CIPP US TEST PAPERS 2025/2026 QUESTIONS WITH
ANSWERS GRADED A+
✔✔What are the four phases of privacy program development? - ✔✔1. Discover
- Issue identification
- Identify best practices
- Perform PIA
2. Build
- Procedure development and identification
- Full implementation
3. Communicate
- Documentation (Training and Awareness)
4. Evolve
- Affirmation and Monitoring
- Adaptation
✔✔What are the elements of data sharing and transfer? - ✔✔1. Data inventory
2. Data classification
3. Data flows
4. Accountability
✔✔What are the four elements of privacy policies and disclosure? - ✔✔1. How many
policies?
2. Policy review and approval
3. Privacy notice
4. Policy version control
✔✔What are the six phases of privacy incident response programs? - ✔✔1. Detection
2. Prevent further activity
3. Investigation
4. Notice
5. Review
6. Corrective actions
✔✔What are the three elements of data subject preference and access - ✔✔1. Opt-in,
opt-out, no option
2. Managing preferences
3. Access and redress
✔✔What are the two elements of vendor management? - ✔✔1. Contracts
- Confidentiality
- No further use
- Subcontractors
- Breach disclosure
- Information security
,2. Due diligence
- Reputation
- Financial condition, insurance
- Information security
- Point of transfer
- Disposal
- Training and user awareness
- Incident response
✔✔Which branch of the U.S. Federal Government makes laws? - ✔✔Legislative
✔✔Where is privacy mentioned in the U.S. Constitution? - ✔✔It's not. Usually privacy
falls under the 4th amendment.
✔✔What federal agency is the most active in enforcing privacy rights? - ✔✔FTC
✔✔How does punishment differ in civil and criminal cases? - ✔✔Civil punishments are
compensation such as monetary and injunctive while criminal punishments include fine,
incarceration, and death.
✔✔When an FTC investigation finds a company guilty of violating privacy, what are its
two recourses? - ✔✔1. Administrative trial
2. Consent decree
✔✔What was the basis of the FTC's findings against BJ's Wholesale Club? - ✔✔Unfair
practices because private data was not encrypted during transmission
✔✔What are the six questions you should ask in understanding a law? - ✔✔1. Who is
covered by this law?
2. What types of information and what uses of information are covered?
3. What exactly is required and/or prohibited?
4. Who enforces the law?
5. What happens if I don't comply?
6. Why does this law exist?
✔✔Define civil litigation - ✔✔Disputes between individuals and/or organizations
✔✔Define criminal litigation - ✔✔Legal punishment of criminal offenses
✔✔Who initiates civil litigation? - ✔✔Private party
✔✔Who initiates criminal litigation? - ✔✔Government
✔✔What is the burden of proof for civil litigation? - ✔✔Preponderance of evidence
,✔✔What is the burden of proof for criminal litigation? - ✔✔Reyond a reasonable doubt
✔✔List the five theories of legal liability - ✔✔1. Negligence - absence of, or failure to
exercise, proper or ordinary care.
2. Breach of Warranty - failure of a seller to fulfill the terms of a promise, claim, or
representation.
3. Misrepresentation - false security about the safety of a particular product.
4. Defamation - an untruth about another which untruth will harm the reputation of the
person defamed (wrtten defamation is libel; oral defamation is slander).
5. Strict tort liability - extending the responsibility of the vendor or manufacturer to all
individuals who might be injured by the product.
✔✔What does article 5 of the FTC Act declare unlawful? - ✔✔unfair or deceptive acts or
practices in or affecting commerce.
✔✔What is Children's Online Privacy Protection Act of 1998 (COPPA)? - ✔✔1.
Regulates collection and use of children's information by commercial website operators.
2. Compels website owners to adhere to specific notice and choice practices.
3. Applies to websites and services targeted to children under 13.
✔✔Who handles the enforcement of COPPA? - ✔✔FTC
✔✔Who handles the enforcement of CAN-SPAM? - ✔✔FTC
✔✔What does the FTC consider a deceptive practice? - ✔✔Saying one thing and
completely going against it
✔✔What does the FTC consider an unfair practice? - ✔✔When reasonable practice are
not being followed
✔✔What does the "Consumer Privacy Bill of Rights" emphasize? - ✔✔1. Privacy by
Design
2. Simplified choice
3. Transparency
✔✔What does the "Consumer Privacy Bill of Rights" prioritize? - ✔✔1. Do not track
2. Mobile
3. Large platform providers
4. Enforceable self-regulation
✔✔What are the three goals of APEC Cross-border Privacy Enforcement Arrangement
(CPEA) - ✔✔1. Facilitate information sharing
2. Promote effective cross-border cooperation
3. Encourage information sharing and investigative/enforcement cooperation
, ✔✔What are the three components of self-regulatory enforcement? - ✔✔1. Legislation -
Who determines the rules?
2. Enforcement - Who initiates actions?
3. Ajudication - Who decides if something is in violation?
✔✔What does HIPAA require? - ✔✔Covered entities to protect health information that is
transmitted or maintained in any form or medium
✔✔List the three HIPAA covered entities - ✔✔1. Healthcare providers that conduct
transactions in electronic form
2. Health insurers
3. Health clearinghouses
✔✔Does HIPAA preempt stronger state laws? - ✔✔No
✔✔Who enforces HIPAA? - ✔✔The U.S. Department of Health & Human Services
(HHS)
✔✔What are the punishments for non-compliance of HIPAA? - ✔✔Fines up to $250K
and/or 10 years imprisonment
✔✔What are the elements of the HIPAA Privacy Rule? - ✔✔1. Privacy notice
2. Authorizations for use and disclosure
3. "Minimum necessary" use and disclosure
4. Access and accounting of disclosures
5. Safeguards
6. Accountability
7. De-identification
8. Research
9. Other exceptions (law enforcement investigations)
✔✔What are the elements of the HIPAA Security Rule? - ✔✔1. Confidentiality, integrity
and availability of ePHI
2. Protection against threats to ePHI
3. No unreasonable uses or disclosures of information not required under the Privacy
Rule
✔✔Health Information Technology for Economic and Clinical Health, 2009 (HITECH) -
✔✔1. Enacted as a part of the American Recovery and Reinvestment Act of 2009.
2. Amends HIPAA
- Regulates personal health records (PHR)
- Covered entities and PHR vendors must provide breach notification to consumers,
HHS and FTC
- Extends HIPAA safeguard and breach notice requirements to business associates
ANSWERS GRADED A+
✔✔What are the four phases of privacy program development? - ✔✔1. Discover
- Issue identification
- Identify best practices
- Perform PIA
2. Build
- Procedure development and identification
- Full implementation
3. Communicate
- Documentation (Training and Awareness)
4. Evolve
- Affirmation and Monitoring
- Adaptation
✔✔What are the elements of data sharing and transfer? - ✔✔1. Data inventory
2. Data classification
3. Data flows
4. Accountability
✔✔What are the four elements of privacy policies and disclosure? - ✔✔1. How many
policies?
2. Policy review and approval
3. Privacy notice
4. Policy version control
✔✔What are the six phases of privacy incident response programs? - ✔✔1. Detection
2. Prevent further activity
3. Investigation
4. Notice
5. Review
6. Corrective actions
✔✔What are the three elements of data subject preference and access - ✔✔1. Opt-in,
opt-out, no option
2. Managing preferences
3. Access and redress
✔✔What are the two elements of vendor management? - ✔✔1. Contracts
- Confidentiality
- No further use
- Subcontractors
- Breach disclosure
- Information security
,2. Due diligence
- Reputation
- Financial condition, insurance
- Information security
- Point of transfer
- Disposal
- Training and user awareness
- Incident response
✔✔Which branch of the U.S. Federal Government makes laws? - ✔✔Legislative
✔✔Where is privacy mentioned in the U.S. Constitution? - ✔✔It's not. Usually privacy
falls under the 4th amendment.
✔✔What federal agency is the most active in enforcing privacy rights? - ✔✔FTC
✔✔How does punishment differ in civil and criminal cases? - ✔✔Civil punishments are
compensation such as monetary and injunctive while criminal punishments include fine,
incarceration, and death.
✔✔When an FTC investigation finds a company guilty of violating privacy, what are its
two recourses? - ✔✔1. Administrative trial
2. Consent decree
✔✔What was the basis of the FTC's findings against BJ's Wholesale Club? - ✔✔Unfair
practices because private data was not encrypted during transmission
✔✔What are the six questions you should ask in understanding a law? - ✔✔1. Who is
covered by this law?
2. What types of information and what uses of information are covered?
3. What exactly is required and/or prohibited?
4. Who enforces the law?
5. What happens if I don't comply?
6. Why does this law exist?
✔✔Define civil litigation - ✔✔Disputes between individuals and/or organizations
✔✔Define criminal litigation - ✔✔Legal punishment of criminal offenses
✔✔Who initiates civil litigation? - ✔✔Private party
✔✔Who initiates criminal litigation? - ✔✔Government
✔✔What is the burden of proof for civil litigation? - ✔✔Preponderance of evidence
,✔✔What is the burden of proof for criminal litigation? - ✔✔Reyond a reasonable doubt
✔✔List the five theories of legal liability - ✔✔1. Negligence - absence of, or failure to
exercise, proper or ordinary care.
2. Breach of Warranty - failure of a seller to fulfill the terms of a promise, claim, or
representation.
3. Misrepresentation - false security about the safety of a particular product.
4. Defamation - an untruth about another which untruth will harm the reputation of the
person defamed (wrtten defamation is libel; oral defamation is slander).
5. Strict tort liability - extending the responsibility of the vendor or manufacturer to all
individuals who might be injured by the product.
✔✔What does article 5 of the FTC Act declare unlawful? - ✔✔unfair or deceptive acts or
practices in or affecting commerce.
✔✔What is Children's Online Privacy Protection Act of 1998 (COPPA)? - ✔✔1.
Regulates collection and use of children's information by commercial website operators.
2. Compels website owners to adhere to specific notice and choice practices.
3. Applies to websites and services targeted to children under 13.
✔✔Who handles the enforcement of COPPA? - ✔✔FTC
✔✔Who handles the enforcement of CAN-SPAM? - ✔✔FTC
✔✔What does the FTC consider a deceptive practice? - ✔✔Saying one thing and
completely going against it
✔✔What does the FTC consider an unfair practice? - ✔✔When reasonable practice are
not being followed
✔✔What does the "Consumer Privacy Bill of Rights" emphasize? - ✔✔1. Privacy by
Design
2. Simplified choice
3. Transparency
✔✔What does the "Consumer Privacy Bill of Rights" prioritize? - ✔✔1. Do not track
2. Mobile
3. Large platform providers
4. Enforceable self-regulation
✔✔What are the three goals of APEC Cross-border Privacy Enforcement Arrangement
(CPEA) - ✔✔1. Facilitate information sharing
2. Promote effective cross-border cooperation
3. Encourage information sharing and investigative/enforcement cooperation
, ✔✔What are the three components of self-regulatory enforcement? - ✔✔1. Legislation -
Who determines the rules?
2. Enforcement - Who initiates actions?
3. Ajudication - Who decides if something is in violation?
✔✔What does HIPAA require? - ✔✔Covered entities to protect health information that is
transmitted or maintained in any form or medium
✔✔List the three HIPAA covered entities - ✔✔1. Healthcare providers that conduct
transactions in electronic form
2. Health insurers
3. Health clearinghouses
✔✔Does HIPAA preempt stronger state laws? - ✔✔No
✔✔Who enforces HIPAA? - ✔✔The U.S. Department of Health & Human Services
(HHS)
✔✔What are the punishments for non-compliance of HIPAA? - ✔✔Fines up to $250K
and/or 10 years imprisonment
✔✔What are the elements of the HIPAA Privacy Rule? - ✔✔1. Privacy notice
2. Authorizations for use and disclosure
3. "Minimum necessary" use and disclosure
4. Access and accounting of disclosures
5. Safeguards
6. Accountability
7. De-identification
8. Research
9. Other exceptions (law enforcement investigations)
✔✔What are the elements of the HIPAA Security Rule? - ✔✔1. Confidentiality, integrity
and availability of ePHI
2. Protection against threats to ePHI
3. No unreasonable uses or disclosures of information not required under the Privacy
Rule
✔✔Health Information Technology for Economic and Clinical Health, 2009 (HITECH) -
✔✔1. Enacted as a part of the American Recovery and Reinvestment Act of 2009.
2. Amends HIPAA
- Regulates personal health records (PHR)
- Covered entities and PHR vendors must provide breach notification to consumers,
HHS and FTC
- Extends HIPAA safeguard and breach notice requirements to business associates
