CIPP US EXAM 2 2025/2026 QUESTIONS WITH ANSWERS
GRADED A+
✔✔Model Contract = - ✔✔Another way for onward transfer of data from EU. 2001/2003.
✔✔3 attitudes towards privacy of PI - ✔✔1. Privacy Concerned
2. Privacy Unconcerned
3. Privacy Pragmatic
✔✔Major risks from using PI improperly - ✔✔1. Legal
2. Reputational
3. Operational (efficient, cost-effective?)
4. Investment (ROI in information)
✔✔4 basic steps for Info Management (IM) Program - ✔✔DBCE
1. Discover (issue-ID, self assessment; best practice determination)
2. Build (Develop & verify procedures; full implementation)
3. Communicate (Documentation; Education)
4. Evolve (Affirmation & monitoring; Adaptation)
✔✔Data Inventory = - ✔✔a. all PI org collects, stores, uses, or discloses
b. both within org and to outside entities
c. locations of data
d. flow of data
e. any sharing info
f. means of data transfer on sharing
* Required for some orgs, e.g., GLBA Safeguards Rule orgs
✔✔Data Classification = - ✔✔By sensitivity level. More sensitive => greater protection..
Segregate most sensitive; use access controls.
E.g.: confidential, proprietary, sensitive, restricted, public.
✔✔Data Flows documentation aid = - ✔✔Org chart
✔✔Data Accountability Design Issues - ✔✔1. Storage (where, how, duration)
2. Sensitivity of info
3. Encryption or not?
4. Onward Transfer issues
5. Who determines the rules that apply to the info? (Controller?)
6. How processed?
7. PI use dependent on any other systems? If so, eval/update.
✔✔Privacy Policies: Decisions - ✔✔Inward-looking docs for organizational users of PI.
Issues:
1. One or multiple? (Joint?)
, 2. Formation: Legal rev; Exec approval
3. Revisions? Tell E'ees and then notice to current/former customers. *EXPRESS aff
consent opt-in before making material retroactive changes (FTC).
4. Communicating policy through a Notice: (a) accessible in places of biz; (b) accessible
online; (c) provide updates and revisions; (d) ensure appropriate personnel are
knowledgeable.
5. Policy Version Control (date, version #)
✔✔Issues in managing users' choices - ✔✔1. Scope: how broad?
2. Mechanism: How express? "The channel for marketing should be the channel for
exercising a user preference."
3. Linking of a user's interactions through multiple channels: "The org should implement
the opt-out or other user pref across channels and platforms."
4. Time period to implement (e.g., CAN-SPAM)
5. 3rd party vendors must honor the user preference
✔✔Access & Redress Guidelines - ✔✔APEC Principles (3 of access, 3 exceptions)
1. Able to get from controller whether it has info about Individ
2. Be told PI * in reasonable time period * at not excessive charge * in reasonable
manner * in generally understandable form
3. Challenge accuracy & get info rectified, completed, amended, or deleted
** If a request is denied, provide reasons why and let challenge.**
EXCEPTIONS
1. Burden or expense unreasonable or disproportionate
2. Info shouldn't be disclosed b/c of legal, security, or commercial proprietary reasons
3. Info privacy of other persons would be violated.
✔✔Vendor Contract Issues = - ✔✔1. Confidentiality provision
2. No further use of shared info
3. If subcontractors, must follow same priv/sec terms.
4. Requirement to notify and disclose breach
5. Info Security Provisions: specific security controls; encryption & when; network
security; access controls; segregation; E'ee bkgrnd checks; audit rights; etc.
✔✔How to do Due Diligence on Vendors: - ✔✔1. Reputation
2. Financial condition & insurance
3. Info security controls in place
4. Point of transfer/ secure mechanism of transfer
5. Info Disposal (see, e.g., FACTA/FCRA Disposal rule)
6. E'ee training & user awareness
7. Vendor incident response provisions
✔✔History of special protection for health info - ✔✔...
✔✔HIPAA - ✔✔(1996) Health Insurance Portability & Accountability Act
GRADED A+
✔✔Model Contract = - ✔✔Another way for onward transfer of data from EU. 2001/2003.
✔✔3 attitudes towards privacy of PI - ✔✔1. Privacy Concerned
2. Privacy Unconcerned
3. Privacy Pragmatic
✔✔Major risks from using PI improperly - ✔✔1. Legal
2. Reputational
3. Operational (efficient, cost-effective?)
4. Investment (ROI in information)
✔✔4 basic steps for Info Management (IM) Program - ✔✔DBCE
1. Discover (issue-ID, self assessment; best practice determination)
2. Build (Develop & verify procedures; full implementation)
3. Communicate (Documentation; Education)
4. Evolve (Affirmation & monitoring; Adaptation)
✔✔Data Inventory = - ✔✔a. all PI org collects, stores, uses, or discloses
b. both within org and to outside entities
c. locations of data
d. flow of data
e. any sharing info
f. means of data transfer on sharing
* Required for some orgs, e.g., GLBA Safeguards Rule orgs
✔✔Data Classification = - ✔✔By sensitivity level. More sensitive => greater protection..
Segregate most sensitive; use access controls.
E.g.: confidential, proprietary, sensitive, restricted, public.
✔✔Data Flows documentation aid = - ✔✔Org chart
✔✔Data Accountability Design Issues - ✔✔1. Storage (where, how, duration)
2. Sensitivity of info
3. Encryption or not?
4. Onward Transfer issues
5. Who determines the rules that apply to the info? (Controller?)
6. How processed?
7. PI use dependent on any other systems? If so, eval/update.
✔✔Privacy Policies: Decisions - ✔✔Inward-looking docs for organizational users of PI.
Issues:
1. One or multiple? (Joint?)
, 2. Formation: Legal rev; Exec approval
3. Revisions? Tell E'ees and then notice to current/former customers. *EXPRESS aff
consent opt-in before making material retroactive changes (FTC).
4. Communicating policy through a Notice: (a) accessible in places of biz; (b) accessible
online; (c) provide updates and revisions; (d) ensure appropriate personnel are
knowledgeable.
5. Policy Version Control (date, version #)
✔✔Issues in managing users' choices - ✔✔1. Scope: how broad?
2. Mechanism: How express? "The channel for marketing should be the channel for
exercising a user preference."
3. Linking of a user's interactions through multiple channels: "The org should implement
the opt-out or other user pref across channels and platforms."
4. Time period to implement (e.g., CAN-SPAM)
5. 3rd party vendors must honor the user preference
✔✔Access & Redress Guidelines - ✔✔APEC Principles (3 of access, 3 exceptions)
1. Able to get from controller whether it has info about Individ
2. Be told PI * in reasonable time period * at not excessive charge * in reasonable
manner * in generally understandable form
3. Challenge accuracy & get info rectified, completed, amended, or deleted
** If a request is denied, provide reasons why and let challenge.**
EXCEPTIONS
1. Burden or expense unreasonable or disproportionate
2. Info shouldn't be disclosed b/c of legal, security, or commercial proprietary reasons
3. Info privacy of other persons would be violated.
✔✔Vendor Contract Issues = - ✔✔1. Confidentiality provision
2. No further use of shared info
3. If subcontractors, must follow same priv/sec terms.
4. Requirement to notify and disclose breach
5. Info Security Provisions: specific security controls; encryption & when; network
security; access controls; segregation; E'ee bkgrnd checks; audit rights; etc.
✔✔How to do Due Diligence on Vendors: - ✔✔1. Reputation
2. Financial condition & insurance
3. Info security controls in place
4. Point of transfer/ secure mechanism of transfer
5. Info Disposal (see, e.g., FACTA/FCRA Disposal rule)
6. E'ee training & user awareness
7. Vendor incident response provisions
✔✔History of special protection for health info - ✔✔...
✔✔HIPAA - ✔✔(1996) Health Insurance Portability & Accountability Act
