100% Free IAPP CIPM Practice Test Questions

Question 1

Which aspect of a privacy program can best aid an organization’s response time to a Data Subject Access Request (DSAR)?

A : Conducting privacy training

B : Maintaining a written DSAR policy

C : Creating a comprehensive data inventory

D : Implementing Privacy Impact Assessment (PIAs).

Answer: C

Question 2

Which term describes a piece of personal data that alone may not identify an individual?

A : Unbundled data

B : A singularity

C : Non-aggregated infopoint

D : A single attribute

Answer: A

Question 3

An organization's internal audit team should do all of the following EXCEPT?

A : Implement processes to correct audit failures.

B : Verify that technical measures are in place.

C : Review how operations work in practice

D : Ensure policies are being adhered to.

Answer: B

Question 4

Under the General Data Protection Regulation (GDPR), international data transfer is allowed using the mechanisms in all of the following scenarios EXCEPT between companies who?

A : Are part of the same group of enterprise using approved Binding Corporate Rules (BCRs).

B : Have signed up to the EU Standard Contractual Clauses.

C : Have put in place a binding confidentiality agreement.

D : Have put in place an approved code of conduct.

Answer: C

Question 5

SCENARIO

Please use the following to answer the next question:

Jonathan recently joined a healthcare payment processing solutions company as a senior privacy manager.

One morning, Jonathan awakens to several emails informing him that an individual cloud server failed due to a

flood in its server room, damaging its hardware and destroying all the data the company had stored on that

drive. Jonathan was not aware that the company had this particular cloud account or that any data was being

stored there because it was not included in the data mapping or data inventory provided to him by his

predecessor. Jonathan's predecessor conducted a data inventory and mapping exercise 4 years ago and

updated it on an annual basis.

Renee works in the sales department and tells Jonathan that she doesn't think that account had been used

since the company moved to a bigger cloud vendor three years ago. She also advised him that the account was

mostly used by Human Resources (HR) and Accounts Payable (AP). Jonathan speaks to both departments and

learns that each had met with his predecessor multiple times and explained they saved sensitive personal data

on that drive, including health and financial related personal data and "other stuff." Jonathan also learns that the

data stored in that account was not backed up pursuant to company policy. Jonathan asks his IT department

who had access to that particular account and learns that there were no access controls in place, making the

account available to anyone in the company, despite the purported sensitivity of the data being stored there.

Jonathan is panicking as the data can't be recovered, and he can't determine exactly what data was saved on

that account or to whom it belongs. Two days later, the company receives 32 data subject access requests and

Accounts Payable confirms Jonathan's worry that these data subjects' personal data was likely stored on this

account. He searches for the company's data subject access request policy, but later learns it doesn't exist.

Based on the scenario above, what is the most appropriate next step Jonathan should take?

A : Consult with the legal team to determine how to address the data subjects' requests and determine the risk of noncompliance.

B : Consult with other key stakeholders to create a presentation on the incident and lessons learned for the board of directors.

C : Consult with the public relations team to discuss potential brand impact of not responding to the data subjects' requests.

D : Consult with the IT team to understand how and why this cloud account was not disabled.

Answer: A

100% Free CIPM Practice Exam Questions (2026)