Certified Information Privacy Professional / Europe (CIPP/E)

Last checked November 10, 2026 against the official IAPP exam page.

1. Question 1Domain I - Introduction to European Data Protection

   Which instrument is generally recognised as the first legally binding international treaty on the automated processing of personal data, opened for signature by the Council of Europe in 1981?

   1. AOECD Guidelines on the Protection of Privacy
   2. BConvention 108 of the Council of Europe
   3. CUniversal Declaration of Human Rights
   4. DDirective 95/46/EC of the European Parliament and of the Council
   Show answer and explanationHide answer

   Correct answer: B

   Convention 108 (1981) is the first legally binding international instrument on data protection. The OECD Guidelines are non-binding recommendations, the Universal Declaration is not a treaty, and Directive 95/46/EC is an EU instrument from 1995 rather than a Council of Europe treaty.

2. Question 2Domain II - European Data Protection Law and Regulation

   A website operator records visitors' IP addresses. The operator cannot identify visitors directly, but an internet service provider holds the information needed to link each address to a subscriber, and the operator could obtain that information through legal proceedings. How should the IP addresses be treated under the GDPR?

   1. AThey are not personal data, because the operator cannot identify visitors without help from another party
   2. BThey are personal data, since the operator has means reasonably likely to identify visitors
   3. CThey are personal data only where the ISP has actually disclosed a subscriber's name to the operator
   4. DThey are personal data only if the visitors have registered an account with the operator
   Show answer and explanationHide answer

   Correct answer: B

   Recital 26 and the CJEU in Breyer (C-582/14) treat an identifier as personal data where the controller has legal means reasonably likely to be used to identify the person, including through a third party such as an ISP. Requiring registration or actual disclosure, or ignoring identification through a third party, does not reflect that test.

3. Question 3Domain III - European Data Processing

   An online clothing retailer collects a customer's delivery address so it can send an order the customer placed. Which lawful basis under Article 6(1) GDPR is most appropriate for that address?

   1. AConsent, because the customer must give consent before any personal data such as an address can be processed
   2. BLegitimate interests, because the retailer has a commercial interest in every delivery it makes
   3. CPerformance of a contract with the customer, because the address is needed to deliver the order
   4. DVital interests, because a failed delivery could cause the customer financial harm
   Show answer and explanationHide answer

   Correct answer: C

   Article 6(1)(b) allows processing necessary for the performance of a contract with the data subject, and delivering a placed order needs the address. Consent is not the right basis where processing is necessary for the contract, legitimate interests is unnecessary for this core need, and vital interests covers only life-threatening emergencies.

4. Question 4Domain IV - European Data Protection: Scope and Accountability

   A US online shop has no office in the EU. It ships goods to customers in Germany and France, prices its site in euros, and offers a French-language version. Under Article 3 GDPR, what is the most accurate conclusion?

   1. AThe GDPR does not apply, because the shop has no establishment in the EU and processes data in the United States
   2. BThe GDPR applies, since the shop offers goods to people in the EU, as shown by delivery, pricing and language
   3. CThe GDPR applies only if a national data protection authority has designated the shop as a controller
   4. DThe GDPR applies only to the personal data of customers who hold a resident EU address, not to casual visitors of the site
   Show answer and explanationHide answer

   Correct answer: B

   Article 3(2)(a) extends the GDPR to controllers without an EU establishment that offer goods or services to data subjects in the Union, and the EDPB territorial scope guidance treats EU delivery, euro pricing and local language as indicators of targeting. Lacking an EU office does not exclude the GDPR, and designation by an authority is not a condition for applicability.

5. Question 5Domain V - Compliance with European Data Protection Law and Regulation

   An employer wants to monitor employees' work email content to detect data leaks. Which approach best reflects the GDPR's requirements for workplace monitoring?

   1. ARely on the employees' consent, since they signed the employment contract and agreed to all workplace policies in it
   2. BRead all emails continuously, because the company owns the email system and everything stored on it
   3. CCarry out a proportionate assessment, inform staff clearly about the monitoring, and use the least intrusive means
   4. DMonitor only after a supervisory authority has approved the monitoring method in writing for this employer
   Show answer and explanationHide answer

   Correct answer: C

   Employee monitoring must be lawful, transparent and proportionate, which means assessing necessity, balancing the employer's interest against staff privacy, and using the least intrusive means. Consent in an employment contract is generally not freely given, continuous reading of all emails is disproportionate, and no prior approval by a supervisory authority is needed.