CIPP E EXAM (ACTUAL 2024-2025) QUESTIONS
AND THEIR WELL DETAILED ANSWERS
GRADED A+
Q: Did ABC violate GDPR by not sending the data to the new
insurance company? - ---ANSWERS_____A: No, because
sending it is not possible. Undue strain on the company to
send it which infringes on their rights. PDF format is enough.
Guy runs a social media company for small businesses along
with a few other things. Sends data to Hermes for Sub
Processing - they then use the data to create ads on their
personal website. Girl accidentally posts her business plan in
the chat function of the website and leaves it for 2 weeks.Goes
to SA about data breach. Serge posts a quote on his Social
Media page and this ends up as a quotation on the main site
attributed to Serge
Q: Why would the girl who leaked her business plan likely
not have a case with GDPR: - ---ANSWERS_____A:Because
of the nature of the data (I chose this one because it was a
business plan and likely did not contain personal data)
Q: Data subject notice required? - ---ANSWERS_____- With
out undue delay Only if this results in a HIGH risk to the
rights and subjects of natural persons
4% or 20M Euros - ---ANSWERS_____Tier 1
o violation ofConsent, Access, Purposes of Processing are the
MOST SEVERE
o keeping data subject from exercising his/her rights
o international data transfer protocol violation
, CIPP E EXAM (ACTUAL 2024-2025) QUESTIONS
AND THEIR WELL DETAILED ANSWERS
GRADED A+
2% or 10M Euros - ---ANSWERS_____Tier 2
o Violation of technical organization measures(think smaller,
day-to-day tasks that might be violated)
Q: How long does one DPA have to reply to another DPA on
a cooperation request? - ---ANSWERS_____- 1 month
What info needs to be provided to a Data Subject if their data
collected indirectly? - ---ANSWERS_____- Source of the
data
*If the data for DS is collected via indirect means what is the
controller's primary obligation? - ---ANSWERS_____Inform
the Data Subject about it.
****Safeguard under 'Article 42'? - keyword is "NEW" to
GDPR - ---ANSWERS_____- Certifications
What is Forum Shopping? - ---ANSWERS_____- Choosing
to place your Headquarters or Main Establishment in a State
with more relaxed Privacy laws
, CIPP E EXAM (ACTUAL 2024-2025) QUESTIONS
AND THEIR WELL DETAILED ANSWERS
GRADED A+
Lead SA questions? - ---ANSWERS_____Investigative
powers. They have the right to access data for investigational
purposes.
INVESTIGATE POWERS - ---ANSWERS_____they can
collect and if they can leverage penalties after controller has
been convicted in court of law
Company X contracts company Y to process. Company Y has
a breach, what is its first priority? - ---ANSWERS_____-
Inform company X immediately
What will an employer do with employee data once they are
terminated? - ---ANSWERS_____- They will keep data
legally required to keep
****CCTV - what would you NOT need to do first? - ---
ANSWERS_____- Create a retention policy
Question regarding in which scenario would GDPR apply - ---
ANSWERS_____- US citizen residing in EU purchases off of
US website. Would apply because EU resident.
***Processor has data on USBdrive that is breached, but then
deleted - why no notification needed to data subject? - ---
AND THEIR WELL DETAILED ANSWERS
GRADED A+
Q: Did ABC violate GDPR by not sending the data to the new
insurance company? - ---ANSWERS_____A: No, because
sending it is not possible. Undue strain on the company to
send it which infringes on their rights. PDF format is enough.
Guy runs a social media company for small businesses along
with a few other things. Sends data to Hermes for Sub
Processing - they then use the data to create ads on their
personal website. Girl accidentally posts her business plan in
the chat function of the website and leaves it for 2 weeks.Goes
to SA about data breach. Serge posts a quote on his Social
Media page and this ends up as a quotation on the main site
attributed to Serge
Q: Why would the girl who leaked her business plan likely
not have a case with GDPR: - ---ANSWERS_____A:Because
of the nature of the data (I chose this one because it was a
business plan and likely did not contain personal data)
Q: Data subject notice required? - ---ANSWERS_____- With
out undue delay Only if this results in a HIGH risk to the
rights and subjects of natural persons
4% or 20M Euros - ---ANSWERS_____Tier 1
o violation ofConsent, Access, Purposes of Processing are the
MOST SEVERE
o keeping data subject from exercising his/her rights
o international data transfer protocol violation
, CIPP E EXAM (ACTUAL 2024-2025) QUESTIONS
AND THEIR WELL DETAILED ANSWERS
GRADED A+
2% or 10M Euros - ---ANSWERS_____Tier 2
o Violation of technical organization measures(think smaller,
day-to-day tasks that might be violated)
Q: How long does one DPA have to reply to another DPA on
a cooperation request? - ---ANSWERS_____- 1 month
What info needs to be provided to a Data Subject if their data
collected indirectly? - ---ANSWERS_____- Source of the
data
*If the data for DS is collected via indirect means what is the
controller's primary obligation? - ---ANSWERS_____Inform
the Data Subject about it.
****Safeguard under 'Article 42'? - keyword is "NEW" to
GDPR - ---ANSWERS_____- Certifications
What is Forum Shopping? - ---ANSWERS_____- Choosing
to place your Headquarters or Main Establishment in a State
with more relaxed Privacy laws
, CIPP E EXAM (ACTUAL 2024-2025) QUESTIONS
AND THEIR WELL DETAILED ANSWERS
GRADED A+
Lead SA questions? - ---ANSWERS_____Investigative
powers. They have the right to access data for investigational
purposes.
INVESTIGATE POWERS - ---ANSWERS_____they can
collect and if they can leverage penalties after controller has
been convicted in court of law
Company X contracts company Y to process. Company Y has
a breach, what is its first priority? - ---ANSWERS_____-
Inform company X immediately
What will an employer do with employee data once they are
terminated? - ---ANSWERS_____- They will keep data
legally required to keep
****CCTV - what would you NOT need to do first? - ---
ANSWERS_____- Create a retention policy
Question regarding in which scenario would GDPR apply - ---
ANSWERS_____- US citizen residing in EU purchases off of
US website. Would apply because EU resident.
***Processor has data on USBdrive that is breached, but then
deleted - why no notification needed to data subject? - ---
