[Apr 16, 2026] New Updated CIPP-E Exam Questions 2026 [Q51-Q67]

[Apr 16, 2026] New Updated CIPP-E Exam Questions 2026

Updated Free IAPP CIPP-E Test Engine Questions with 310 Q&As

IAPP CIPP/E certification exam is an essential certification for privacy professionals who work in or with organizations that operate within the EU or handle EU citizens' personal data. Certified Information Privacy Professional/Europe (CIPP/E) certification demonstrates an individual's knowledge and understanding of European data protection laws and regulations, particularly the GDPR, and is an excellent way to advance one's career in the privacy field.

 

NEW QUESTION # 51
Which mechanism, introduced by the GDPR as a means of ensuring both compliance and transparency, allows for the possibility of personal data transfers to third countries under Article 42?

• A. Standard contractual clauses.
• B. Binding corporate rules.
• C. Law enforcement requests.
• D. Approved certifications.

Answer: D

Explanation:
The General Data Protection Regulation (GDPR) introduces a mechanism for personal data transfers to third countries or international organisations that do not ensure an adequate level of data protection, based on approved certifications. According to Article 42 of the GDPR, the European Commission, the European Data Protection Board (EDPB) and the national data protection authorities (DPAs) shall encourage the establishment of data protection certification mechanisms and of data protection seals and marks, for the purpose of demonstrating compliance with the GDPR of processing operations by controllers and processors.
The specific needs of micro, small and medium-sized enterprises shall be taken into account.
The GDPR also provides that the certification mechanisms shall be voluntary and available via a transparent process. The certification shall be issued by the competent supervisory authority or by the certification bodies accredited by the supervisory authority or by the national accreditation body. The certification shall be valid for a maximum period of three years and may be renewed, under the same conditions, if the relevant requirements continue to be met. The certification shall be withdrawn, as the case may be, by the competent supervisory authority or by the certification bodies, where the requirements for the certification are not or are no longer met.
The GDPR further stipulates that the certification shall be issued to a controller or processor who has demonstrated, in accordance with the approved certification criteria, that the processing of personal data is in compliance with the GDPR. The certification shall specify the scope and purpose of the processing, the criteria applied and the duration of the validity of the certification. The certification shall not reduce the responsibility of the controller or the processor for compliance with the GDPR and shall not be interpreted as an endorsement of the quality or reliability of the products or services of the controller or the processor by the supervisory authority or the certification body.
The GDPR also states that the certification mechanisms shall contribute to the proper application of the GDPR, taking account of the specific features of the various processing sectors and the different risks for the rights and freedoms of data subjects. The certification mechanisms shall allow for the verification of compliance with the GDPR of processing operations by controllers and processors not established in the EU, regardless of the location of the processing. The certification mechanisms shall also provide for the possibility to demonstrate compliance with the GDPR for personal data transfers to third countries or international organisations under Article 46, which sets out the rules and requirements for the transfer of personal data to third countries or international organisations based on appropriate safeguards, such as binding corporate rules, standard contractual clauses, codes of conduct or certification mechanisms.
References:
GDPR, Articles 42, 43, 44, 45, 46, 47, 48 and 49.
EDPB Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation 2016/679, pages 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 and 15.
Free CIPP/E Study Guide, pages 9, 10, 11 and 12.

NEW QUESTION # 52
Please use the following to answer the next question:
ProStorage is a multinational cloud storage provider headquartered in the Netherlands. Its CEO. Ruth Brown, has developed a two-pronged strategy for growth: 1) expand ProStorage s global customer base and 2) increase ProStorage's sales force by efficiently onboarding effective teams. Enacting this strategy has recently been complicated by Ruth's health condition, which has limited her working hours, as well as her ability to travel to meet potential customers. ProStorage's Human Resources department and Ruth's Chief of Staff now work together to manage her schedule and ensure that she is able to make all her medical appointments The latter has become especially crucial after Ruth's last trip to India, where she suffered a medical emergency and was hospitalized m New Delhi Unable to reach Ruths family, the hospital reached out to ProStorage and was able to connect with her Chief of Staff, who in coordination with Mary, the head of HR. provided information to the doctors based on accommodate on requests Ruth made when she started a: ProStorage What transfer mechanism should Jackie recommend for using InstaHR?

• A. Standard contractual clauses
• B. Adequacy
• C. Explicit consent of employees.
• D. Binding corporate rules.

Answer: C

NEW QUESTION # 53
Which of the following describes a mandatory requirement for a group of undertakings that wants to appoint a single data protection officer?

• A. The group of undertakings must be comprised of organizations of similar sizes and functions.
• B. The group of undertakings must obtain approval from a supervisory authority.
• C. The data protection officer must be located in the country where the data controller has its main establishment.
• D. The data protection officer must be easily accessible from each establishment where the undertakings are located.

Answer: D

Explanation:
Reference https://www.privacy-regulation.eu/en/article-37-designation-of-the-data-protection-officer- GDPR.htm

NEW QUESTION # 54
The GDPR requires controllers to supply data subjects with detailed information about the processing of their data. Where a controller obtains data directly from data subjects, which of the following items of information does NOT legally have to be supplied?

• A. The categories of personal data concerned.
• B. The rights of access, erasure, restriction, and portability.
• C. The right to lodge a complaint with a supervisory authority.
• D. The recipients or categories of recipients.

Answer: A

Explanation:
According to Article 13 of the GDPR, when a controller obtains personal data directly from the data subject, the controller must provide the data subject with certain information about the processing of their data, such as the identity and contact details of the controller, the purposes and legal basis of the processing, the recipients or categories of recipients, the period of storage, the rights of the data subject, the right to lodge a complaint, etc. However, the controller does not have to provide the data subject with the categories of personal data concerned, as this information is already known by the data subject, since they provided the data themselves. This is different from Article 14, which applies when the controller obtains personal data from a source other than the data subject, and requires the controller to inform the data subject of the categories of personal data concerned, as well as the source of the data. References:
* Art. 13 GDPR - Information to be provided where personal data are collected from the data subject
* Art. 14 GDPR - Information to be provided where personal data have not been obtained from the data subject
* Article 13: Information to be provided where personal data are collected from the data subject - GDPR

NEW QUESTION # 55
SCENARIO
Please use the following to answer the next question:
Zandelay Fashion ('Zandelay') is a successful international online clothing retailer that employs approximately 650 people at its headquarters based in Dublin, Ireland. Martin is their recently appointed data protection officer, who oversees the company's compliance with the General Data Protection Regulation (GDPR) and other privacy legislation.
The company offers both male and female clothing lines across all age demographics, including children. In doing so, the company processes large amounts of information about such customers, including preferences and sensitive financial information such as credit card and bank account numbers.
In an aggressive bid to build revenue growth, Jerry, the CEO, tells Martin that the company is launching a new mobile app and loyalty scheme that puts significant emphasis on profiling the company's customers by analyzing their purchases. Martin tells the CEO that: (a) the potential risks of such activities means that Zandelay needs to carry out a data protection impact assessment to assess this new venture and its privacy implications; and (b) where the results of this assessment indicate a high risk in the absence of appropriate protection measures. Zandelay may have to undertake a prior consultation with the Irish Data Protection Commissioner before implementing the app and loyalty scheme.
Jerry tells Martin that he is not happy about the prospect of having to directly engage with a supervisory authority and having to disclose details of Zandelay's business plan and associated processing activities.
What must Zandelay provide to the supervisory authority during the prior consultation?

• A. An evaluation of the complexity of the intended processing.
• B. Records showing that customers have explicitly consented to the intended profiling activities.
• C. Certificates that prove Martin's professional qualities and expert knowledge of data protection law.
• D. An of the purposes and means of the intended processing.

Answer: D

NEW QUESTION # 56
In 2016's Guidance, the United Kingdom's Information Commissioner's Office (ICO) reaffirmed the importance of using a "layered notice" to provide data subjects with what?

• A. A privacy notice containing brief information whilst offering access to further detail.
• B. An efficient means of providing written consent in member states where they are required to do so.
• C. An explanation of the security measures used when personal data is transferred to a third party.
• D. A privacy notice explaining the consequences for opting out of the use of cookies on a website.

Answer: A

Explanation:
A layered notice is a privacy notice designed to respond to problems with excessively long notices1. A short notice - the top layer - provides a user with the key elements of the privacy notice, such as the identity of the organisation, the purposes of the processing, and the rights of the data subjects2. The full notice - the bottom layer - covers all the intricacies in full, such as the lawful basis, the retention periods, and the recipients of the personal data2. The ICO recommends using a layered approach to deliver privacy information in a concise, transparent, intelligible, and easily accessible way, as required by the UK GDPR3. A layered notice allows data subjects to access the information they need at the appropriate level of detail and helps organisations to comply with the right to be informed23. Reference: 2

NEW QUESTION # 57
What is the key difference between the European Council and the Council of the European Union?

• A. The European Council is comprised of the heads of each EU member state.
• B. The European Council focuses primarily on issues involving human rights.
• C. The Council of the European Union has a degree of legislative power.
• D. The Council of the European Union is helmed by a president.

Answer: A

Explanation:
The European Council and the Council of the European Union are two different EU institutions that have similar names but distinct roles and memberships. The European Council is the body of leaders (heads of state or government) of the 27 EU member states that defines the EU's general political direction and priorities1. The European Council does not adopt EU legislation, but rather sets the agenda and gives guidance to the other EU institutions1. The Council of the European Union, informally known as the Council, is composed of national ministers from each EU member state, grouped by policy area1. The Council is one of the two legislative bodies of the EU, along with the European Parliament, and negotiates and adopts EU laws, coordinates member states' policies, and develops the EU's common foreign and security policy1. The key difference between the two institutions is that the European Council is comprised of the heads of each EU member state, while the Council of the European Union is comprised of the ministers of each EU member state12. References: European Council | Council of the European Union, What is the difference between EU Council, Council of the European Union, and Council of Europe?

NEW QUESTION # 58
Under Article 21 of the GDPR, a controller must stop profiling when requested by a data subject, unless it can demonstrate compelling legitimate grounds that override the interests of the individual. In the Guidelines on Automated individual decision-making and Profiling, the WP 29 says the controller needs to do all of the following to demonstrate that it has such legitimate grounds EXCEPT?

• A. Demonstrate that the profiling is for the purposes of direct marketing.
• B. Consider the impact of the profiling on the data subject's interest, rights and freedoms.
• C. Consider the importance of the profiling to their particular objective.
• D. Carry out an exercise that weighs the interests of the controller and the basis for the data subject's objection.

Answer: A

Explanation:
According to the UK GDPR, the data subject has the right to object, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions1. The controller must stop the processing unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims1. The WP 29 Guidelines on Automated individual decision-making and Profiling provide some guidance on how to assess the existence of such compelling legitimate grounds2. The controller needs to carry out an exercise that weighs the interests of the controller and the basis for the data subject's objection, consider the impact of the profiling on the data subject's interest, rights and freedoms, and consider the importance of the profiling to their particular objective2. However, the controller does not need to demonstrate that the profiling is for the purposes of direct marketing, as this is a separate ground for objection under Article 21(2) of the UK GDPR, which gives the data subject an absolute right to object to such processing13. Therefore, option C is the correct answer, as it is not required by the controller to demonstrate that it has compelling legitimate grounds for profiling. Reference: 132
https://gdpr.eu/article-21-right-to-object/ https://ico.org.uk/for-organisations-2/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-object/

NEW QUESTION # 59
According to the European Data Protection Board, if a controller that is not established in the EU but still subject to the GDPR becomes aware of a personal data breach, which supervisory authority or authorities must be notified?

• A. Every supervisory authority of the EU member states where the controller is offering goods or services.
• B. Only the supervisory authority of the EU member state in which the controller's EU representative (pursuant to Article 27) is established.
• C. Only one lead supervisory authority, as a controller benefits from the one-stop shop mechanism under the GDPR's enforcement regime.
• D. Every supervisory authority for which affected data subjects reside in their EU member state.

Answer: B

Explanation:
The General Data Protection Regulation (GDPR) introduces a duty for controllers to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. The GDPR also requires controllers to communicate the personal data breach to the affected data subjects without undue delay, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.
The GDPR applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the EU, regardless of whether the processing takes place in the EU or not. The GDPR also applies to the processing of personal data of data subjects who are in the EU by a controller or processor not established in the EU, where the processing activities are related to the offering of goods or services to data subjects in the EU or the monitoring of their behaviour as far as their behaviour takes place within the EU.
The GDPR provides that where a controller or a processor is not established in the EU, but is subject to the GDPR, the controller or the processor shall designate in writing a representative in the EU. The representative shall be established in one of the member states where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are. The representative shall act on behalf of the controller or the processor and may be addressed by any supervisory authority or data subject on any issues related to the processing of personal data under the GDPR.
The GDPR also establishes a one-stop shop mechanism, which aims to ensure the consistent and effective application of the GDPR across the EU. The one-stop shop mechanism allows a controller or a processor with establishments in several member states to have a single supervisory authority as its interlocutor, which is the supervisory authority of the main establishment or of the single establishment of the controller or processor.
The one-stop shop mechanism also enables a controller or a processor that is not established in the EU, but is subject to the GDPR, to deal with a single lead supervisory authority, which is the supervisory authority of the member state where the representative of the controller or processor is established.
Based on the GDPR and the guidelines of the European Data Protection Board (EDPB), if a controller that is not established in the EU but still subject to the GDPR becomes aware of a personal data breach, the controller must notify the supervisory authority of the EU member state in which the controller's EU representative (pursuant to Article 27) is established. This is the only supervisory authority that the controller must notify, as the controller benefits from the one-stop shop mechanism and has a single lead supervisory authority. The controller does not need to notify every supervisory authority of the EU member states where the controller is offering goods or services or where the affected data subjects reside, as this would be contrary to the principle of consistency and the aim of simplification of the one-stop shop mechanism.
References:
GDPR, Articles 3, 4, 27, 28, 29, 33, 34, 51, 55, 56, 57, 58, 60, 61, 62, 63, 64, 65, 66, 67, and 68.
EDPB Guidelines 9/2022 on personal data breach notification under GDPR, pages 5, 6, 7, 8, 9, 10, 11, 12, 13,
14, 15, and 16.
EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, pages 19, 20, 21, 22, 23,
24, 25, 26, 27, and 28.
EDPB Guidelines 3/2018 on the territorial scope of the GDPR, pages 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, and 15.

NEW QUESTION # 60
SCENARIO
Please use the following to answer the next question:
Gentle Hedgehog Inc. is a privately owned website design agency incorporated in Italy. The company has numerous remote workers in different EU countries. Recently, the management of Gentle Hedgehog noticed a decrease in productivity of their sales team, especially among remote workers. As a result, the company plans to implement a robust but privacy-friendly remote surveillance system to prevent absenteeism, reward top performers, and ensure the best quality of customer service when sales people are interacting with customers.
Gentle Hedgehog eventually hires Sauron Eye Inc., a Chinese vendor of employee surveillance software whose European headquarters is in Germany. Sauron Eye's software provides powerful remote-monitoring capabilities, including 24/7 access to computer cameras and microphones, screen captures, emails, website history, and keystrokes. Any device can be remotely monitored from a central server that is securely installed at Gentle Hedgehog headquarters. The monitoring is invisible by default; however, a so-called Transparent Mode, which regularly and conspicuously notifies all users about the monitoring and its precise scope, also exists. Additionally, the monitored employees are required to use a built-in verification technology involving facial recognition each time they log in.
All monitoring data, including the facial recognition data, is securely stored in Microsoft Azure cloud servers operated by Sauron Eye, which are physically located in France.
Based on the scenario, what are the primary privacy risks of the planned surveillance system?

• A. Facial recognition data stored in the cloud and lack of encryption.
• B. Excessive scope of monitoring and lack of legitimate purpose for data collection.
• C. A Chinese vendor and the monitoring of EU-based employees.
• D. Missing E2EE encryption in the monitoring system and unclear data storage duration.

Answer: B

Explanation:
The General Data Protection Regulation (GDPR) does not prohibit surveillance of employees in the workplace. Still, it requires employers to follow special rules to ensure that the rights and freedoms of employees are protected when processing their personal data. The GDPR applies to any processing of personal data in the context of the activities of an establishment of a controller or a processor in the EU, regardless of whether the processing takes place in the EU or not. The GDPR also applies to the processing of personal data of data subjects who are in the EU by a controller or processor not established in the EU, where the processing activities are related to the offering of goods or services to data subjects in the EU or the monitoring of their behaviour as far as their behaviour takes place within the EU.
The GDPR requires that any processing of personal data must be lawful, fair and transparent, and based on one of the six legal grounds specified in the regulation. The most relevant legal grounds for employee surveillance are the legitimate interests of the employer, the performance of a contract with the employee, or the compliance with a legal obligation. The GDPR also requires that any processing of personal data must be limited to what is necessary for the purposes for which they are processed, and that the data subjects must be informed of the purposes and the legal basis of the processing, as well as their rights and the safeguards in place to protect their data.
The GDPR also imposes specific obligations and restrictions on the processing of special categories of personal data, such as biometric data, which reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or which are processed for the purpose of uniquely identifying a natural person. The processing of such data is prohibited, unless one of the ten exceptions listed in the regulation applies. The most relevant exceptions for employee surveillance are the explicit consent of the data subject, the necessity for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law, or the necessity for reasons of substantial public interest.
The GDPR also sets out the rules and requirements for the transfer of personal data to third countries or international organisations, which do not ensure an adequate level of data protection. The transfer of such data is only allowed if the controller or processor has provided appropriate safeguards, such as binding corporate rules, standard contractual clauses, codes of conduct or certification mechanisms, and if the data subjects have enforceable rights and effective legal remedies.
Based on the scenario, the primary privacy risks of the planned surveillance system are the excessive scope of monitoring and the lack of legitimate purpose for data collection. The surveillance system involves the collection and processing of a large amount of personal data, including special categories of personal data, such as biometric data and data revealing political opinions or trade union membership, from the employees' devices and communications. The surveillance system also involves the transfer of personal data to a third country, China, which does not provide an adequate level of data protection. The surveillance system does not seem to have a clear and specific purpose that is necessary and proportionate to the legitimate interests of the employer, such as preventing fraud, ensuring network security, or complying with legal obligations. The surveillance system also does not seem to respect the principles of data minimisation, purpose limitation, transparency, and accountability. The surveillance system may infringe the rights and freedoms of the employees, such as the right to privacy, the right to data protection, the right to non-discrimination, the right to dignity, and the right to freedom of expression and association.
References:
GDPR, Articles 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 44, 45, 46, 47, 48, and
49.
EDPB Guidelines 3/2019 on processing of personal data through video devices, pages 5, 6, 7, 8, 9, 10, 11, 12,
13, and 14.
EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, pages 19, 20, 21, 22, 23,
24, 25, 26, 27, and 28.
EDPB Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, pages 5, 6, 7, 8, 9, 10, 11,
12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, and 28.
EDPB Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679, pages 4, 5, 6, 7, 8, 9, 10,
11, and 12.
Data protection: GDPR and employee surveilance | Feature | Law Gazette, paragraphs 1, 2, 3, 4, 5, 6, 7, and 8.

NEW QUESTION # 61
A company wishes to transfer personal data to a country outside of the European Union/EEA In order to do so, they are planning an assessment of the country's laws and practices, knowing that these may impinge upon the transfer safeguards they intend to use All of the following factors would be relevant for the company to consider EXCEPT'?

• A. The technical, financial, and staff resources available to an authority m the third country concerned that may access the personal data to be transferred
• B. Any onward transfers, such as transfers of personal data to a sub-processor in the same or another third country.
• C. The process of modernization in the third country concerned and their access to emerging technologies that rely on international transfers of personal data
• D. The contractual clauses between the data controller or processor established in the European Union/EEA and the recipient of the transfer established in the third country concerned

Answer: C

NEW QUESTION # 62
Which type of personal data does the GDPR define as a "special category" of personal data?

• A. Educational history.
• B. Financial information.
• C. Trade-union membership.
• D. Closed Circuit Television (CCTV) footage.

Answer: C

Explanation:
According to Article 9 of the GDPR, special category data is personal data that needs more protection because it is sensitive. The GDPR defines 10 types of personal data as special categories, which are:
* personal data revealing racial or ethnic origin;
* personal data revealing political opinions;
* personal data revealing religious or philosophical beliefs;
* personal data revealing trade union membership;
* genetic data;
* biometric data (where used for identification purposes);
* data concerning health;
* data concerning a person's sex life; and
* data concerning a person's sexual orientation.
Among the answer choices, only option B falls under one of these categories, as trade union membership is considered to reveal political opinions or beliefs. Option A, C and D are not considered as special category data, as they do not reveal any sensitive information about the data subject. However, they are still subject to the general principles and rules of the GDPR, such as lawfulness, fairness, transparency, accuracy, security, etc. References:
* Special category data | ICO
* Art. 9 GDPR Processing of special categories of personal data
* Special Categories of Data - International Association of Privacy Professionals Reference: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection- regulation-gdpr/lawful-basis-for-processing/special-category-data/#:~:text=The%20GDPR%20defines%
20special%20category%20data%20as%3A&text=personal%20data%20revealing%20trade%20union,used%
20for%20identification%20purposes)%3B

NEW QUESTION # 63
SCENARIO
Please use the following to answer the next question:
Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA. Today, it is a multi-billion- dollar candy company operating in every continent. All of the company's IT servers are located in Vermont.
This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father's company, but is also secretly working on launching a new global online dating website company called Ben Knows Best.
Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company's online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers' philosophical beliefs, political opinions and marital status.
If a customer identifies as single, Ben then copies all of that customer's personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out.
Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland.
Joe also hires his best friend's daughter, Alice, who just graduated from law school in the U.S., to be the company's new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company's operations in the European Union to the U.S.
Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company's IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone' s information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm.
As a result of Sam's actions, the Gummy Bear Company potentially violated Articles 33 and 34 of the GDPR and will be required to do what?

• A. Analyze and evaluate the liability for customers in Ireland.
• B. Notify its Data Protection Authority about the data breach.
• C. Notify all of its customers that reside in the European Union.
• D. Analyze and evaluate all of its breach notification obligations.

Answer: D

Explanation:
According to Articles 33 and 34 of the GDPR, the Gummy Bear Company potentially violated its breach notification obligations by allowing Sam to copy and use the personal data of its customers in Ireland without their consent or authorization. A personal data breach is defined as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed (Article 4(12)). The Gummy Bear Company, as a data controller, is required to notify the competent supervisory authority of the personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons (Article 33(1)). The notification should include the nature of the personal data breach, the categories and approximate number of data subjects and personal data records concerned, the likely consequences of the personal data breach, and the measures taken or proposed to address the personal data breach (Article 33(3)). The Gummy Bear Company is also required to communicate the personal data breach to the affected data subjects without undue delay, if the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons (Article 34 (1)). The communication should describe the nature of the personal data breach and the measures taken or proposed to address the personal data breach (Article 34(2)).
Therefore, the Gummy Bear Company should analyze and evaluate all of its breach notification obligations, taking into account the nature and circumstances of the personal data breach, the type and sensitivity of the personal data involved, the potential impact and harm to the data subjects, and the applicable laws and regulations of the jurisdictions where the data subjects reside. The Gummy Bear Company should also document the personal data breach and the remedial actions taken, and cooperate with the supervisory authorities and the data subjects as required by the GDPR.
References: GDPR, Articles 4(12), 33, 341; EDPB Guidelines 01/2021 on Examples regarding Data Breach Notification2

NEW QUESTION # 64
As a result of the European Court of Justice's ruling in the case of Google v. Spain, search engines outside the EEA are also likely to be subject to the Regulation's right to be forgotten. This holds true if the activities of an EU subsidiary and its U.S. parent are what?

• A. Supervised by the same Data Protection Officer.
• B. Inextricably linked in their businesses.
• C. Bound by a standard contractual clause.
• D. Consistent with Privacy Shield requirements

Answer: B

Explanation:
According to the CIPP/E study guide, the Court of Justice of the European Union (CJEU) ruled in the case of Google Spain SL, Google Inc. v Agencia Espanola de Proteccion de Datos (AEPD), Mario Costeja Gonzalez1 that an Internet search engine operator is responsible for the processing of personal data that appear on web pages published by third parties, and that such operator must comply with the EU data protection law when it has an establishment in the EU. The CJEU held that Google Spain and Google Inc.
were inextricably linked in their businesses, since Google Spain promoted and sold advertising space offered by Google Inc., which oriented its activity towards the inhabitants of Spain. Therefore, Google Inc. was subject to the EU data protection law through its subsidiary Google Spain, even though the personal data processing was carried out by Google Inc. outside the EU. This implies that search engines outside the EEA are also likely to be subject to the Regulation's right to be forgotten if they have an establishment in the EU that is inextricably linked to their parent company. References: 1: CIPP/E study guide, page 16; Google Spain v AEPD and Mario Costeja Gonzalez

NEW QUESTION # 65
A U.S. company's website sells widgets. Which of the following factors would NOT in itself subject the company to the GDPR?

• A. The website is in English and French, and is accessible in France.
• B. An affiliate office is located in France but the processing is in the U.S.
• C. The website places cookies to monitor the EU website user behavior.
• D. The widgets are offered in EU and priced in euro.

Answer: A

NEW QUESTION # 66
According to the European Data Protection Board, data subjects should be aware of any video surveillance in operation. How should a retail shop operator ensure that data subjects receive at information required for such a purpose under EU data protection law?

• A. The shop operator should provide the most important information on a clearly readable warning sign to data subjects before they enter the monitored area, and additional mandatory details by other means.
• B. The shop operator should instruct the data protection officer to hand out a comprehensive notice to data subjects every time they enter the shop.
• C. The shop operator should post a copy of the manual of the video surveillance system in the shop and on its social media channels.
• D. The shop operator should provide full notice of the intended video surveillance outside the shop, for example with a sign or a stand-up display.

Answer: D

NEW QUESTION # 67
......

IAPP CIPP-E certification is a valuable credential for anyone working in the field of privacy and data protection. By demonstrating expertise in this field, individuals can enhance their professional reputation, open up new career opportunities, and contribute to the important work of protecting personal data and privacy in today's digital age.

 

Try 100% Updated CIPP-E Exam Questions [2026]: https://www.examsreviews.com/CIPP-E-pass4sure-exam-review.html

The Best Certified Information Privacy Professional CIPP-E Professional Exam Questions: https://drive.google.com/open?id=1xRL7WbVHkzXHeaEPwjl_83CyOZp_NLyW