CIPP-E Free Practice Test

To which of the following parties does the territorial scope of the GDPR NOT apply?

1. A. All member countries of the European Economic Area.
2. B. All member countries party to the Treaty of Lisbon.
3. C. All member countries party to the Paris Agreement.
4. D. All member countries of the European Union.

Correct Answer: A

A company is hesitating between Binding Corporate Rules and Standard Contractual Clauses as a global data transfer solution. Which of the following statements would help the company make an effective decision?

1. A. Binding Corporate Rules are especially recommended for small and medium companies.
2. B. The data exporter does not need to be located in the EU for the standard Contractual Clauses.
3. C. Binding Corporate Rules provide a global solution for all the entities of a company that are bound by the intra-group agreement.
4. D. The company will need the prior authorization of all EU data protection authorities for concluding Standard Contractual Clauses.

Correct Answer: C

What must be included in a written agreement between the controller and processor in relation to processing conducted on the controller’s behalf?

1. A. An obligation on the processor to report any personal data breach to the controller within 72 hours.
2. B. An obligation on both parties to report any serious personal data breach to the supervisory authority.
3. C. An obligation on both parties to agree to a termination of the agreement if the other party is responsible for a personal data breach.
4. D. An obligation on the processor to assist the controller in complying with the controller’s obligations to notify the supervisory authority about personal data breaches.

Correct Answer: B

Which of the following is NOT recognized as being a common characteristic of cloud-computing services?

1. A. The service’s infrastructure is shared among the supplier’s customers and can be located in a number of countries.
2. B. The supplier determines the location, security measures, and service standards applicable to the processing.
3. C. The supplier allows customer data to be transferred around the infrastructure according to capacity.
4. D. The supplier assumes the vendor’s business risk associated with data processed by the supplier.

Correct Answer: D

Under the GDPR, who would be LEAST likely to be allowed to engage in the collection, use, and disclosure of a data subject’s sensitive medical information without the data subject’s knowledge or consent?

1. A. A member of the judiciary involved in adjudicating a legal dispute involving the data subject and concerning the health of the data subject.
2. B. A public authority responsible for public health, where the sharing of such information is considered necessary for the protection of the general populace.
3. C. A health professional involved in the medical care for the data subject, where the data subject’s life hinges on the timely dissemination of such information.
4. D. A journalist writing an article relating to the medical condition in QUESTION, who believes that the publication of such information is in the public interest.

Correct Answer: B