Free CIPT Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CIPT Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Under the GDPR, two companies jointly decide why customer data will be processed and which processing methods will be used. What is their relationship for that processing?

   1. A. A controller and its processor
   2. B. Two joint controllers
   3. C. A processor and its subprocessor
   4. D. Two independent supervisory authorities

   Answer: B

   Explanation: Article 26(1) states: "Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers." Both companies make those decisions, so they are joint controllers.

   Reference: General Data Protection Regulation — Article 26(1)

2. 2A service covered by the GDPR relies on consent to collect personal data. Which user response meets the affirmative-action element of the GDPR consent definition?

   1. A. Remaining silent after a consent request is displayed
   2. B. Leaving an automatically selected consent box unchanged
   3. C. Actively selecting an initially unselected consent control
   4. D. Continuing to use a service without seeing a consent request

   Answer: C

   Explanation: Article 4(11) requires agreement "by a statement or by a clear affirmative action". Actively selecting an unselected consent control meets that element; silence and passive defaults do not. The other elements of valid consent must also be satisfied.

   Reference: General Data Protection Regulation — Article 4(11)

3. 3An optional tracking dialog offers acceptance or postponement, but no way to reject tracking permanently. Which change directly addresses the privacy-choice defect identified in the FTC's dark-patterns report?

   1. A. Dismiss the request for this visit and automatically repeat it next visit
   2. B. Suspend the request until an update restores the optional sharing default
   3. C. Record rejection and stop collection unless the user changes the choice
   4. D. Close the request dialog while leaving the optional collection active

   Answer: C

   Explanation: The FTC identifies interfaces that "do not allow consumers to definitively reject data collection or use". A recorded rejection that stops the optional collection supplies that choice; temporary dismissal, automatic restoration and closing only the dialog do not.

   Reference: FTC Staff Report: Bringing Dark Patterns to Light — Section IV, p. 15, item (1)

4. 4A team identifies likely privacy-invasive events before a system launches and redesigns the system to prevent them. Which foundational Privacy by Design principle is illustrated?

   1. A. Visibility and Transparency
   2. B. Full Functionality
   3. C. Respect for User Privacy
   4. D. Proactive not Reactive; Preventative not Remedial

   Answer: D

   Explanation: The principle calls on designers to "Anticipate, identify and prevent privacy invasive events before they occur." Preventing foreseeable events before launch is proactive rather than relying on remediation.

   Reference: Information and Privacy Commissioner of Ontario: Privacy by Design — Principle 1, p. 1

5. 5Which NIST privacy engineering objective enables individuals, owners and operators to make reliable assumptions about a system's data processing?

   1. A. Manageability
   2. B. Predictability
   3. C. Disassociability
   4. D. Availability

   Answer: B

   Explanation: NIST defines predictability as "Enabling reliable assumptions by individuals, owners, and operators about data and their processing by a system". This concerns expectations about processing, rather than control operations or system uptime.

   Reference: NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management — Appendix D, Table 3, p. 34

6. 6A GDPR processor finishes providing its processing service. The controller requests return of the personal data, and no applicable law requires continued storage. What should the processor do with its existing copies?

   1. A. Keep them until the controller's DPO authorizes erasure
   2. B. Keep them for possible future service improvements
   3. C. Transfer them to a replacement processor of its choice
   4. D. Delete them after returning the data to the controller

   Answer: D

   Explanation: Article 28(3)(g) requires the processor to return or delete data at the controller’s choice and "deletes existing copies unless Union or Member State law requires storage of the personal data". The stated exception does not apply.

   Reference: General Data Protection Regulation — Article 28(3)(g)

7. 7A GDPR service bases collection on consent. What capability should its consent records support under Article 7(1)?

   1. A. Demonstrating that the data subject consented to the processing
   2. B. Inferring consent solely from the number of website visits
   3. C. Replacing consent with the service provider's preferred settings
   4. D. Treating every logged-in account as having consented to every purpose

   Answer: A

   Explanation: Article 7(1) says the controller "shall be able to demonstrate that the data subject has consented". A consent record must support that demonstration; a visit or login alone does not establish agreement.

   Reference: General Data Protection Regulation — Article 7(1)

8. 8Users reject optional data sharing, but an app repeatedly interrupts unrelated tasks asking them to reverse that decision. Which privacy risk is identified in the FTC's dark-patterns report?

   1. A. Repeated prompts can pressure users into settings they wish to avoid
   2. B. A recorded rejection automatically authorizes the next sharing request
   3. C. More interruptions necessarily make the user's consent more informed
   4. D. A rejected setting becomes mandatory when an app repeats the request

   Answer: A

   Explanation: The FTC flags interfaces that "repeatedly prompt consumers to select settings they wish to avoid". Repetition can erode the chosen privacy preference rather than establish meaningful agreement.

   Reference: FTC Staff Report: Bringing Dark Patterns to Light — Section IV, p. 15, item (2)

9. 9In Privacy by Design, what should happen when a user takes no action to adjust privacy settings?

   1. A. The user's privacy should remain protected by the built-in defaults
   2. B. Every optional processing purpose should become enabled automatically
   3. C. The system should treat inaction as permission for unrestricted sharing
   4. D. Privacy safeguards should remain inactive until the user discovers them

   Answer: A

   Explanation: The default-setting principle says: "Build in the maximum degree of privacy into the default settings for any system or business practice." The accompanying text keeps privacy intact when users do nothing, so protection cannot depend on discovering and changing settings.

   Reference: Information and Privacy Commissioner of Ontario: Privacy by Design — Principle 2, p. 1

10. 10Granular administration of collection, alteration, deletion and selective disclosure supports which NIST privacy engineering objective?

    1. A. Predictability
    2. B. Confidentiality
    3. C. Disassociability
    4. D. Manageability

    Answer: D

    Explanation: NIST describes manageability as "Providing the capability for granular administration of data". The listed operations are ways to administer processing, rather than remove associations or merely predict behavior.

    Reference: NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management — Appendix D, Table 3, p. 34