CIPP/E IAPP CORE EXAMS 2026 SET QUESTIONS AND
ANSWERS SURE A+
✔✔Consumer Financial Protection Bureau - ✔✔Created by the Dodd-Frank Act, the
consumer financial protection bureau is intended to consolidate the oversight of the
financial industry. It is an independent bureau within the Federal Reserve and when it
was created CFPB took rule-making authority over FCRA and GLBA regulations from
the FTC and Financial Industry Regulators. Its enforcement powers include authority to
take action against "abusive acts and practices" as specified by the Dodd-Frank Act.
*Acronym: CFPB
**Associated law(s): Dodd-Frank Act, Gramm-Leach-Bliley Act, Fair Credit Reporting
Act, Federal Trade Commission
✔✔Consumer Reporting Agency (CRAs) - ✔✔Any person or entity that complies or
evaluates personal information for the purpose of furnishing consumer reports to third
parties for a fee.
✔✔Cookie - ✔✔A small text file stored on a client machine that may later be retrieved
by a web server from the machine. Cookies allow web servers to keep track of the end
user's browser activities, and connect individual web requests into a session. Cookies
can also be used to prevent users from having to be authorized for every password
protected page they access during a session by recording that they have successfully
supplied their username and password already. Cookies may be referred to as "first-
party" (if they are placed by the website that is visited) or "third-party" (if they are placed
by a party other than the visited website). Additionally, they may be referred to as
"session cookies" if they are deleted when a session ends, or "persistent cookies" if they
remain longer. Notably, the General Data Protection Regulation lists this latter category,
so-called "cookie identifiers," as an example of personal information. The use of cookies
is regulated both by the GDPR and the ePrivacy Directive (see Cookie Directive)
*Associated term(s): First-Party Cookie, Persistent Cookie, Third-Party Cookie, Tracking
Cookie, Web Cookie
✔✔Credit Freeze - ✔✔A consumer-initiated security measure which locks an
individual's data at consumer reporting agencies. Is used to prevent identity theft, as it
disallows both reporting of data and issuance of new credit.
✔✔Credit Reporting Agencies - ✔✔Under the Fair Credit Reporting Act, any
organization that regularly engages in assembling or evaluating consumer credit
information or other information on consumers for the purpose of furnishing consumer
reports to third parties for a fee.
*Acronym(s): CRA
**Associated term(s): Consumer reporting agency
***Associated law(s): FCRA
,✔✔Customer Access - ✔✔A customer's ability to access the personal information
collected on them as well as review, correct or delete any incorrect information.
✔✔Customer Information - ✔✔In contrast to employee information, customer
information includes data relating to the clients of private-sector organizations, patients
within the healthcare sector and the general public within the context of public-sector
agencies that provide services.
✔✔Data Breach - ✔✔The unauthorized acquisition of computerized data that
compromises the security, confidentiality, or integrity of personal information maintained
by a data collector. Breaches do not include good faith acquisitions of personal
information by an employee or agent of the data collector for a legitimate purpose of the
data collector—provided the personal information is not used for a purpose unrelated to
the data collector's business or subject to further unauthorized disclosure.
✔✔Data classification - ✔✔A scheme that provides the basis for managing access to,
and protection of, data assets.
✔✔Data controller - ✔✔The natural or legal person, public authority, agency or any
other body which alone or jointly with others determines the purposes and means of the
processing of personal data. Where the purposes and means of such processing are
determined by EU or member state law, the controller or the specific criteria for its
nomination may be provided for by EU or member state law.
✔✔Data elements - ✔✔A unit of data that cannot be broken down further or has a
distinct meaning. This may be a date of birth, a numerical identifier, or location
coordinates. In the context of data protection, it is important to understand that data
elements in isolation may not be personal data but, when combined, become personally
identifiable and therefore personal data.
✔✔Data matching - ✔✔An activity that involves comparing personal data obtained from
a variety of sources, including personal information banks, for the purpose of making
decisions about the individuals to whom the data pertains.
✔✔Data processing - ✔✔Any operation or set of operations which is performed on
personal data or sets of personal data, whether or not by automated means, such as
collection, recording, organization, structuring, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise
making available, alignment or combination, restriction, erasure or destruction.
✔✔Data Processor - ✔✔A natural or legal person (other than an employee of the
controller), public authority, agency or other body which processes personal data on
behalf of the controller. An organization can be both a controller and a processor at the
same time, depending on the function the organization is performing.
, ✔✔Data Quality - ✔✔A fair information practices principle, it is the principle that
personal data should be relevant to the purposes for which it is to be used, and, to the
extent necessary for those purposes, should be accurate, complete and kept up-to-date.
The quality of data is judged by four criteria: Does it meet the business needs?; Is it
accurate?; Is it complete?, and is it recent? Data is of an appropriate quality if these
criteria are satisfied for a particular application.
✔✔Data Recipient - ✔✔A natural or legal person, public authority, agency or another
body, to which personal data is disclosed, whether a third party or not. Public authorities
that receive personal data in the framework of a particular inquiry in accordance with EU
or member state law shall not be regarded as recipients, however. The processing of
that data by those public authorities shall be in compliance with the applicable data
protection rules according to the purposes of the processing.
✔✔Data Subject - ✔✔An identified or identifiable natural person.
✔✔Deceptive trade practices - ✔✔In the context of U.S. federal law, a term associated
with corporate entities who mislead or misrepresent products or services to consumers
and customers. These practices are regulated in the U.S. by the Federal Trade
Commission at the federal level and typically by an attorney general or office of
consumer protection at the state level. Law typically provides for both enforcement by
the government to stop the practice and individual actions for damages brought by
consumers who are hurt by the practices.
*Associated term(s): Unfair Trade Practices
✔✔Defamation - ✔✔Common law tort focuses on a false or defamatory statement,
defined as a communication tending "so to harm the reputation of another as to lower
him in the estimation of the community or to deter third persons from associating or
dealing with him."
*Associated term(s): Common Law
✔✔Digital Fingerprinting - ✔✔The use of log files to identify a website visitor. It is often
used for security and system maintenance purposes. Log files generally include: the IP
address of the visitor; a time stamp; the URL of the requested page or file; a referrer
URL, and the visitor's web browser, operating system and font preferences. In some
cases, combining this information can be used to "fingerprint" a device. This more
detailed information varies enough among computing devices that two devices are
unlikely to be the same. It is used as a security technique by financial institutions and
others initiating additional security assurances before allowing users to log on from a
new device. Some privacy enforcement agencies; however, have questioned what
would constitute sufficient notice and consent for digital fingerprinting techniques to be
used for targeted advertising.
ANSWERS SURE A+
✔✔Consumer Financial Protection Bureau - ✔✔Created by the Dodd-Frank Act, the
consumer financial protection bureau is intended to consolidate the oversight of the
financial industry. It is an independent bureau within the Federal Reserve and when it
was created CFPB took rule-making authority over FCRA and GLBA regulations from
the FTC and Financial Industry Regulators. Its enforcement powers include authority to
take action against "abusive acts and practices" as specified by the Dodd-Frank Act.
*Acronym: CFPB
**Associated law(s): Dodd-Frank Act, Gramm-Leach-Bliley Act, Fair Credit Reporting
Act, Federal Trade Commission
✔✔Consumer Reporting Agency (CRAs) - ✔✔Any person or entity that complies or
evaluates personal information for the purpose of furnishing consumer reports to third
parties for a fee.
✔✔Cookie - ✔✔A small text file stored on a client machine that may later be retrieved
by a web server from the machine. Cookies allow web servers to keep track of the end
user's browser activities, and connect individual web requests into a session. Cookies
can also be used to prevent users from having to be authorized for every password
protected page they access during a session by recording that they have successfully
supplied their username and password already. Cookies may be referred to as "first-
party" (if they are placed by the website that is visited) or "third-party" (if they are placed
by a party other than the visited website). Additionally, they may be referred to as
"session cookies" if they are deleted when a session ends, or "persistent cookies" if they
remain longer. Notably, the General Data Protection Regulation lists this latter category,
so-called "cookie identifiers," as an example of personal information. The use of cookies
is regulated both by the GDPR and the ePrivacy Directive (see Cookie Directive)
*Associated term(s): First-Party Cookie, Persistent Cookie, Third-Party Cookie, Tracking
Cookie, Web Cookie
✔✔Credit Freeze - ✔✔A consumer-initiated security measure which locks an
individual's data at consumer reporting agencies. Is used to prevent identity theft, as it
disallows both reporting of data and issuance of new credit.
✔✔Credit Reporting Agencies - ✔✔Under the Fair Credit Reporting Act, any
organization that regularly engages in assembling or evaluating consumer credit
information or other information on consumers for the purpose of furnishing consumer
reports to third parties for a fee.
*Acronym(s): CRA
**Associated term(s): Consumer reporting agency
***Associated law(s): FCRA
,✔✔Customer Access - ✔✔A customer's ability to access the personal information
collected on them as well as review, correct or delete any incorrect information.
✔✔Customer Information - ✔✔In contrast to employee information, customer
information includes data relating to the clients of private-sector organizations, patients
within the healthcare sector and the general public within the context of public-sector
agencies that provide services.
✔✔Data Breach - ✔✔The unauthorized acquisition of computerized data that
compromises the security, confidentiality, or integrity of personal information maintained
by a data collector. Breaches do not include good faith acquisitions of personal
information by an employee or agent of the data collector for a legitimate purpose of the
data collector—provided the personal information is not used for a purpose unrelated to
the data collector's business or subject to further unauthorized disclosure.
✔✔Data classification - ✔✔A scheme that provides the basis for managing access to,
and protection of, data assets.
✔✔Data controller - ✔✔The natural or legal person, public authority, agency or any
other body which alone or jointly with others determines the purposes and means of the
processing of personal data. Where the purposes and means of such processing are
determined by EU or member state law, the controller or the specific criteria for its
nomination may be provided for by EU or member state law.
✔✔Data elements - ✔✔A unit of data that cannot be broken down further or has a
distinct meaning. This may be a date of birth, a numerical identifier, or location
coordinates. In the context of data protection, it is important to understand that data
elements in isolation may not be personal data but, when combined, become personally
identifiable and therefore personal data.
✔✔Data matching - ✔✔An activity that involves comparing personal data obtained from
a variety of sources, including personal information banks, for the purpose of making
decisions about the individuals to whom the data pertains.
✔✔Data processing - ✔✔Any operation or set of operations which is performed on
personal data or sets of personal data, whether or not by automated means, such as
collection, recording, organization, structuring, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise
making available, alignment or combination, restriction, erasure or destruction.
✔✔Data Processor - ✔✔A natural or legal person (other than an employee of the
controller), public authority, agency or other body which processes personal data on
behalf of the controller. An organization can be both a controller and a processor at the
same time, depending on the function the organization is performing.
, ✔✔Data Quality - ✔✔A fair information practices principle, it is the principle that
personal data should be relevant to the purposes for which it is to be used, and, to the
extent necessary for those purposes, should be accurate, complete and kept up-to-date.
The quality of data is judged by four criteria: Does it meet the business needs?; Is it
accurate?; Is it complete?, and is it recent? Data is of an appropriate quality if these
criteria are satisfied for a particular application.
✔✔Data Recipient - ✔✔A natural or legal person, public authority, agency or another
body, to which personal data is disclosed, whether a third party or not. Public authorities
that receive personal data in the framework of a particular inquiry in accordance with EU
or member state law shall not be regarded as recipients, however. The processing of
that data by those public authorities shall be in compliance with the applicable data
protection rules according to the purposes of the processing.
✔✔Data Subject - ✔✔An identified or identifiable natural person.
✔✔Deceptive trade practices - ✔✔In the context of U.S. federal law, a term associated
with corporate entities who mislead or misrepresent products or services to consumers
and customers. These practices are regulated in the U.S. by the Federal Trade
Commission at the federal level and typically by an attorney general or office of
consumer protection at the state level. Law typically provides for both enforcement by
the government to stop the practice and individual actions for damages brought by
consumers who are hurt by the practices.
*Associated term(s): Unfair Trade Practices
✔✔Defamation - ✔✔Common law tort focuses on a false or defamatory statement,
defined as a communication tending "so to harm the reputation of another as to lower
him in the estimation of the community or to deter third persons from associating or
dealing with him."
*Associated term(s): Common Law
✔✔Digital Fingerprinting - ✔✔The use of log files to identify a website visitor. It is often
used for security and system maintenance purposes. Log files generally include: the IP
address of the visitor; a time stamp; the URL of the requested page or file; a referrer
URL, and the visitor's web browser, operating system and font preferences. In some
cases, combining this information can be used to "fingerprint" a device. This more
detailed information varies enough among computing devices that two devices are
unlikely to be the same. It is used as a security technique by financial institutions and
others initiating additional security assurances before allowing users to log on from a
new device. Some privacy enforcement agencies; however, have questioned what
would constitute sufficient notice and consent for digital fingerprinting techniques to be
used for targeted advertising.
