Free Certified Information Privacy Manager (CIPM) practice test: 30 questions with answers

A sound scope starts from an inventory of how personal information is used and is prioritized by risk, so the highest-risk processing is covered first. Limiting scope to one database leaves other high-risk processing outside the program, deferring scope waits without a legal basis, and covering systems with no personal information wastes effort.

A steering committee brings together senior leaders from the functions that handle personal information, so priorities can be set and disputes resolved at an executive level. Engineers contribute to implementation, external auditors provide independent assurance, and customers may be consulted, but none of them is the internal body that governs program priorities.

A hub-and-spoke (federated) model sets global standards centrally while regional staff apply them to local legal requirements. A fully decentralized model produces inconsistent standards, a fully centralized team lacks local knowledge and capacity, and an informal model has no real governance at all.

A vision reaches a broad workforce when it is short, easy to understand, tied to values employees recognize, and repeated by leaders. Long legal texts, lists of fines, and memorization exercises do not explain the organization's direction and are unlikely to change everyday behavior.

Applicability depends on where the data subjects are, what processing takes place, and the sector, so the first step is to map those facts and then match them to the relevant laws. Relying on home-country law ignores laws such as the GDPR that can reach offerings directed at people in the EU, waiting for complaints is reactive, and assuming one law covers everything is not a valid method.

A retention and disposal policy ties each data category to a documented period and purpose, and it requires secure disposal once that purpose ends. Indefinite retention conflicts with the storage limitation principle, electronic systems do not delete data automatically by default, and retention periods need input from legal and business owners rather than IT alone.

Completion rates measure activity rather than behavior change, so the program should target the specific risky practice with role-based training and then measure whether it stops. Raising completion alone does not fix the content gap, removing the course is unsupported by the evidence, and discipline without training or secure alternatives leaves the process gap in place.

A responsibility matrix such as a RACI chart clarifies accountability and approval rights for each step, which resolves overlapping claims to authority. Letting one business owner decide ignores the privacy and security review, an outside partner should not define internal responsibilities, and postponing all sharing is unnecessary once roles are clear.

Timeliness of responses to data subject requests shows whether a required privacy process is working as intended, while counts of notices, posters, and training sessions only show that activities took place. Activity counts can support a program but do not show whether it achieves its outcomes.

A sound procedure records the complaint, acknowledges it, investigates the root cause, fixes the consent record, and reports the outcome to the individual. Closing the complaint without proof, routing it only to the team whose process failed, or waiting for a regulator leaves the individual's rights unaddressed and the root cause in place.

A useful inventory records what personal data is held, where it is stored and moves, who can access it, and why it is processed, because these facts drive risk assessment and compliance decisions. License costs, training counts, and hardware details are operational facts that do not describe personal data flows.

Due diligence on a processor examines documented evidence of controls, subprocessors, incident history, and contractual commitments before personal data is handed over. Marketing claims are not evidence, price-first selection with privacy terms added later leaves risk unmanaged, and office location says nothing about how the provider protects data.

A transfer impact assessment (TIA) evaluates whether the destination country's laws and government access practices undermine the protections for transferred data, which is needed when relying on mechanisms such as standard contractual clauses. A legitimate interests assessment supports a lawful basis, a processing record describes activities, and a security questionnaire checks controls but not foreign law.

When a provider processes personal data on the company's behalf, a data processing agreement, as required by GDPR Article 28 and comparable laws, must define permitted instructions, security measures, and subprocessor controls. A trade secret NDA, a co-marketing agreement, and a verbal assurance do not create the enforceable obligations needed for processing personal data.

Encryption documentation and independent audit reports that cover access control and monitoring are direct evidence of technical and physical safeguards. A general code of conduct and publicity about security do not show whether personal data is actually protected.

Erasure requests are assessed against legal retention obligations, so data outside those obligations should be deleted, while the legal basis for retained records is explained and the outcome confirmed. Deleting everything ignores legal duties, refusing the whole request is not appropriate, and requiring payment before review is not a standard step in handling these requests.

A breach response plan should define who does what and how issues escalate, and it should set criteria for when regulators and affected individuals must be notified. Marketing messages and vendor renewal schedules are not part of breach response.

GDPR Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach likely to result in risk. Waiting for a full investigation, using a quarterly deadline, or skipping notice because the company found the breach itself are all incorrect under this rule.

Effectiveness is shown by how quickly an incident is detected and contained and by whether lessons learned produce real control improvements. Press releases, meeting attendance, and raw incident counts measure activity or reporting behavior, and a higher count does not by itself show a better response.

The right to object to processing for direct marketing is absolute under the GDPR, so that processing must stop once an objection is received and the objection must be recorded. Requiring justification, transferring the data, or reducing mailing frequency does not respect the objection.

Privacy as the default setting means the most protective option is active without the individual having to act, which is exactly what a switched-off location setting does. The other principles matter, but they describe transparency, lifecycle security, and positive-sum design rather than the default configuration itself.

Role-based access combined with data minimization gives the agent only the fields the task requires, with sensitive values masked. Shared logins remove individual accountability, unrestricted access breaks least privilege, and printed records create uncontrolled copies of personal information.

Full-disk encryption protects data at rest, so a stolen device without the decryption key does not expose readable personal information. Password rotation and antivirus signatures do not protect the stored data once the device is in a thief's hands, and a printed policy does not change how the device is protected.

Privacy by design calls for proactive protections embedded at the design stage and maintained across the full data life cycle. It is not limited to sensitive categories of data, and a single notice does not by itself satisfy the approach.

Pseudonymization lets the team analyze outcomes while the identifiers and the key stay with a restricted party, which reduces exposure. Pseudonymized data remains personal data and still needs protection, but the other options expose identities broadly or publicly.

Linking metrics to goals shows whether the program is reducing risk, for example by resolving high-risk findings before launch. A raw count does not prove effectiveness, dropping metrics removes accountability, and comparing assessments with marketing campaigns has no clear link to program goals.

An internal privacy audit independently tests whether policies and controls are implemented and effective, and it reports gaps for remediation. Regulator notification, vendor price negotiation, and substituting audit staff for privacy leadership are not the purpose of an audit, and auditors should evaluate decisions rather than make them.

Managing an assessment means recording the risk, assigning mitigation with owners and deadlines, and documenting any decision to accept residual risk by an accountable executive. Informal tracking, removing the assessment, or letting an engineer accept the risk each leaves no accountable record of the decision.

A key risk indicator tracks conditions that tend to precede incidents, such as launching high-risk processing before assessment, so it can warn leaders in advance. Headcount, policy version counts, and speaking engagements do not indicate whether privacy risk is rising.

Continuous monitoring tests key controls on an ongoing basis, whether automatically or on a set schedule, and treats exceptions as items to escalate and resolve. A decade-long audit cycle, complaint-only detection, and one-time self-certification each leave control failures undetected for long periods.