Canadian Privacy and Confidentiality
Law Compliance Exam Practice
Questions And Correct Answers
(Verified Answers) Plus Rationale 2026
Q&A| Instant Download Pdf
1. A Canadian healthcare organization collects patient data for treatment
purposes and later wants to use the same data for a research study.
Under privacy and confidentiality principles, what is the most legally
appropriate requirement before using the data for research?
A. The organization may proceed if the data is anonymized, regardless of
patient awareness
B. The organization may proceed without consent if the research is in the
public interest
C. The organization must obtain informed consent from patients or ensure
an approved ethics waiver applies
,D. The organization may proceed if internal management approves the
project
Answer: C
Rationale: Canadian privacy law and research ethics frameworks generally
require informed consent for secondary use of personal health information
unless a Research Ethics Board grants a waiver under strict conditions.
Anonymization alone does not always eliminate legal obligations if re-
identification risk exists.
2. Under the federal Personal Information Protection and Electronic
Documents Act (PIPEDA), which principle most directly requires
organizations to collect only the information necessary for identified
purposes?
A. Accountability
B. Identifying purposes
C. Limiting collection
D. Consent
Answer: C
Rationale: The limiting collection principle ensures organizations do not
gather excessive personal data and only collect what is necessary for
stated purposes.
, 3. A Canadian employer wants to install workplace surveillance cameras
in employee break rooms. What is the most legally appropriate
concern under privacy law?
A. Employees have no expectation of privacy in break rooms
B. Surveillance is always allowed if disclosed in a policy
C. Surveillance must be reasonable, necessary, and proportionate to a
legitimate purpose
D. Surveillance is only regulated in public spaces
Answer: C
Rationale: Privacy law requires that surveillance be justified, minimally
intrusive, and proportionate to a legitimate business purpose, even in
workplaces.
4. Which of the following best describes “personal information” under
Canadian privacy laws?
A. Any business data stored in electronic format
B. Information about an identifiable individual, directly or indirectly
C. Any data collected by government institutions only
D. Only financial records linked to individuals
Answer: B
Rationale: Personal information includes any data that can identify an
, individual directly or indirectly, such as names, identifiers, or combined
datasets.
5. A company collects customer emails for marketing. What is the most
important legal requirement before sending promotional emails in
Canada?
A. Prior verbal approval from management
B. Implied consent is always sufficient
C. Consent that is express, informed, or validly implied under CASL rules
D. No consent is required for existing customers
Answer: C
Rationale: Canadian Anti-Spam Legislation (CASL) requires valid consent—
express or implied under specific conditions—before sending commercial
electronic messages.
6. What is the primary role of a Privacy Impact Assessment (PIA)?
A. To determine employee salaries
B. To evaluate and mitigate privacy risks in a project involving personal data
C. To replace the need for consent
D. To eliminate all data collection risks entirely
Answer: B
Rationale: A PIA systematically identifies privacy risks and ensures
Law Compliance Exam Practice
Questions And Correct Answers
(Verified Answers) Plus Rationale 2026
Q&A| Instant Download Pdf
1. A Canadian healthcare organization collects patient data for treatment
purposes and later wants to use the same data for a research study.
Under privacy and confidentiality principles, what is the most legally
appropriate requirement before using the data for research?
A. The organization may proceed if the data is anonymized, regardless of
patient awareness
B. The organization may proceed without consent if the research is in the
public interest
C. The organization must obtain informed consent from patients or ensure
an approved ethics waiver applies
,D. The organization may proceed if internal management approves the
project
Answer: C
Rationale: Canadian privacy law and research ethics frameworks generally
require informed consent for secondary use of personal health information
unless a Research Ethics Board grants a waiver under strict conditions.
Anonymization alone does not always eliminate legal obligations if re-
identification risk exists.
2. Under the federal Personal Information Protection and Electronic
Documents Act (PIPEDA), which principle most directly requires
organizations to collect only the information necessary for identified
purposes?
A. Accountability
B. Identifying purposes
C. Limiting collection
D. Consent
Answer: C
Rationale: The limiting collection principle ensures organizations do not
gather excessive personal data and only collect what is necessary for
stated purposes.
, 3. A Canadian employer wants to install workplace surveillance cameras
in employee break rooms. What is the most legally appropriate
concern under privacy law?
A. Employees have no expectation of privacy in break rooms
B. Surveillance is always allowed if disclosed in a policy
C. Surveillance must be reasonable, necessary, and proportionate to a
legitimate purpose
D. Surveillance is only regulated in public spaces
Answer: C
Rationale: Privacy law requires that surveillance be justified, minimally
intrusive, and proportionate to a legitimate business purpose, even in
workplaces.
4. Which of the following best describes “personal information” under
Canadian privacy laws?
A. Any business data stored in electronic format
B. Information about an identifiable individual, directly or indirectly
C. Any data collected by government institutions only
D. Only financial records linked to individuals
Answer: B
Rationale: Personal information includes any data that can identify an
, individual directly or indirectly, such as names, identifiers, or combined
datasets.
5. A company collects customer emails for marketing. What is the most
important legal requirement before sending promotional emails in
Canada?
A. Prior verbal approval from management
B. Implied consent is always sufficient
C. Consent that is express, informed, or validly implied under CASL rules
D. No consent is required for existing customers
Answer: C
Rationale: Canadian Anti-Spam Legislation (CASL) requires valid consent—
express or implied under specific conditions—before sending commercial
electronic messages.
6. What is the primary role of a Privacy Impact Assessment (PIA)?
A. To determine employee salaries
B. To evaluate and mitigate privacy risks in a project involving personal data
C. To replace the need for consent
D. To eliminate all data collection risks entirely
Answer: B
Rationale: A PIA systematically identifies privacy risks and ensures
