Free CIPP/E exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CIPP/E exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which historical concern helped drive replacement of Directive 95/46/EC with a regulation?

   1. A. Differences in national implementation obstructed data flows within the Union.
   2. B. The directive required all personal data to remain in the collecting state.
   3. C. The directive confined data protection to public-sector information systems.
   4. D. National authorities were required to apply identical criminal penalties.

   Answer: A

   Explanation: Recital 9 states that the directive "has not prevented fragmentation in the implementation of data protection across the Union". Divergent implementation could obstruct internal data flows; the other options misstate the earlier framework.

   Reference: Regulation (EU) 2016/679 (General Data Protection Regulation) — Recital 9

2. 2A customer record contains no name, but its account number can identify the customer using an available account register. How is the record classified under the GDPR?

   1. A. Anonymous data because the name is absent
   2. B. Personal data because the person is indirectly identifiable
   3. C. Corporate data because the identifier was issued by a business
   4. D. Nonpersonal data until the register is actually consulted

   Answer: B

   Explanation: Article 4(1) defines personal data as "any information relating to an identified or identifiable natural person" and describes a person identifiable "directly or indirectly, in particular by reference to an identifier". The available account register makes this customer indirectly identifiable before anyone actually performs a lookup. Removing a name does not by itself anonymise the record.

   Reference: Regulation (EU) 2016/679 (General Data Protection Regulation) — Article 4(1)

3. 3A company collected data for specified purposes and now proposes further use incompatible with them. Which GDPR principle is directly implicated?

   1. A. Storage limitation
   2. B. Integrity and confidentiality
   3. C. Purpose limitation
   4. D. Data portability

   Answer: C

   Explanation: Article 5(1)(b) says data must be "not further processed in a manner that is incompatible with those purposes". The issue is compatibility of use rather than retention duration, system security or transfer to another controller.

   Reference: Regulation (EU) 2016/679 (General Data Protection Regulation) — Article 5(1)(b)

4. 4Which nonautomated processing falls within Article 2(1) GDPR's material scope?

   1. A. All unstructured notes unrelated to any filing system
   2. B. Only paper records that have already been scanned
   3. C. Personal data forming part of, or intended for, a filing system
   4. D. Only handwritten records created by a public authority

   Answer: C

   Explanation: Article 2(1) includes nonautomated data which "form part of a filing system or are intended to form part of a filing system". Digital conversion or public-sector creation is not required, while wholly unstructured non-filing-system records do not meet this limb.

   Reference: Regulation (EU) 2016/679 (General Data Protection Regulation) — Article 2(1)

5. 5Under Article 88(1) GDPR, how may Member States provide more specific rules for processing employee personal data?

   1. A. Only through informal internal instructions issued by an employer
   2. B. By law or collective agreements
   3. C. Only through an individual employee's waiver of fundamental rights
   4. D. By treating the employment relationship as outside the GDPR entirely

   Answer: B

   Explanation: Article 88(1) allows more specific employment rules "by law or by collective agreements". Such rules protect rights within the GDPR framework; they are not a general employer power to waive those rights.

   Reference: Regulation (EU) 2016/679 (General Data Protection Regulation) — Article 88(1)

6. 6Which instrument became the first legally binding international instrument specifically in the data protection field?

   1. A. The OECD Privacy Guidelines
   2. B. Council of Europe Convention 108
   3. C. The EU Data Protection Directive
   4. D. The EU Charter of Fundamental Rights

   Answer: B

   Explanation: The Council of Europe describes Convention 108 as "the first legally binding international instrument in the data protection field". The guidelines are a different type of instrument, and the EU instruments came later.

   Reference: Convention 108 and Protocols — The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 108)

7. 7Which arrangement meets the defining structure of pseudonymisation under Article 4(5) GDPR?

   1. A. Replacing names with public identifiers that directly reveal each person's identity
   2. B. Encrypting records while publishing their decryption key together with the records
   3. C. Replacing identifiers and separately protecting information needed for attribution
   4. D. Erasing all personal records and retaining no data capable of attribution

   Answer: C

   Explanation: Article 4(5) requires data that "can no longer be attributed to a specific data subject without the use of additional information", with that information kept separately and protected by technical and organisational measures. Publicly revealing identifiers or keys does not meet that protective structure; erasing the records is deletion rather than pseudonymisation.

   Reference: Regulation (EU) 2016/679 (General Data Protection Regulation) — Article 4(5)

8. 8A registration form asks for detailed family information that is unnecessary for its stated service purpose. Which principle most directly requires reducing those fields?

   1. A. Data minimisation
   2. B. Accuracy
   3. C. Storage limitation
   4. D. Integrity and confidentiality

   Answer: A

   Explanation: Article 5(1)(c) requires data to be "adequate, relevant and limited to what is necessary". Unnecessary collection is a minimisation issue even if data are accurate, securely stored and later deleted.

   Reference: Regulation (EU) 2016/679 (General Data Protection Regulation) — Article 5(1)(c)

9. 9A natural person keeps a private address book exclusively for personal and household activities. Which GDPR material-scope exclusion is relevant?

   1. A. The purely personal or household activity exclusion
   2. B. An exemption covering every processing activity of a sole trader
   3. C. A general exemption for every business record stored in a private home
   4. D. An exemption for every unpaid voluntary activity outside a personal or household context

   Answer: A

   Explanation: Article 2(2)(c) excludes processing "by a natural person in the course of a purely personal or household activity". The purpose and context matter; sole-trader status, a home storage location or lack of payment alone does not establish the exclusion.

   Reference: Regulation (EU) 2016/679 (General Data Protection Regulation) — Article 2(2)(c)

10. 10An employer considers reviewing a job applicant's publicly visible social media profile. Under WP249, what is a key condition for collecting applicant information?

    1. A. Collect everything public because public visibility supplies unlimited permission.
    2. B. Collect private-life details whenever another employer might find them interesting.
    3. C. Require the applicant to disclose every account before assessing job relevance.
    4. D. Limit collection to what is necessary and relevant to the job.

    Answer: D

    Explanation: WP249 section 5.1 limits collection to data "necessary and relevant to the performance of the job". Public accessibility alone does not establish lawful and relevant recruitment screening; the guidance also requires proper information to candidates.

    Reference: Opinion 2/2017 on data processing at work (WP249) — Section 5.1, page 11