1|Page
FULL CIPP/E EXAM 2026-COMPLETE
EXAM SET WITH QUESTIONS AND
VERIFIED ANSWERS
Biometrics - correct-answer -Data concerning the *intrinsic physical or behavioral
characteristics* of an individual. Examples include *DNA, fingerprints, retina and
iris patterns, voice, face, handwriting, keystroke technique* and *gait*. The GDPR,
in Article 9, lists these for the purpose of uniquely identifying a natural person as a
special category of data for which processing is not allowed other than in specific
circumstances.
Bodily Privacy - correct-answer -One of the four classes of privacy, along with
information privacy, territorial privacy and communications privacy. It focuses on a
person's physical being and any invasion thereof. Such an invasion can take the
form of *genetic testing, drug testing* or *body cavity searches*.
Breach Disclosure (EU specific) - correct-answer -The requirement that a data
controller *notify regulators*, potentially within *72 hours* of discovery, and/or
victims, of incidents affecting the confidentiality and security of personal data,
depending on the assessed risks to the rights and freedoms of affected data
subjects.
,2|Page
Bundesdatenschutzgesetz-neu - correct-answer -*Germany's federal data
protection act*, implementing the GDPR. With the passage of the GDPR, it
replaced a previous law with the same name and enhanced a series of other acts
mainly in areas of law enforcement and intelligence services. Furthermore, the
*new version suggests a procedure* for national data protection authorities *to
challenge adequacy decisions* of the EU Commission.
CCTV - correct-answer -Has come to be shorthand for any video surveillance
system. *Originally*, such systems relied on coaxial cable and was truly *only
accessible on premise*. *Today*, most surveillance systems are *hosted via
TCP/IP networks* and can be *accessed remotely*, and the footage much more
*easily shared*, eliciting new and different privacy concerns.
Certification Mechanisms - correct-answer -Introduced by the GDPR, a *new valid
adequacy mechanism for* the *transfer* of personal data outside of the
European Union *in* the *absence of an adequacy decision* and instead of other
mechanisms such as binding corporate rules or contractual clauses. These *must
be developed by certifying bodies*, *approved by data protection authorities or
the EDPB* (European Data Protection Board), *and* have *a methodology for
auditing* compliance. Similar to binding corporate rules, they compel
organizations to be able to demonstrate their compliance with all aspects of
applicable data protection legislation.
,3|Page
Charter of Fundamental Rights - correct-answer -A treaty that consolidates human
rights within the EU. The treaty states that *everyone has a right to protect their
personal data*, that *data must be processed for legitimate and specified
purposes* and that *compliance is subject to control by an authority*.
Choice - correct-answer -In the context of consent, this refers to the idea that
consent must be freely given and that data subjects must have a *genuine
____________* as to whether to provide personal data or not. If this is not truly
given it is unlikely the consent will be deemed valid under the GDPR.
Cloud Computing - correct-answer -The provision of information technology
services over the Internet. These services may be provided by a company for its
internal users in private or by third-party suppliers. The *services can include
software, infrastructure (i.e., servers), hosting and platforms (i.e., operating
systems)*. Has numerous applications, from personal webmail to corporate data
storage, and can be subdivided into different types of service models.
Codes of Conduct - correct-answer -Introduced by the GDPR, these are a new
valid adequacy mechanism for the transfer of personal data outside of the
European Union in the absence of an adequacy decision and instead of other
mechanisms such as binding corporate rules or contractual clauses. these must be
*developed by industry trade groups, associations or other bodies* representing
categories of controllers or processors. They *must be approved by supervisory
authorities or the European Data Protection Board*, and have a methodology for
auditing compliance. Similar to binding corporate rules, they compel organizations
, 4|Page
to be able to demonstrate their compliance with all aspects of applicable data
protection legislation.
Collection Limitation - correct-answer -A *fair information practices* principle, it
is the principle stating *there should be limits to* the *collection* of personal
data, that any such *data should be obtained by lawful and fair means and*,
where appropriate, *with* the knowledge or consent* of the data subject.
Communications Privacy - correct-answer -One of the four classes of privacy,
along with information privacy, bodily privacy and territorial privacy. It
encompasses protection of the means of correspondence, including *postal mail,
telephone conversations, electronic e-mail* and *other forms of communicative
behavior and apparatus*.
Confidentiality - correct-answer -Data is this if it is *protected against
unauthorised or unlawful* processing. The GDPR requires that an organization be
able to ensure the ongoing confidentiality, integrity, availability and resilience of
processing systems and services as part of its requirements for appropriate
security. In addition, the GDPR requires that *persons authorised to process* the
personal data *have committed* themselves *to confidentiality* or are under an
appropriate statutory obligation of this.
Consent (EU specific) - correct-answer -This privacy requirement is one of the
*fair information practices*. In the GDPR, however, it is specifically one of the
FULL CIPP/E EXAM 2026-COMPLETE
EXAM SET WITH QUESTIONS AND
VERIFIED ANSWERS
Biometrics - correct-answer -Data concerning the *intrinsic physical or behavioral
characteristics* of an individual. Examples include *DNA, fingerprints, retina and
iris patterns, voice, face, handwriting, keystroke technique* and *gait*. The GDPR,
in Article 9, lists these for the purpose of uniquely identifying a natural person as a
special category of data for which processing is not allowed other than in specific
circumstances.
Bodily Privacy - correct-answer -One of the four classes of privacy, along with
information privacy, territorial privacy and communications privacy. It focuses on a
person's physical being and any invasion thereof. Such an invasion can take the
form of *genetic testing, drug testing* or *body cavity searches*.
Breach Disclosure (EU specific) - correct-answer -The requirement that a data
controller *notify regulators*, potentially within *72 hours* of discovery, and/or
victims, of incidents affecting the confidentiality and security of personal data,
depending on the assessed risks to the rights and freedoms of affected data
subjects.
,2|Page
Bundesdatenschutzgesetz-neu - correct-answer -*Germany's federal data
protection act*, implementing the GDPR. With the passage of the GDPR, it
replaced a previous law with the same name and enhanced a series of other acts
mainly in areas of law enforcement and intelligence services. Furthermore, the
*new version suggests a procedure* for national data protection authorities *to
challenge adequacy decisions* of the EU Commission.
CCTV - correct-answer -Has come to be shorthand for any video surveillance
system. *Originally*, such systems relied on coaxial cable and was truly *only
accessible on premise*. *Today*, most surveillance systems are *hosted via
TCP/IP networks* and can be *accessed remotely*, and the footage much more
*easily shared*, eliciting new and different privacy concerns.
Certification Mechanisms - correct-answer -Introduced by the GDPR, a *new valid
adequacy mechanism for* the *transfer* of personal data outside of the
European Union *in* the *absence of an adequacy decision* and instead of other
mechanisms such as binding corporate rules or contractual clauses. These *must
be developed by certifying bodies*, *approved by data protection authorities or
the EDPB* (European Data Protection Board), *and* have *a methodology for
auditing* compliance. Similar to binding corporate rules, they compel
organizations to be able to demonstrate their compliance with all aspects of
applicable data protection legislation.
,3|Page
Charter of Fundamental Rights - correct-answer -A treaty that consolidates human
rights within the EU. The treaty states that *everyone has a right to protect their
personal data*, that *data must be processed for legitimate and specified
purposes* and that *compliance is subject to control by an authority*.
Choice - correct-answer -In the context of consent, this refers to the idea that
consent must be freely given and that data subjects must have a *genuine
____________* as to whether to provide personal data or not. If this is not truly
given it is unlikely the consent will be deemed valid under the GDPR.
Cloud Computing - correct-answer -The provision of information technology
services over the Internet. These services may be provided by a company for its
internal users in private or by third-party suppliers. The *services can include
software, infrastructure (i.e., servers), hosting and platforms (i.e., operating
systems)*. Has numerous applications, from personal webmail to corporate data
storage, and can be subdivided into different types of service models.
Codes of Conduct - correct-answer -Introduced by the GDPR, these are a new
valid adequacy mechanism for the transfer of personal data outside of the
European Union in the absence of an adequacy decision and instead of other
mechanisms such as binding corporate rules or contractual clauses. these must be
*developed by industry trade groups, associations or other bodies* representing
categories of controllers or processors. They *must be approved by supervisory
authorities or the European Data Protection Board*, and have a methodology for
auditing compliance. Similar to binding corporate rules, they compel organizations
, 4|Page
to be able to demonstrate their compliance with all aspects of applicable data
protection legislation.
Collection Limitation - correct-answer -A *fair information practices* principle, it
is the principle stating *there should be limits to* the *collection* of personal
data, that any such *data should be obtained by lawful and fair means and*,
where appropriate, *with* the knowledge or consent* of the data subject.
Communications Privacy - correct-answer -One of the four classes of privacy,
along with information privacy, bodily privacy and territorial privacy. It
encompasses protection of the means of correspondence, including *postal mail,
telephone conversations, electronic e-mail* and *other forms of communicative
behavior and apparatus*.
Confidentiality - correct-answer -Data is this if it is *protected against
unauthorised or unlawful* processing. The GDPR requires that an organization be
able to ensure the ongoing confidentiality, integrity, availability and resilience of
processing systems and services as part of its requirements for appropriate
security. In addition, the GDPR requires that *persons authorised to process* the
personal data *have committed* themselves *to confidentiality* or are under an
appropriate statutory obligation of this.
Consent (EU specific) - correct-answer -This privacy requirement is one of the
*fair information practices*. In the GDPR, however, it is specifically one of the
