CIPPE Exam Prep Free practice test →

Free CIPPE Practice Questions

10 free, exam-style Certified Information Privacy Professional/Europe (CIPPE) practice questions with answers and explanations. No signup required. Work through them below, then take the full free CIPPE practice test to study every exam domain.

These 10 free CIPPE questions are organized by exam domain, so you can see how each part of the Certified Information Privacy Professional/Europe blueprint is tested. Reveal the answer and explanation under each question.

Domain 2: European Data Protection Law and Regulation

Question 1

SCENARIO: A hospital processes patient health records. What is the likely legal basis under Article 9?

  1. Explicit consent only
  2. Healthcare provision under 9(2)(h)
  3. Legitimate interests
  4. Public task
Show answer & explanation

Correct answer: B - Healthcare provision under 9(2)(h)

Domain 3: Compliance with European Data Protection Law and Regulation

Question 2

SCENARIO: A controller has multiple legal bases for processing the same dataset. What must be disclosed regarding the legal basis?

  1. Any one legal basis is sufficient
  2. All applicable legal bases for the processing
  3. Only the primary legal basis
  4. The strongest legal basis
Show answer & explanation

Correct answer: B - All applicable legal bases for the processing

Question 3

Under Guidelines 1/2024, when must a Legitimate Interest Assessment (LIA) be documented?

  1. Only if requested by authority
  2. Before processing begins and maintained
  3. After processing has commenced
  4. Only for high-risk processing
Show answer & explanation

Correct answer: B - Before processing begins and maintained

Question 4

SCENARIO: A controller discovers they processed personal data without an adequate legal basis. What is their obligation even without a data subject request?

  1. Continue processing until requested
  2. Proactively erase the unlawfully processed data
  3. Seek retrospective consent
  4. Report to authority only
Show answer & explanation

Correct answer: B - Proactively erase the unlawfully processed data

Domain 4: Territorial and Material Scope, and Accountability

Question 5

SCENARIO: A company hires a cloud provider for email hosting. What must exist between them per Article 28?

  1. A verbal agreement is acceptable for such services
  2. Contract/legal act binding processor with Article 28(3) specific content
  3. General terms of service are sufficient without more
  4. No formal agreement is needed for cloud services
Show answer & explanation

Correct answer: B - Contract/legal act binding processor with Article 28(3) specific content

Question 6

SCENARIO: An online retailer uses AI to profile customers for personalized pricing. Is a DPIA likely required?

  1. No, pricing decisions are business discretion only
  2. Yes, Article 35(3)(a) for extensive profiling with significant effects
  3. Yes, but only if prices are increased for customers
  4. Yes, but only for premium or high-value customers
Show answer & explanation

Correct answer: B - Yes, Article 35(3)(a) for extensive profiling with significant effects

Question 7

What must a DPIA contain at minimum according to Article 35(7)?

  1. Risk assessment only
  2. Description of processing, necessity/proportionality, risks, safeguards
  3. Controller contact details only
  4. List of data subjects affected
Show answer & explanation

Correct answer: B - Description of processing, necessity/proportionality, risks, safeguards

Question 8

What must a joint controller arrangement determine?

  1. Which controller is primary
  2. Respective responsibilities for GDPR compliance
  3. Which controller handles all requests
  4. Financial liability split
Show answer & explanation

Correct answer: B - Respective responsibilities for GDPR compliance

Domain 5: European Data Protection in Practice

Question 9

SCENARIO: GPS tracking of company vehicles driven by employees. Is consent valid legal basis?

  1. Yes, valid if employees provide consent
  2. Questionable; employment may invalidate free consent; legitimate interests better
  3. Yes, always valid in employment contexts
  4. Valid only with union agreement obtained
Show answer & explanation

Correct answer: B - Questionable; employment may invalidate free consent; legitimate interests better

Question 10

SCENARIO: Irish DPC drafts decision on Meta, German and French DPAs object. Irish DPC disagrees. What happens?

  1. Irish DPC decision final
  2. EDPB issues binding decision
  3. Commission arbitrates
  4. Majority vote of authorities
Show answer & explanation

Correct answer: B - EDPB issues binding decision

The rest of the CIPPE blueprint

The CIPPE exam also covers these domains. Drill them in the full free practice test:

Ready for the real thing?

Practice hundreds more CIPPE questions with instant scoring, weak-area drills, and full exam simulations.

Start the free practice test See pricing