1 | Page
CIPM - IAPP Questions and Answers
Strategic Management is the first high level necessary task to
implement proactive privacy management through the following 3
subtasks:
Ans: (1) Define Privacy Vision and Privacy Mission Statement (2) Develop
Privacy Strategy (3) Structure Privacy Team
Strategic management of privacy starts by creating or updating
the organization vision and mission statement based on privacy
best practices that should include:
Ans: (1) Develop vision and mission statement objectives (2) Define
privacy program scope (3) Identify legal and regulatory compliance
challenges (4) Identify organization personal information legal
requirements
Define Privacy Program Scope
Ans: 1) Identify & Understand Legal and Regulatory Compliance
Challenges ii) Identify the Data Impacted
Types of Protection Models (4)
Ans: i) Sectoral (US) ii) Comprehensize (EU, Canada, Russia) iii) Co-
Regulatory (Australia) iv) Self Regulated (US, Japan, Singapore)
Questions to Ask When Determining Privacy Requirements (Legal)
© 2025 All rights reserved
, 2 | Page
Ans: - Who collects, uses, maintians Personal Information
- What are the types of Personal Information
- What are the legal requirements for the PI
- Where is the PI stored
- How is the PI collected
- Why is the PI collected
Steps to Developing a Privacy Strategy (5)
Ans: i) ID Stakeholders and Internal Partnerships ii) Leverage Key
Functions iii) Create a Process for Interfacing iv) Develop a Data
Governance Strategy v) Conduct a Privacy Workshop
Data Governance Models (3)
Ans: i) Centralized
ii) Local/Decentralized
iii) Hybrid
What is a Privacy Program Framework?
Ans: Implementation roadmap that provides structure or checklists to
guide privacy professionals through management and prompts for
details to determine privacy relevant decisions.
Popular Frameworks (6)
Ans: APEC Privacy - regional data transfers
PIPEDA (Canada)
AIPP (Australian)
OCED
Privacy by Design
US Government
Steps to Develop Privacy Policies, Standards, Guidelines (4)
© 2025 All rights reserved
, 3 | Page
Ans: i) Assessment of Business Case ii) Gap Analysis iii) Review &
Monitor iv) Communicate
Business Case
Ans: Defines individual program needs and way to meet specific goals.
- Org Privacy Guidance
- Define Privacy
- Laws/Regs
- Technical Controls
- External Privacy Orgs
- Frameworks
- Privacy Enhancing Tech (PETs)
- Education/Awareness
- Program Assurance
What are the 4 Parts of the Privacy Operational Life Cycle
Ans: i) Assess ii) Protect iii) Sustain iv) Respond
5 Maturity Levels of the AICPA/CICA Privacy Maturity Model?
Ans: i) Ad Hoc - Procedures informal, incomplete, inconsistently applied
(not written) ii) Repeatable - Procedures exist, partially documented,
don't cover all areas iii) Defined - All documented, implemented, cover
all relevant aspects iv) Managed - Reviews conducted assess
effectiveness of controls v) Optimized - Regular reviews and feedback to
ensure continuous improvements.
Privacy Assessment Approach (Key Areas)
Ans: i) Internal Audit & Risk Management ii) Information Tech & IT
Operations/Development iii) Information Security iv) HR/Ethics v)
Legal/Contracts vi) Process/3rd Party Vendors vii) Marketing/Sales viii)
Government Relations ix) Accounting/Finance
11 Principles of the Data Life Cycle Management Model
© 2025 All rights reserved
, 4 | Page
Ans: i) Enterprise Objectives ii) Minimalism iii) Simplicity of Procedures
& Training iv) Adequacy of Infrastructure v) Information Security vi)
Authenticity and Accuracy of Records vii) Retrievabiliyt viii) Distribution
Controls ix) Auditability x) Consistency of Policies xi) Enforcement
What is CIA & AA
Ans: Confidentiality, Integrity, Availability & Accountability, Assurance
What is the difference between positive & negative controls?
Ans: Positive - Enable privacy and business practices (win/win)
Negative - Enable privacy but constrain business (win/lose)
What are the 3 high level security roles?
Ans: i) Executive
ii) Functional
iii) Corollary
What are the 7 foundation principles of Privacy by Design?
Ans: i) Proactive not Reactive; Preventative not Remedial ii) Privacy as
Default Setting iii) Privacy Embedded into Design iv) Full Funcationality
v) End to End Security (Throughout Lifecyle) vi) Visibility and
Transparency vii) Respect for User Privacy
3 keys to Sustainment?
Ans: i) Monitor
ii) Audit
iii) Communicate
4 keys to Response?
Ans: i) Information Request ii) Legal Compliance iii) Incident Response
Planning iv) Incident Handling
Proactive privacy management is accomplished through three
tasks
© 2025 All rights reserved
CIPM - IAPP Questions and Answers
Strategic Management is the first high level necessary task to
implement proactive privacy management through the following 3
subtasks:
Ans: (1) Define Privacy Vision and Privacy Mission Statement (2) Develop
Privacy Strategy (3) Structure Privacy Team
Strategic management of privacy starts by creating or updating
the organization vision and mission statement based on privacy
best practices that should include:
Ans: (1) Develop vision and mission statement objectives (2) Define
privacy program scope (3) Identify legal and regulatory compliance
challenges (4) Identify organization personal information legal
requirements
Define Privacy Program Scope
Ans: 1) Identify & Understand Legal and Regulatory Compliance
Challenges ii) Identify the Data Impacted
Types of Protection Models (4)
Ans: i) Sectoral (US) ii) Comprehensize (EU, Canada, Russia) iii) Co-
Regulatory (Australia) iv) Self Regulated (US, Japan, Singapore)
Questions to Ask When Determining Privacy Requirements (Legal)
© 2025 All rights reserved
, 2 | Page
Ans: - Who collects, uses, maintians Personal Information
- What are the types of Personal Information
- What are the legal requirements for the PI
- Where is the PI stored
- How is the PI collected
- Why is the PI collected
Steps to Developing a Privacy Strategy (5)
Ans: i) ID Stakeholders and Internal Partnerships ii) Leverage Key
Functions iii) Create a Process for Interfacing iv) Develop a Data
Governance Strategy v) Conduct a Privacy Workshop
Data Governance Models (3)
Ans: i) Centralized
ii) Local/Decentralized
iii) Hybrid
What is a Privacy Program Framework?
Ans: Implementation roadmap that provides structure or checklists to
guide privacy professionals through management and prompts for
details to determine privacy relevant decisions.
Popular Frameworks (6)
Ans: APEC Privacy - regional data transfers
PIPEDA (Canada)
AIPP (Australian)
OCED
Privacy by Design
US Government
Steps to Develop Privacy Policies, Standards, Guidelines (4)
© 2025 All rights reserved
, 3 | Page
Ans: i) Assessment of Business Case ii) Gap Analysis iii) Review &
Monitor iv) Communicate
Business Case
Ans: Defines individual program needs and way to meet specific goals.
- Org Privacy Guidance
- Define Privacy
- Laws/Regs
- Technical Controls
- External Privacy Orgs
- Frameworks
- Privacy Enhancing Tech (PETs)
- Education/Awareness
- Program Assurance
What are the 4 Parts of the Privacy Operational Life Cycle
Ans: i) Assess ii) Protect iii) Sustain iv) Respond
5 Maturity Levels of the AICPA/CICA Privacy Maturity Model?
Ans: i) Ad Hoc - Procedures informal, incomplete, inconsistently applied
(not written) ii) Repeatable - Procedures exist, partially documented,
don't cover all areas iii) Defined - All documented, implemented, cover
all relevant aspects iv) Managed - Reviews conducted assess
effectiveness of controls v) Optimized - Regular reviews and feedback to
ensure continuous improvements.
Privacy Assessment Approach (Key Areas)
Ans: i) Internal Audit & Risk Management ii) Information Tech & IT
Operations/Development iii) Information Security iv) HR/Ethics v)
Legal/Contracts vi) Process/3rd Party Vendors vii) Marketing/Sales viii)
Government Relations ix) Accounting/Finance
11 Principles of the Data Life Cycle Management Model
© 2025 All rights reserved
, 4 | Page
Ans: i) Enterprise Objectives ii) Minimalism iii) Simplicity of Procedures
& Training iv) Adequacy of Infrastructure v) Information Security vi)
Authenticity and Accuracy of Records vii) Retrievabiliyt viii) Distribution
Controls ix) Auditability x) Consistency of Policies xi) Enforcement
What is CIA & AA
Ans: Confidentiality, Integrity, Availability & Accountability, Assurance
What is the difference between positive & negative controls?
Ans: Positive - Enable privacy and business practices (win/win)
Negative - Enable privacy but constrain business (win/lose)
What are the 3 high level security roles?
Ans: i) Executive
ii) Functional
iii) Corollary
What are the 7 foundation principles of Privacy by Design?
Ans: i) Proactive not Reactive; Preventative not Remedial ii) Privacy as
Default Setting iii) Privacy Embedded into Design iv) Full Funcationality
v) End to End Security (Throughout Lifecyle) vi) Visibility and
Transparency vii) Respect for User Privacy
3 keys to Sustainment?
Ans: i) Monitor
ii) Audit
iii) Communicate
4 keys to Response?
Ans: i) Information Request ii) Legal Compliance iii) Incident Response
Planning iv) Incident Handling
Proactive privacy management is accomplished through three
tasks
© 2025 All rights reserved
