Certified Information Privacy Manager (CIPM)

Last checked November 10, 2026 against the official IAPP exam page.

1. Question 1Domain I - Privacy Program: Developing a Framework

   A privacy manager at a regional retail chain has been asked to define the scope of the first privacy program. Leadership wants a plan that can be delivered within the first year. Which approach is most sound for defining the program scope?

   1. ALimit the scope to the loyalty card database because it holds the largest number of customer records
   2. BInclude every data store in the company, including all systems that hold no personal information at all, regardless of risk
   3. CDefer scoping until a regulator publishes a list of the systems that must be covered
   4. DInventory every process that collects or uses personal information, then prioritize coverage by risk and business need
   Show answer and explanationHide answer

   Correct answer: D

   A sound scope starts from an inventory of how personal information is used and is prioritized by risk, so the highest-risk processing is covered first. Limiting scope to one database leaves other high-risk processing outside the program, deferring scope waits without a legal basis, and covering systems with no personal information wastes effort.

2. Question 2Domain II - Privacy Program: Establishing Program Governance

   Which statement best describes an effective retention and disposal policy for personal information?

   1. AIt sets how long each category of personal information is kept, why it is kept, and how it is securely disposed of
   2. BIt requires all personal information to be kept indefinitely so that it remains available for future analytics
   3. CIt applies only to paper records, because most electronic systems delete data automatically at the end of its use
   4. DIt is written by the IT department alone so that the technical team can choose storage periods that suit its systems
   Show answer and explanationHide answer

   Correct answer: A

   A retention and disposal policy ties each data category to a documented period and purpose, and it requires secure disposal once that purpose ends. Indefinite retention conflicts with the storage limitation principle, electronic systems do not delete data automatically by default, and retention periods need input from legal and business owners rather than IT alone.

3. Question 3Domain III - Privacy Program Operational Life Cycle: Assessing Data

   A company is preparing its first data inventory and data flow map. Which set of information is most useful to record for each data element?

   1. AThe software license cost, vendor name, and renewal date for each application that touches the data
   2. BThe personal data category, where it is stored and transferred, who can access it, and the purpose of processing
   3. CThe number of employees who completed training on the application that holds the data
   4. DThe server hardware model, operating system version, warranty period, rack location, and data center cooling schedule
   Show answer and explanationHide answer

   Correct answer: B

   A useful inventory records what personal data is held, where it is stored and moves, who can access it, and why it is processed, because these facts drive risk assessment and compliance decisions. License costs, training counts, and hardware details are operational facts that do not describe personal data flows.

4. Question 4Domain VI - Privacy Program Operational Life Cycle: Responding to Requests and Incidents

   A customer asks for deletion of all personal data held about them. The company must keep certain transaction records because tax law requires a retention period. What is the best response?

   1. ADelete everything immediately and ignore the tax retention requirement so that the request is handled as quickly as possible
   2. BRefuse the whole request because the customer has previously made purchases from the company
   3. CDelete the data not covered by the retention duty, explain the legal basis for keeping other records, and confirm the outcome
   4. DRequire the customer to pay a processing fee before any part of the request is reviewed by the company
   Show answer and explanationHide answer

   Correct answer: C

   Erasure requests are assessed against legal retention obligations, so data outside those obligations should be deleted, while the legal basis for retained records is explained and the outcome confirmed. Deleting everything ignores legal duties, refusing the whole request is not appropriate, and requiring payment before review is not a standard step in handling these requests.

5. Question 5Domain IV - Privacy Program Operational Life Cycle: Protecting Personal Information

   A product team configures a new mobile app so that location sharing is switched off until a user chooses to turn it on in settings. Which privacy by design principle does this configuration best illustrate?

   1. AVisibility and transparency, so that users can see what data is collected
   2. BEnd-to-end security, so that data is protected throughout its life cycle
   3. CPrivacy as the default setting, so that no action is needed for protection
   4. DFull functionality, so that the app keeps every feature while still protecting privacy
   Show answer and explanationHide answer

   Correct answer: C

   Privacy as the default setting means the most protective option is active without the individual having to act, which is exactly what a switched-off location setting does. The other principles matter, but they describe transparency, lifecycle security, and positive-sum design rather than the default configuration itself.