100% Free IAPP CIPP-C Practice Test Questions

Question 1

According to the FTC Report of 2012, what is the main goal of Privacy by Design?

A : Obtaining consumer consent when collecting sensitive data for certain purposes

B : Establishing a system of self-regulatory codes for mobile-related services

C : Incorporating privacy protections throughout the development process

D : Implementing a system of standardization for privacy notices

Answer: C

Question 2

Global Manufacturing Co’s Human Resources department recently purchased a new software tool. This tool

helps evaluate future candidates for executive roles by scanning emails to see what those candidates say and

what is said about them. This provides the HR department with an automated “360 review” that lets them

know how the candidate thinks and operates, what their peers and direct reports say about them, and how well

they interact with each other.

What is the most important step for the Human Resources Department to take when implementing this new

software?

A : Making sure that the software does not unintentionally discriminate against protected groups.

B : Ensuring that the software contains a privacy notice explaining that employees have no right to privacyas long as they are running this software on organization systems to scan email systems.

C : Confirming that employees have read and signed the employee handbook where they have been advisedthat they have no right to privacy as long as they are using the organization’s systems, regardless of theprotected group or laws enforced by EEOC.

D : Providing notice to employees that their emails will be scanned by the software and creating automatedprofiles.

Answer: A

Question 3

Acme Student Loan Company has developed an artificial intelligence algorithm that determines whether an

individual is likely to pay their bill or default. A person who is determined by the algorithm to be more likely

to default will receive frequent payment reminder calls, while those who are less likely to default will not

receive payment reminders.

Which of the following most accurately reflects the privacy concerns with Acme Student Loan Company using

artificial intelligence in this manner?

A : If the algorithm uses risk factors that impact the automatic decision engine. Acme must ensure that thealgorithm does not have a disparate impact on protected classes in the output.

B : If the algorithm makes automated decisions based on risk factors and public information, Acme need notdetermine if the algorithm has a disparate impact on protected classes.

C : If the algorithm’s methodology is disclosed to consumers, then it is acceptable for Acme to have adisparate impact on protected classes.

D : If the algorithm uses information about protected classes to make automated decisions, Acme mustensure that the algorithm does not have a disparate impact on protected classes in the output.

Answer: B

Question 4

SCENARIO

Please use the following to answer the next QUESTION

Felicia has spent much of her adult life overseas, and has just recently returned to the U.S. to help her friend

Celeste open a jewelry store in California. Felicia, despite being excited at the prospect, has a number of

security concerns, and has only grudgingly accepted the need to hire other employees. In order to guard

against the loss of valuable merchandise, Felicia wants to carefully screen applicants. With their permission,

Felicia would like to run credit checks, administer polygraph tests, and scrutinize videos of interviews. She

intends to read applicants’ postings on social media, ask QUESTION NO:s about drug addiction, and solicit

character references. Felicia believes that if potential employees are serious about becoming part of a dynamic

new business, they will readily agree to these requirements.

Felicia is also in favor of strict employee oversight. In addition to protecting the inventory, she wants to

prevent mistakes during transactions, which will require video monitoring. She also wants to regularly check

the company vehicle’s GPS for locations visited by employees. She also believes that employees who use their

own devices for work-related purposes should agree to a certain amount of supervision.

Given her high standards, Felicia is skeptical about the proposed location of the store. She has been told that

many types of background checks are not allowed under California law. Her friend Celeste thinks these

worries are unfounded, as long as applicants verbally agree to the checks and are offered access to the results.

Nor does Celeste share Felicia’s concern about state breach notification laws, which, she claims, would be

costly to implement even on a minor scale. Celeste believes that

even if the business grows a customer database of a few thousand, it’s unlikely that a state agency would

hassle an honest business if an accidental security incident were to occur.

In any case, Celeste feels that all they need is common sense – like remembering to tear up sensitive

documents before throwing them in the recycling bin. Felicia hopes that she’s right, and that all of her

concerns will be put to rest next month when their new business consultant (who is also a privacy

professional) arrives from North Carolina.

Based on Felicia’s Bring Your Own Device (BYOD) plan, the business consultant will most likely advise

Felicia and Celeste to do what?

A : Reconsider the plan in favor of a policy of dedicated work devices.

B : Adopt the same kind of monitoring policies used for work-issued devices.

C : Weigh any productivity benefits of the plan against the risk of privacy issues.

D : Make employment decisions based on those willing to consent to the plan in writing.

Answer: D

Question 5

Which of the following types of information would an organization generally NOT be required to disclose to

law enforcement?

A : Information about medication errors under the Food, Drug and Cosmetic Act

B : Money laundering information under the Bank Secrecy Act of 1970

C : Information about workspace injuries under OSHA requirements

D : Personal health information under the HIPAA Privacy Rule

Answer: D

Free Practice IAPP CIPP-C Exam Questions 2026