CIPT CORE EXAM SET 2026/2027 QUESTIONS AND
SOLUTIONS RATED A+
✔✔Visibility & transparency (PbD) - ✔✔The use of personal information should not be
obscured or obfuscated, and disclosure about that use must consider the needs and
sophistication of the respective audiences
✔✔Respect for user privacy (PbD) - ✔✔The individual is the principal beneficiary of
privacy and the one affected when that privacy is violated; therefore, their needs and
risks should be forefront in the minds of designers
✔✔Privacy by Design principles - ✔✔1. Proactive, not reactive
2. Privacy as the default setting
3. Privacy embedded into design
4. Positive sum, not zero sum (full functionality)
5. End-to-end security (full lifecycle protection)
6. Visibility & transparency
7. Respect for user privacy
✔✔Value sensitive design - ✔✔Value-sensitive design is a design approach that
accounts for ethical values, such as privacy, in addition to usability-oriented design
goals. Value-sensitive design places people, their needs and values important to them
at the center of the design process
✔✔How design affects users - ✔✔Transparency & user rights are core concepts of
global privacy legislation & guidelines, and customers should be able to make informed
privacy & consent decisions
✔✔Strategies for skillful practice - ✔✔TBD
✔✔Data lifecycle - ✔✔1. Collection
2. Use
3. Disclosure
4. Retention
5. Destruction
✔✔Collection - ✔✔Only collect data for established purposes and always collect
consent from data subjects for sensitive data; allow data subjects to opt out of services
they deem unnecessary and before collecting the data, when possible
✔✔Use - ✔✔Only use data for the purpose of the original collection; any new uses
require additional consent from the data subject, and/or the sending of new privacy
notices
,✔✔Disclosure - ✔✔Sharing of information external to an organization collecting it; Limit
disclosures to those purposes for which data was originally collected; any new
disclosures require additional consent from the data subject, and/or the sending of new
privacy notices
✔✔Retention - ✔✔Destroy data when it is no longer needed to complete the
transaction; any new uses that motivate longer retention periods require additional
consent from the data subject and/or the sending of new privacy notices
✔✔Destruction - ✔✔As soon as data is no longer needed, ensure the data and any
derivatives are removed from all systems using appropriate methods to prevent
recovery
✔✔Organization privacy notice - ✔✔The privacy notice is based on an organization's
internal privacy policies & should contain:
- what data is being collected, processed or shared
- why this data practice is necessary and how it benefits the data subject
- what controls are available regarding the practice
✔✔Organization internal privacy policies - ✔✔- Privacy policies that serve as a guide for
all organizational activities & drive commitments made within the privacy notice
- Often overwhelming to a user since they provide a complete & comprehensive
overview of an organization's data practices
✔✔What should be included in internal privacy policy? - ✔✔- Types of data
classification
- Data collection principles
- Protection of data (encryption, access control based, etc.)
- Data retention period
- Treatment of sensitive data
- Sharing of data across groups
- Sharing of data with partners and vendors
- Creation of departmental privacy policies
- Performance of privacy reviews
- Participation in a privacy response center
- Responding to privacy inquiries
✔✔Organization security policies - ✔✔Security policy helps maintain and organization's
privacy policies & identifies what security measures need to be in place to protect the
organization
✔✔What should be included in security policy? - ✔✔- encryption
- software protection
- access controls
- physical protection
, - social engineering prevention
- auditing
✔✔data classification scheme - ✔✔an information scheme used throughout an
organization that helps secure confidentiality and integrity of information that is typically
used by corporations
✔✔Data classification standard - ✔✔The goal and objective of a __________ is to
provide a consistent definition for how an organization should handle and secure
different types of data.
✔✔COBIT - ✔✔A framework developed by the Information Systems Audit and Control
Association and the IT Governance Institute that defines the goals for the controls that
should be used to properly manage IT and ensure IT maps to business needs.
✔✔COBIT domains - ✔✔1. Plan and Organize
2. Acquire and Implement
3. Deliver and Support
4. Monitor and Evaluate
✔✔Data inventory - ✔✔Conducting a data inventory reveals where personal data
resides, which will identify the data as it moves across various systems and thus how
data is shared and organized and its locations. That data is then categorized by subject
area, which identifies inconsistent data versions, enabling identification and mitigation of
data disparities. The data inventory offers a good starting point for the privacy team to
prioritize resources, efforts, risk assessments and current policy in response to
incidents.
✔✔Enterprise Architecture (EA) - ✔✔involves documenting an organization's IT assets
and data flows to facilitate understanding, management, planning. Involves managing
data flows across organization to minimize privacy risk & support business growth
✔✔Cross-border transfers - ✔✔Implement appropriate safeguards when transferring
data internationally
- binding corporate rules
- approved code of conduct
- certification scheme
✔✔Binding Corporate Rules (BCR) - ✔✔internal code of conduct operating within a
multinational group, which applies to restricted data from the group's EEA entities to
non-EEA entities; may be a corporate group or group of enterprises engaged in a joint
economic activity
SOLUTIONS RATED A+
✔✔Visibility & transparency (PbD) - ✔✔The use of personal information should not be
obscured or obfuscated, and disclosure about that use must consider the needs and
sophistication of the respective audiences
✔✔Respect for user privacy (PbD) - ✔✔The individual is the principal beneficiary of
privacy and the one affected when that privacy is violated; therefore, their needs and
risks should be forefront in the minds of designers
✔✔Privacy by Design principles - ✔✔1. Proactive, not reactive
2. Privacy as the default setting
3. Privacy embedded into design
4. Positive sum, not zero sum (full functionality)
5. End-to-end security (full lifecycle protection)
6. Visibility & transparency
7. Respect for user privacy
✔✔Value sensitive design - ✔✔Value-sensitive design is a design approach that
accounts for ethical values, such as privacy, in addition to usability-oriented design
goals. Value-sensitive design places people, their needs and values important to them
at the center of the design process
✔✔How design affects users - ✔✔Transparency & user rights are core concepts of
global privacy legislation & guidelines, and customers should be able to make informed
privacy & consent decisions
✔✔Strategies for skillful practice - ✔✔TBD
✔✔Data lifecycle - ✔✔1. Collection
2. Use
3. Disclosure
4. Retention
5. Destruction
✔✔Collection - ✔✔Only collect data for established purposes and always collect
consent from data subjects for sensitive data; allow data subjects to opt out of services
they deem unnecessary and before collecting the data, when possible
✔✔Use - ✔✔Only use data for the purpose of the original collection; any new uses
require additional consent from the data subject, and/or the sending of new privacy
notices
,✔✔Disclosure - ✔✔Sharing of information external to an organization collecting it; Limit
disclosures to those purposes for which data was originally collected; any new
disclosures require additional consent from the data subject, and/or the sending of new
privacy notices
✔✔Retention - ✔✔Destroy data when it is no longer needed to complete the
transaction; any new uses that motivate longer retention periods require additional
consent from the data subject and/or the sending of new privacy notices
✔✔Destruction - ✔✔As soon as data is no longer needed, ensure the data and any
derivatives are removed from all systems using appropriate methods to prevent
recovery
✔✔Organization privacy notice - ✔✔The privacy notice is based on an organization's
internal privacy policies & should contain:
- what data is being collected, processed or shared
- why this data practice is necessary and how it benefits the data subject
- what controls are available regarding the practice
✔✔Organization internal privacy policies - ✔✔- Privacy policies that serve as a guide for
all organizational activities & drive commitments made within the privacy notice
- Often overwhelming to a user since they provide a complete & comprehensive
overview of an organization's data practices
✔✔What should be included in internal privacy policy? - ✔✔- Types of data
classification
- Data collection principles
- Protection of data (encryption, access control based, etc.)
- Data retention period
- Treatment of sensitive data
- Sharing of data across groups
- Sharing of data with partners and vendors
- Creation of departmental privacy policies
- Performance of privacy reviews
- Participation in a privacy response center
- Responding to privacy inquiries
✔✔Organization security policies - ✔✔Security policy helps maintain and organization's
privacy policies & identifies what security measures need to be in place to protect the
organization
✔✔What should be included in security policy? - ✔✔- encryption
- software protection
- access controls
- physical protection
, - social engineering prevention
- auditing
✔✔data classification scheme - ✔✔an information scheme used throughout an
organization that helps secure confidentiality and integrity of information that is typically
used by corporations
✔✔Data classification standard - ✔✔The goal and objective of a __________ is to
provide a consistent definition for how an organization should handle and secure
different types of data.
✔✔COBIT - ✔✔A framework developed by the Information Systems Audit and Control
Association and the IT Governance Institute that defines the goals for the controls that
should be used to properly manage IT and ensure IT maps to business needs.
✔✔COBIT domains - ✔✔1. Plan and Organize
2. Acquire and Implement
3. Deliver and Support
4. Monitor and Evaluate
✔✔Data inventory - ✔✔Conducting a data inventory reveals where personal data
resides, which will identify the data as it moves across various systems and thus how
data is shared and organized and its locations. That data is then categorized by subject
area, which identifies inconsistent data versions, enabling identification and mitigation of
data disparities. The data inventory offers a good starting point for the privacy team to
prioritize resources, efforts, risk assessments and current policy in response to
incidents.
✔✔Enterprise Architecture (EA) - ✔✔involves documenting an organization's IT assets
and data flows to facilitate understanding, management, planning. Involves managing
data flows across organization to minimize privacy risk & support business growth
✔✔Cross-border transfers - ✔✔Implement appropriate safeguards when transferring
data internationally
- binding corporate rules
- approved code of conduct
- certification scheme
✔✔Binding Corporate Rules (BCR) - ✔✔internal code of conduct operating within a
multinational group, which applies to restricted data from the group's EEA entities to
non-EEA entities; may be a corporate group or group of enterprises engaged in a joint
economic activity
