CIPP-E EXAM with Questions and
Answers/Plus a Rationale Updated 2026
A+/Instant Download PDF
EXAM COVERAGE
1. Introduction to European Data Protection
2. Regulatory Authorities and Enforcement
3. Territorial Scope and Material Scope under the GDPR
4. Principles of Data Processing and Lawfulness
5. Data Subject Rights and Obligations of Controllers/Processors
1. A multinational financial institution headquartered in New York processes personal data of
European Union residents through an online portal. The firm has no physical branch or
subsidiary inside the member states, but actively targets services to EU data subjects by offering
localized euro-denominated accounts and customer support in multiple European languages. A
disgruntled customer in Paris files a complaint regarding automated credit profiling. Which
authority holds primary enforcement jurisdiction under the GDPR?
A. The Federal Trade Commission (FTC) in the United States because the headquarters is
located in New York.
B. The lead supervisory authority in France (CNIL) where the data subject resides and
where the targeting occurs under Article 3(2).
C. The Data Protection Commission of Ireland since most multinational firms use Dublin as an
entry point.
D. The European Data Protection Board (EDPB) directly as a court of first instance.
CORRECT ANSWER : B
Rationale: Under Article 3(2) of the GDPR, the regulation applies to controllers not established
in the EU if their processing activities relate to the offering of goods or services to data subjects
, in the Union. Because the firm targets EU residents, the local supervisory authority where the
data subject resides can exercise enforcement powers via the consistency mechanism or local
establishment.
2. An e-commerce platform based in Frankfurt utilizes automated machine-learning algorithms to
segment user shopping histories and dynamically adjust product prices based on inferred
socioeconomic vulnerability. A consumer rights NGO challenges this practice under GDPR
Article 22, arguing it constitutes an automated decision-making process producing legal or
similarly significant effects. The company defends that prices are purely commercial. How must
a European Data Protection Authority evaluate this practice?
A. Automated dynamic pricing is explicitly exempt from restrictions under GDPR Recital 71.
B. It constitutes automated individual decision-making with significant effects, requiring
explicit consent, contract necessity, or member state law authorization alongside suitable
safeguards.
C. The practice is completely unregulated unless personal identification numbers are processed
without encryption.
D. It falls exclusively under consumer protection directives and is immune from GDPR scrutiny.
CORRECT ANSWER : B
Rationale: Article 22 protects data subjects from decisions based solely on automated
processing, including profiling, which produce legal or similarly significant effects. Dynamic
pricing affecting economic well-being based on vulnerable profiling triggers strict safeguards,
and commercial convenience alone does not override these protections.
3. A healthcare provider in Berlin appoints an external legal consultant as its Data Protection
Officer (DPO). The consultant also simultaneously represents the provider in contentious civil
litigation against former employees whose medical records are central to the dispute. The local
supervisory authority audits the hospital's governance structure. What finding is the authority
most likely to issue regarding the DPO?
A. The appointment is fully compliant because legal training enhances compliance oversight.
B. A severe conflict of interest exists under Article 38(6), as the DPO cannot maintain
professional independence while acting as legal counsel in litigation adverse to data
subjects.
C. Conflicts of interest only apply to internal employees, not external consultants.
D. The arrangement is valid provided the consultant bills under a separate corporate entity name.
CORRECT ANSWER : B
, Rationale: Article 38(6) of the GDPR permits a DPO to undertake other tasks, provided they do
not result in a conflict of interests. Representing the controller in litigation involving data
subjects compromises professional independence and objectivity, violating core DPO mandates.
4. A cloud service provider acting as a data processor for a major German automotive manufacturer
discovers an unauthorized privilege escalation exploit affecting multi-tenant virtual machines.
Under GDPR Article 33, what are the precise legal obligations and timelines governing breach
notification?
A. The processor must notify affected data subjects directly within 24 hours of discovery.
B. The processor must notify the controller without undue delay upon becoming aware of a
personal data breach, enabling the controller to notify the supervisory authority within 72
hours.
C. The processor is exempt from all notification requirements if encryption-at-rest was enabled.
D. The processor must publish a public advisory on the European Commission portal within 7
days.
CORRECT ANSWER : B
Rationale: Processors do not notify supervisory authorities directly under standard GDPR rules;
instead, Article 33(2) mandates that processors notify controllers without undue delay. The
controller then bears the responsibility to notify the competent supervisory authority within 72
hours.
5. A global social media corporation transfers user telemetry data from its Irish operating entity to
servers located in Virginia, USA, relying on the EU-U.S. Data Privacy Framework. A privacy
advocacy group challenges the adequacy framework, pointing to extensive U.S. intelligence
surveillance under FISA Section 702. What fundamental legal standard governs the validity of
such data transfers under Chapter V of the GDPR?
A. Transfers are prohibited unless the destination country matches EU member state GDP levels.
B. Transfers require an adequacy decision ensuring an essentially equivalent level of
protection to that guaranteed within the EU, or the implementation of binding and effective
appropriate safeguards.
C. Any commercial entity certified under a self-assessment scheme is automatically immune
from Chapter V restrictions.
D. adequacy is judged solely on the presence of standard commercial arbitration clauses in user
terms of service.
CORRECT ANSWER : B
, Rationale: Following established Court of Justice of the European Union (CJEU) jurisprudence
(Schrems rulings), transfers based on adequacy frameworks or alternative tools must guarantee
an level of protection essentially equivalent to that guaranteed inside the EU.
6. A retail chain in Milan implements biometric facial recognition cameras at store entrances to
track repeat shoplifters. The system captures facial geometry, converts it into a mathematical
hash, and compares it against a local watchlist. The retailer argues this processing is justified
under legitimate interest (Article 6(1)(f)). How does the GDPR classify biometric data processed
for unique identification?
A. Standard personal data subject to standard balancing tests under legitimate interest.
B. Special category data under Article 9, which is strictly prohibited unless an explicit
exemption such as substantial public interest or explicit consent applies.
C. Anonymous data, completely outside the material scope of the GDPR.
D. Traffic data governed exclusively by the ePrivacy Directive without GDPR overlap.
CORRECT ANSWER : B
Rationale: Under Article 9, biometric data processed for the purpose of uniquely identifying a
natural person is classified as special category data. General legitimate interest under Article
6(1)(f) is insufficient; an Article 9 exemption must also be satisfied.
7. A multinational pharmaceutical company conducts clinical trials across Spain, Sweden, and
Poland, collecting genetic and health records from thousands of trial participants. The company
designates its research headquarters in Madrid as the single point of contact for all regulatory
filings. Which supervisory authority is designated as the "lead supervisory authority" for cross-
border processing under the GDPR?
A. The supervisory authority of the data subject's country of birth in every individual case.
B. The supervisory authority of the main establishment of the controller in the EU, which
in this scenario is Spain (AEPD).
C. The European Medicines Agency (EMA) in Amsterdam.
D. A rotating committee managed by the European Parliament.
CORRECT ANSWER : B
Rationale: The lead supervisory authority concept under Article 56 assigns primary competence
to the supervisory authority of the controller's main establishment in the EU for cross-border
processing activities.
Answers/Plus a Rationale Updated 2026
A+/Instant Download PDF
EXAM COVERAGE
1. Introduction to European Data Protection
2. Regulatory Authorities and Enforcement
3. Territorial Scope and Material Scope under the GDPR
4. Principles of Data Processing and Lawfulness
5. Data Subject Rights and Obligations of Controllers/Processors
1. A multinational financial institution headquartered in New York processes personal data of
European Union residents through an online portal. The firm has no physical branch or
subsidiary inside the member states, but actively targets services to EU data subjects by offering
localized euro-denominated accounts and customer support in multiple European languages. A
disgruntled customer in Paris files a complaint regarding automated credit profiling. Which
authority holds primary enforcement jurisdiction under the GDPR?
A. The Federal Trade Commission (FTC) in the United States because the headquarters is
located in New York.
B. The lead supervisory authority in France (CNIL) where the data subject resides and
where the targeting occurs under Article 3(2).
C. The Data Protection Commission of Ireland since most multinational firms use Dublin as an
entry point.
D. The European Data Protection Board (EDPB) directly as a court of first instance.
CORRECT ANSWER : B
Rationale: Under Article 3(2) of the GDPR, the regulation applies to controllers not established
in the EU if their processing activities relate to the offering of goods or services to data subjects
, in the Union. Because the firm targets EU residents, the local supervisory authority where the
data subject resides can exercise enforcement powers via the consistency mechanism or local
establishment.
2. An e-commerce platform based in Frankfurt utilizes automated machine-learning algorithms to
segment user shopping histories and dynamically adjust product prices based on inferred
socioeconomic vulnerability. A consumer rights NGO challenges this practice under GDPR
Article 22, arguing it constitutes an automated decision-making process producing legal or
similarly significant effects. The company defends that prices are purely commercial. How must
a European Data Protection Authority evaluate this practice?
A. Automated dynamic pricing is explicitly exempt from restrictions under GDPR Recital 71.
B. It constitutes automated individual decision-making with significant effects, requiring
explicit consent, contract necessity, or member state law authorization alongside suitable
safeguards.
C. The practice is completely unregulated unless personal identification numbers are processed
without encryption.
D. It falls exclusively under consumer protection directives and is immune from GDPR scrutiny.
CORRECT ANSWER : B
Rationale: Article 22 protects data subjects from decisions based solely on automated
processing, including profiling, which produce legal or similarly significant effects. Dynamic
pricing affecting economic well-being based on vulnerable profiling triggers strict safeguards,
and commercial convenience alone does not override these protections.
3. A healthcare provider in Berlin appoints an external legal consultant as its Data Protection
Officer (DPO). The consultant also simultaneously represents the provider in contentious civil
litigation against former employees whose medical records are central to the dispute. The local
supervisory authority audits the hospital's governance structure. What finding is the authority
most likely to issue regarding the DPO?
A. The appointment is fully compliant because legal training enhances compliance oversight.
B. A severe conflict of interest exists under Article 38(6), as the DPO cannot maintain
professional independence while acting as legal counsel in litigation adverse to data
subjects.
C. Conflicts of interest only apply to internal employees, not external consultants.
D. The arrangement is valid provided the consultant bills under a separate corporate entity name.
CORRECT ANSWER : B
, Rationale: Article 38(6) of the GDPR permits a DPO to undertake other tasks, provided they do
not result in a conflict of interests. Representing the controller in litigation involving data
subjects compromises professional independence and objectivity, violating core DPO mandates.
4. A cloud service provider acting as a data processor for a major German automotive manufacturer
discovers an unauthorized privilege escalation exploit affecting multi-tenant virtual machines.
Under GDPR Article 33, what are the precise legal obligations and timelines governing breach
notification?
A. The processor must notify affected data subjects directly within 24 hours of discovery.
B. The processor must notify the controller without undue delay upon becoming aware of a
personal data breach, enabling the controller to notify the supervisory authority within 72
hours.
C. The processor is exempt from all notification requirements if encryption-at-rest was enabled.
D. The processor must publish a public advisory on the European Commission portal within 7
days.
CORRECT ANSWER : B
Rationale: Processors do not notify supervisory authorities directly under standard GDPR rules;
instead, Article 33(2) mandates that processors notify controllers without undue delay. The
controller then bears the responsibility to notify the competent supervisory authority within 72
hours.
5. A global social media corporation transfers user telemetry data from its Irish operating entity to
servers located in Virginia, USA, relying on the EU-U.S. Data Privacy Framework. A privacy
advocacy group challenges the adequacy framework, pointing to extensive U.S. intelligence
surveillance under FISA Section 702. What fundamental legal standard governs the validity of
such data transfers under Chapter V of the GDPR?
A. Transfers are prohibited unless the destination country matches EU member state GDP levels.
B. Transfers require an adequacy decision ensuring an essentially equivalent level of
protection to that guaranteed within the EU, or the implementation of binding and effective
appropriate safeguards.
C. Any commercial entity certified under a self-assessment scheme is automatically immune
from Chapter V restrictions.
D. adequacy is judged solely on the presence of standard commercial arbitration clauses in user
terms of service.
CORRECT ANSWER : B
, Rationale: Following established Court of Justice of the European Union (CJEU) jurisprudence
(Schrems rulings), transfers based on adequacy frameworks or alternative tools must guarantee
an level of protection essentially equivalent to that guaranteed inside the EU.
6. A retail chain in Milan implements biometric facial recognition cameras at store entrances to
track repeat shoplifters. The system captures facial geometry, converts it into a mathematical
hash, and compares it against a local watchlist. The retailer argues this processing is justified
under legitimate interest (Article 6(1)(f)). How does the GDPR classify biometric data processed
for unique identification?
A. Standard personal data subject to standard balancing tests under legitimate interest.
B. Special category data under Article 9, which is strictly prohibited unless an explicit
exemption such as substantial public interest or explicit consent applies.
C. Anonymous data, completely outside the material scope of the GDPR.
D. Traffic data governed exclusively by the ePrivacy Directive without GDPR overlap.
CORRECT ANSWER : B
Rationale: Under Article 9, biometric data processed for the purpose of uniquely identifying a
natural person is classified as special category data. General legitimate interest under Article
6(1)(f) is insufficient; an Article 9 exemption must also be satisfied.
7. A multinational pharmaceutical company conducts clinical trials across Spain, Sweden, and
Poland, collecting genetic and health records from thousands of trial participants. The company
designates its research headquarters in Madrid as the single point of contact for all regulatory
filings. Which supervisory authority is designated as the "lead supervisory authority" for cross-
border processing under the GDPR?
A. The supervisory authority of the data subject's country of birth in every individual case.
B. The supervisory authority of the main establishment of the controller in the EU, which
in this scenario is Spain (AEPD).
C. The European Medicines Agency (EMA) in Amsterdam.
D. A rotating committee managed by the European Parliament.
CORRECT ANSWER : B
Rationale: The lead supervisory authority concept under Article 56 assigns primary competence
to the supervisory authority of the controller's main establishment in the EU for cross-border
processing activities.
