CIPP/E IAPP UPDATED FINAL EXAM QUESTIONS AND
ANSWERS SURE A+
✔✔True or false: A data controller may be a natural person or a legal entity, while a
data processor must be a legal entity. - ✔✔False
✔✔True or false: a contract protects a processor from being held to the same legal
obligations as the controller. - ✔✔False
✔✔True or False: A processor may decide wehre and how to process personal data. -
✔✔False
✔✔True or false: When personal data is being processed, there is always a controller. -
✔✔True
✔✔What is data processing:
-Any action involved in securing and protecting data
-Any action performed upon data
-Any action involved in collecting personal data
-Any action that adapts or alters data. - ✔✔Any action performed upon data.
✔✔What are the criteria used to determine the territorial scope of the GDPR: Select all
that apply.
-Processing of personal data of EU subjects relating to offering goods or services or
monitoring behaviour
-Processing of personal data by a controller not established in the EU but in a place
where member state law applies
-Processing of personal data when a controller or processor is established in the EU -
✔✔All.
✔✔Which of the following fall under the material scope of the GDPR? Select all that
apply.
-processing personal data without human intervention
-processing anonymous data
-Processing personal data that forms part of a filing system. - ✔✔All EXCEPT
anonymous data
✔✔Exclusions to the material scope of GDPR should be interpreted broadly. True or
false? - ✔✔False
✔✔True or false: At least three of the legitimate processing criteria within the GDPR
must ve met for personal data to be processed legally. - ✔✔False
,✔✔Read the following and select all the GDPR principles that have been violated: An
access control system used by an organization's maintenance team for building security
is later used by a manager in a different department to determine if employees are
arriving late for work. The employees are not informed of this new processing action,
and the manager does not create consistent records of the processing activities.
-Integrity and confidentiality
-Accountability
-Data quality and accuracy - ✔✔This violates
-Integrity and confidentiality
Accountability
✔✔Which legitimate processing criteria is commonly used when a customer purchases
a good or service?
-Consent
-Vital interests
-Contract - ✔✔Contract
✔✔Which exception to the prohibition on processing special categories of data must be
explicit?
-Vital interests
-Publicly available data
-Consent - ✔✔Consent
✔✔Select all that are potential solutions to lengthy privacy notices.
-Key notices
-Standardized Icons
-Terms of Agreement
-Just in time notices
-Layered privacy notices - ✔✔All EXCEPT
-Key notices
-Terms of Agreement
✔✔True of False: A controller may charge an administrative fee to data subjects if they
request that the information provision be in oral format. - ✔✔False
✔✔Privacy notices should use visualisation where appropriate. True or false? - ✔✔True
✔✔True or false: Information provided to data subjects about the processing of their
personal data should be written in clear and plain language that is understandable. -
✔✔True
, ✔✔True or false: The transparency principle states that detail is more important that
conciseness in a privacy notice. - ✔✔False
✔✔The information that must be provided to data subjects will depend on the situation.
What information must be provided to data subjects when their personal data will be
stored on a database hosted in the United States?
-Use of automated decision making
-Source of the date
-Intention to transfer data internationally
-Controller's legitimate interest - ✔✔Intention to transfer data internationally
✔✔What information must be provided to data subjects when the controller's necessity
is being used as the legal basis for processing?
-Source of the data
-Controller's legitimate interest
-Recipients of the data
-Legal basis for transferring data internationally - ✔✔Controller's legitimate interest
✔✔What information must be provided to data subjects when the personal data that will
be processed was collected indirectly?
-Source of the data
-Storage period
-Statutory or contractual requirement
-Controller's legitimate interest - ✔✔Source of the data
✔✔What information must be provided to data subjects when their personal data will be
shared with an outside organisation to provide them with a promised service?
-Use of automated decision making
-Recipients of the data
-Intention to transfer data internationally
-Source of the data - ✔✔Recipients of the data
✔✔What information must be provided to the data subjects in all circumstances? Select
all that apply.
- Identity of the controller
-Controller's legitimate interest
-Purpose of processing
-Data subjects' rights - ✔✔All EXCEPT legitimate interest
ANSWERS SURE A+
✔✔True or false: A data controller may be a natural person or a legal entity, while a
data processor must be a legal entity. - ✔✔False
✔✔True or false: a contract protects a processor from being held to the same legal
obligations as the controller. - ✔✔False
✔✔True or False: A processor may decide wehre and how to process personal data. -
✔✔False
✔✔True or false: When personal data is being processed, there is always a controller. -
✔✔True
✔✔What is data processing:
-Any action involved in securing and protecting data
-Any action performed upon data
-Any action involved in collecting personal data
-Any action that adapts or alters data. - ✔✔Any action performed upon data.
✔✔What are the criteria used to determine the territorial scope of the GDPR: Select all
that apply.
-Processing of personal data of EU subjects relating to offering goods or services or
monitoring behaviour
-Processing of personal data by a controller not established in the EU but in a place
where member state law applies
-Processing of personal data when a controller or processor is established in the EU -
✔✔All.
✔✔Which of the following fall under the material scope of the GDPR? Select all that
apply.
-processing personal data without human intervention
-processing anonymous data
-Processing personal data that forms part of a filing system. - ✔✔All EXCEPT
anonymous data
✔✔Exclusions to the material scope of GDPR should be interpreted broadly. True or
false? - ✔✔False
✔✔True or false: At least three of the legitimate processing criteria within the GDPR
must ve met for personal data to be processed legally. - ✔✔False
,✔✔Read the following and select all the GDPR principles that have been violated: An
access control system used by an organization's maintenance team for building security
is later used by a manager in a different department to determine if employees are
arriving late for work. The employees are not informed of this new processing action,
and the manager does not create consistent records of the processing activities.
-Integrity and confidentiality
-Accountability
-Data quality and accuracy - ✔✔This violates
-Integrity and confidentiality
Accountability
✔✔Which legitimate processing criteria is commonly used when a customer purchases
a good or service?
-Consent
-Vital interests
-Contract - ✔✔Contract
✔✔Which exception to the prohibition on processing special categories of data must be
explicit?
-Vital interests
-Publicly available data
-Consent - ✔✔Consent
✔✔Select all that are potential solutions to lengthy privacy notices.
-Key notices
-Standardized Icons
-Terms of Agreement
-Just in time notices
-Layered privacy notices - ✔✔All EXCEPT
-Key notices
-Terms of Agreement
✔✔True of False: A controller may charge an administrative fee to data subjects if they
request that the information provision be in oral format. - ✔✔False
✔✔Privacy notices should use visualisation where appropriate. True or false? - ✔✔True
✔✔True or false: Information provided to data subjects about the processing of their
personal data should be written in clear and plain language that is understandable. -
✔✔True
, ✔✔True or false: The transparency principle states that detail is more important that
conciseness in a privacy notice. - ✔✔False
✔✔The information that must be provided to data subjects will depend on the situation.
What information must be provided to data subjects when their personal data will be
stored on a database hosted in the United States?
-Use of automated decision making
-Source of the date
-Intention to transfer data internationally
-Controller's legitimate interest - ✔✔Intention to transfer data internationally
✔✔What information must be provided to data subjects when the controller's necessity
is being used as the legal basis for processing?
-Source of the data
-Controller's legitimate interest
-Recipients of the data
-Legal basis for transferring data internationally - ✔✔Controller's legitimate interest
✔✔What information must be provided to data subjects when the personal data that will
be processed was collected indirectly?
-Source of the data
-Storage period
-Statutory or contractual requirement
-Controller's legitimate interest - ✔✔Source of the data
✔✔What information must be provided to data subjects when their personal data will be
shared with an outside organisation to provide them with a promised service?
-Use of automated decision making
-Recipients of the data
-Intention to transfer data internationally
-Source of the data - ✔✔Recipients of the data
✔✔What information must be provided to the data subjects in all circumstances? Select
all that apply.
- Identity of the controller
-Controller's legitimate interest
-Purpose of processing
-Data subjects' rights - ✔✔All EXCEPT legitimate interest
