure
-right to object
-right to restriction of processing - ✔✔right of access
✔✔Right of access grants data subjects access to which of the following types of
information? Select all that apply.
-The means of data storage
-Retention periods
_The purpose of processing
-Locations where the date is being processed - ✔✔-The purpose of processing
-Retention periods
, -Locations where the data is being processed
✔✔The right to be forgotten is part of what data subjectc right?
-Right to data portability
-Right to erasure
-Right to restriction of processing
-Right to rectification - ✔✔Right to erasure
✔✔Which of the following is not a method listed by the GDPR as a method for
restricting processing of personal data. Select all that apply.
-Noting the restriction in the system
-Moving the data to a separate system
-Temporarily blocking a website
-Disabling the data management system - ✔✔Disabling the data management system
✔✔Which of the following are categories under which a data subject may object to
processing his or her personal data? Select all that apply.
-Establishment, exercise or defense of legal claims
-Direct marketing
-Public interest or legitimate interest
-Research or statistical purposes - ✔✔All EXCEPT Establishment, exercise or defense
of legal claims.
✔✔What is profiling?
-the processing of personal data gathered from social media sites
-a form of automated decision making
-The act of enabling cookies
-All of the above - ✔✔A form of automated decision making
✔✔True or false. Both controllers and processors have accountability obligations under
GDPR. - ✔✔True
✔✔True or false: Data protection by design begins prior to processing and incorporates
data protection considerations into the planning phase. - ✔✔True
✔✔What are the main values of data protection impact assessment (DPIA)? Select all
that apply.
-Demonstrating compliance to supervisory authorities
-Incorporating data protection consideration into organisational planning
