1|Page
CIPP/E IAPP PRACTICE EXAM|
LATEST 2026 ACTUAL QUESTIONS &
VERIFIED ANSWERS
Which of the following must be included in controllers personal data
processing records, but not in the processors' records?
-International data transfers being made and the measures put in place
to ensure they are lawful
-purpose of processing
-A general description of technical and organisational security measures
that have been implemented - correct-answer -purpose of processing
,2|Page
True or false. The data protection officer must be an expert in data
protection law and practices. - correct-answer -True
Which of the following are circumstances that require an organisation
to appoint a DPO? Select all that apply.
-The core activities of the controller or processor include regular and
systematic monitoring of data subjects on a large scale.
-The core activities of the controller or processor consist of large scale
processing of special categories of data.
- The controller is a public authority. - correct-answer -All
,3|Page
In what order should the following options for cross-border data
transfers be considered?
-Adequacy decisions
-Appropriate Safeguards
-Derogations - correct-answer --Adequacy decisons
-Appropriate Safeguards
-Derogations
Which of the following options for cross-border data transfers is a
determination by the European Commission that a third country has
achieved an EU-level of personal data protection.
-Adequacy decision
-Appropriate safeguard
-Derogation - correct-answer -Adequacy decisions
, 4|Page
Which of the followig countries hav ebeen deemed adequate by the
European Commission? Select all that apply.
Argentina
Uruguay
New Zealand
Switzerland - correct-answer -All
Which of the following are EU-US Privacy Shield requirements? Select
all that apply.
-Publicly disclose the organisation's privacy policy
-Implement the Privacy Shield Principles
CIPP/E IAPP PRACTICE EXAM|
LATEST 2026 ACTUAL QUESTIONS &
VERIFIED ANSWERS
Which of the following must be included in controllers personal data
processing records, but not in the processors' records?
-International data transfers being made and the measures put in place
to ensure they are lawful
-purpose of processing
-A general description of technical and organisational security measures
that have been implemented - correct-answer -purpose of processing
,2|Page
True or false. The data protection officer must be an expert in data
protection law and practices. - correct-answer -True
Which of the following are circumstances that require an organisation
to appoint a DPO? Select all that apply.
-The core activities of the controller or processor include regular and
systematic monitoring of data subjects on a large scale.
-The core activities of the controller or processor consist of large scale
processing of special categories of data.
- The controller is a public authority. - correct-answer -All
,3|Page
In what order should the following options for cross-border data
transfers be considered?
-Adequacy decisions
-Appropriate Safeguards
-Derogations - correct-answer --Adequacy decisons
-Appropriate Safeguards
-Derogations
Which of the following options for cross-border data transfers is a
determination by the European Commission that a third country has
achieved an EU-level of personal data protection.
-Adequacy decision
-Appropriate safeguard
-Derogation - correct-answer -Adequacy decisions
, 4|Page
Which of the followig countries hav ebeen deemed adequate by the
European Commission? Select all that apply.
Argentina
Uruguay
New Zealand
Switzerland - correct-answer -All
Which of the following are EU-US Privacy Shield requirements? Select
all that apply.
-Publicly disclose the organisation's privacy policy
-Implement the Privacy Shield Principles
