CIPM Questions and AnswersCIPM Questions and Answers

1 | Page



CIPM Questions and Answers

What are the 5 phases of a privacy program audit
Ans: Planning, Preparation, Audit, Report, Followup

What happens during the audit planning phase of PPARF?
Ans: Risk assessment, schedule, selecting auditor, pre-audit
questionnaire, preparatory meeting/visit and checklist

What happens during the Audit Preparation phase of PPARF?
Ans: Confirm schedule, confirm and prepare checklists, sampling
criteria and audit plan

What Happens during the Audit phase of PPARF?
Ans: Meeting and audit execution

What happens during the report phase of PPARF?
Ans: Noncompliance records and categories (major/minor), audit report,
closing meeting and distribution

What happens during the followup phase of PPARF?
Ans: Confirm scope, schedule, methodology and closure

What are the three types of privacy governance models? (privacy
governance may be "___, _____, or ______."
Ans: Centralized, Localized, or Hybrid

When creating your privacy office governance model, you should
consider what 4 factors?




© 2025 All rights reserved

, 2 | Page

Ans: 1. existing organisational structure,
2. position and authority of the privacy team,
3. involvement level of senior leadership and internal stakeholder
4. The development of internal partnerships.

What are the advantages/disadvantages of the hybrid governance
model?
Ans: Advantage: Resources of larger centralized org


Disadvantage: Decentralized decision making provides less big picture
vision

What are the 5 maturity levels of the GAPP Privacy Maturity
Model?
Ans: 1. Ad Hoc
2. Repeatable
3. Defined
4. Managed
5. Optimized (ARDMO)

What are the 5 mechanisms that allow organizations to transfer
data across borders? (there is something else you must also have)




© 2025 All rights reserved

, 3 | Page

Ans: 1. Adequacy Decisions
2. Ad Hoc Contracts
3. Standard Contractual Clauses
4.Binding Corporate Rules
5. Codes of Conduct/Self Certification Mechanisms


(You must also have legal basis for processing data in addition to any of
these prior to transfer)

What are the 5 useful stages of the effective Policy Lifecycle?
Ans: 1. Draft practical polices, working with legal, to draft aligned and
consistent policies.
2. Get approval from decision makers/stakeholders
3. Disseminate to all employees
4. Train and enforce policies
5. Review and revise policies (like after a breach or incident, or merger)

Describe the 5 GAPP program maturity levels in order




© 2025 All rights reserved

, 4 | Page

Ans: 1. Ad Hoc - Process & Procedures: Informal, Incomplete,
Inconsistently applied


2. Repeatable - Process & procedures: Not fully complete / Do not cover
all relevant aspects


3. Defined - Process & procedures: Fully Documented, implemented,
cover all relevant aspects


4. Managed - Reviews conducted to assess effectiveness of controls in
place


5. Optimized - Regular Reviews / Feedback are used to ensure continual
improvement toward optimisation of a given process

Describe Adequacy Decisions
Ans: "Adequacy" means that one country (or jurisdiction, such as the EU)
has deemed another country's data protection laws "adequate" to
safeguard its own data.

Describe Ad Hoc Contracts
Ans: Ad hoc contractual clauses may also be used for GDPR compliance,
although they must receive prior supervisory authority approval and
thus are potentially a less attractive option for controllers.

Describe Standard Contractual Clauses
Ans: A standard contractual clause (language written into a contract)
may be a way for organisations to facilitate cross-border transfers


(these have been challenged recently and decisions are pending in the
EUCJ)

Describe Binding Corporate Rules & the 5 things they must
include:
© 2025 All rights reserved