IAPP CIPP-C Practice Test : Free Online Preparation

Free IAPP CIPP-C Exam Questions

If an organization certified under Privacy Shield wants to transfer personal data to a third party acting as an

agent, the organization must ensure the third party does all of the following EXCEPT?

Please use the following to answer the next QUESTION

Felicia has spent much of her adult life overseas, and has just recently returned to the U.S. to help her friend

Celeste open a jewelry store in California. Felicia, despite being excited at the prospect, has a number of

security concerns, and has only grudgingly accepted the need to hire other employees. In order to guard

against the loss of valuable merchandise, Felicia wants to carefully screen applicants. With their permission,

Felicia would like to run credit checks, administer polygraph tests, and scrutinize videos of interviews. She

intends to read applicants’ postings on social media, ask QUESTION NO:s about drug addiction, and solicit

character references. Felicia believes that if potential employees are serious about becoming part of a dynamic

new business, they will readily agree to these requirements.

Felicia is also in favor of strict employee oversight. In addition to protecting the inventory, she wants to

prevent mistakes during transactions, which will require video monitoring. She also wants to regularly check

the company vehicle’s GPS for locations visited by employees. She also believes that employees who use their

own devices for work-related purposes should agree to a certain amount of supervision.

Given her high standards, Felicia is skeptical about the proposed location of the store. She has been told that

many types of background checks are not allowed under California law. Her friend Celeste thinks these

worries are unfounded, as long as applicants verbally agree to the checks and are offered access to the results.

Nor does Celeste share Felicia’s concern about state breach notification laws, which, she claims, would be

costly to implement even on a minor scale. Celeste believes that

even if the business grows a customer database of a few thousand, it’s unlikely that a state agency would

hassle an honest business if an accidental security incident were to occur.

In any case, Celeste feels that all they need is common sense – like remembering to tear up sensitive

documents before throwing them in the recycling bin. Felicia hopes that she’s right, and that all of her

concerns will be put to rest next month when their new business consultant (who is also a privacy

professional) arrives from North Carolina.

Based on Felicia’s Bring Your Own Device (BYOD) plan, the business consultant will most likely advise

Felicia and Celeste to do what?

Please use the following to answer the next QUESTION:

A US-based startup company is selling a new gaming application. One day, the CEO of the company receives

an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an

EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer’s data

handling practices.

The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in

the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her

withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup

company, was never informed of this request for erasure by the EU-based retail partner. The supervisory

authority investigating the complaint has threatened the suspension of data flows if the parties involved do not

cooperate with the investigation. The letter closes with an urgent request: “Please act immediately by

identifying all personal data received from our company.”

This is an important partnership. Company executives know that its biggest fans come from Western Europe;

and this retailer is primarily responsible for the startup’s rapid market penetration.

As the Company’s data privacy leader, you are sensitive to the criticality of the relationship with the retailer.

Upon review, the data privacy leader discovers that the Company’s documented data inventory is obsolete.

What is the data privacy leader’s next best source of information to aid the investigation?

Which of the following best describes an employer’s privacy-related responsibilities to an employee who has

An employer has a responsibility to maintain a former employee’s access to computer systems and

company data needed to support claims against the company such as discrimination.

An employer has a responsibility to permanently delete or expunge all sensitive employment records to

minimize privacy risks to both the employer and former employee.

An employer may consider any privacy-related responsibilities terminated, as the relationship between

employer and employee is considered primarily contractual.

An employer has a responsibility to maintain the security and privacy of any sensitive employment

records retained for a legitimate business purpose.

Which of the following types of information would an organization generally NOT be required to disclose to

Free IAPP CIPP-C Exam Questions

Try our Free Demo Practice Tests for Comprehensive CIPP-C Exam Preparation