Free IAPP CIPM Exam Questions
Try our Free Demo Practice Tests for Comprehensive CIPM Exam Preparation
-
IAPP CIPM Exam Questions
-
Provided By: IAPP
- Exam: Certified Information Privacy Manager
- Certification: Certified Information Privacy Manager
-
Total Questions: 278
-
Updated On: Mar 06, 2026
-
Rated: 4.9 |
-
Online Users: 556
-
Question 1
-
SCENARIOPlease use the following to answer the next question:Perhaps Jack Kelly should have stayed in the U.S. He enjoys a formidable reputation inside the company,Special Handling Shipping, for his work in reforming certain "rogue" offices. Last year, news broke that a policesting operation had revealed a drug ring operating in the Providence, Rhode Island office in the United States.Video from the office's video surveillance cameras leaked to news operations showed a drug exchangebetween Special Handling staff and undercover officers.In the wake of this incident, Kelly had been sent to Providence to change the "hands off" culture that uppermanagement believed had let the criminal elements conduct their illicit transactions. After a few weeks underKelly's direction, the office became a model of efficiency and customer service. Kelly monitored his workers'activities using the same cameras that had recorded the illegal conduct of their former co-workers.Now Kelly has been charged with turning around the office in Cork, Ireland, another trouble spot. The companyhas received numerous reports of the staff leaving the office unattended. When Kelly arrived, he found thateven when present, the staff often spent their days socializing or conducting personal business on their mobilephones. Again, he observed their behaviors using surveillance cameras. He issued written reprimands to sixstaff members based on the first day of video alone.Much to Kelly's surprise and chagrin, he and the company are now under investigation by the Data ProtectionCommissioner of Ireland for allegedly violating the privacy rights of employees. Kelly was told that thecompany's license for the cameras listed facility security as their main use, but he does not know why thismatters. He has pointed out to his superiors that the company's training programs on privacy protection anddata collection mention nothing about surveillance video.You are a privacy protection consultant, hired by the company to assess this incident, report on the legal andcompliance issues, and recommend next steps.What should you advise this company regarding the status of security cameras at their offices in the UnitedStates?
Answer: B
-
-
Question 2
-
Which of the following is a common disadvantage of a third-party audit?
Answer: C
-
Which of the following is a common disadvantage of a third-party audit?
-
Question 3
-
Under the General Data Protection Regulation (GDPR), which situation would be LEAST likely to require a Data
Protection Impact Assessment (DPIA)?
Answer: D
-
Under the General Data Protection Regulation (GDPR), which situation would be LEAST likely to require a Data
Protection Impact Assessment (DPIA)?
-
Question 4
-
Under the General Data Protection Regulation (GDPR), international data transfer is allowed using the mechanisms in all of the following scenarios EXCEPT between companies who?
Answer: C
-
Under the General Data Protection Regulation (GDPR), international data transfer is allowed using the mechanisms in all of the following scenarios EXCEPT between companies who?
-
Question 5
-
SCENARIOPlease use the following to answer the next question:As the Director of data protection for Consolidated Records Corporation, you are justifiably pleased with youraccomplishments so far. Your hiring was precipitated by warnings from regulatory agencies following a series ofrelatively minor data breaches that could easily have been worse. However, you have not had a reportableincident for the three years that you have been with the company. In fact, you consider your program a modelthat others in the data storage industry may note in their own program development.You started the program at Consolidated from a jumbled mix of policies and procedures and worked towardcoherence across departments and throughout operations. You were aided along the way by the program'ssponsor, the vice president of operations, as well as by a Privacy Team that started from a clear understandingof the need for change.Initially, your work was greeted with little confidence or enthusiasm by the company's "old guard" among boththe executive team and frontline personnel working with data and interfacing with clients. Through the use ofmetrics that showed the costs not only of the breaches that had occurred, but also projections of the costs thateasily could occur given the current state of operations, you soon had the leaders and key decision-makerslargely on your side. Many of the other employees were more resistant, but face-to-face meetings with eachdepartment and the development of a baseline privacy training program achieved sufficient "buy-in" to beginputting the proper procedures into place.Now, privacy protection is an accepted component of all current operations involving personal or protected dataand must be part of the end product of any process of technological development. While your approach is notsystematic, it is fairly effective.You are left contemplating:What must be done to maintain the program and develop it beyond just a data breach prevention program?How can you build on your success?What are the next action steps?What stage of the privacy operational life cycle best describes the company's current privacy program?
Answer: D
-