SCENARIO -Please use the following to answer the next question: Penny has recently joined Ace Space, a company that sells homeware accessories online, as its new privacy officer. The company is based in California but thanks to some great publicity from a social media influencer last year, the company has received an influx of sales from the EU and has set up a regional office in Ireland to support this expansion. To become familiar with Ace Space’s practices and assess what her privacy priorities will be, Penny has set up meetings with a number of colleagues to hear about the work that they have been doing and their compliance efforts. Penny’s colleague in Marketing is excited by the new sales and the company’s plans, but is also concerned that Penny may curtail some of the growth opportunities he has planned. He tells her “I heard someone in the breakroom talking about some new privacy laws but I really don’t think it affects us. We’re just a small company. I mean we just sell accessories online, so what’s the real risk?” He has also told her that he works with a number of small companies that help him get projects completed in a hurry. “We’ve got to meet our deadlines otherwise we lose money. I just sign the contracts and get Jim in finance to push through the payment. Reviewing the contracts takes time that we just don’t have.” In her meeting with a member of the IT team, Penny has learned that although Ace Space has taken a number of precautions to protect its website from malicious activity, it has not taken the same level of care of its physical files or internal infrastructure. Penny’s colleague in IT has told her that a former employee lost an encrypted USB key with financial data on it when he left. The company nearly lost access to their customer database last year after they fell victim to a phishing attack. Penny is told by her IT colleague that the IT team “didn’t know what to do or who should do what. We hadn’t been trained on it but we’re a small team though, so it worked out OK in the end.” Penny is concerned that these issues will compromise Ace Space’s privacy and data protection. Penny is aware that the company has solid plans to grow its international sales and will be working closely with the CEO to give the organization a data “shake up”. Her mission is to cultivate a strong privacy culture within the company. Penny has a meeting with Ace Space’s CEO today and has been asked to give her first impressions and an overview of her next steps. To help Penny and her CEO with their objectives, what would be the most helpful approach to address her IT concerns?
Answer(s): B
Why option B – Undertake a tabletop exercise – is the most helpful approachTargets the identified gaps – The IT team admitted it “didn’t know what to do or who should do what” after a phishing incident. A tabletop exercise walks the team through realistic breach-scenario playbooks, clarifying roles, responsibilities, escalation paths, and communication channels. This directly addresses the lack of defined response processes. Low-cost, high-impact – It requires only time and coordination, not heavy capital expenditure or major system changes. For a small, resource-constrained IT group, it is the most pragmatic way to build confidence and competence without disrupting ongoing operations. Creates measurable progress – The exercise produces documented lessons learned, gaps, and action items that can be fed into the privacy “shake-up” agenda and later prioritized (e.g., encryption, asset inventory). It therefore establishes a concrete, repeatable improvement cycle. Facilitates cross-functional alignment – By involving relevant stakeholders (IT, legal, compliance, finance),the exercise ensures that privacy and security controls are understood and supported across the organization, mitigating the Marketing colleague’s concern about “curtailing growth opportunities.”Why the other options are less suitableA – Roll out an encryption policy – While encryption is essential, implementing a policy without first knowing what data assets exist, how they are stored, and who owns them can lead to mis-classification, missed data, or incomplete coverage. Moreover, the immediate priority is to understand and improve response capabilities, not just technical controls. C – Ensure inventory of IT assets is maintained – Asset inventory is a foundational activity, but the IT team’s current deficiency is not a lack of inventory; it is a lack of incident-response awareness. Inventory alone does not teach the team how to react when an incident occurs. D – Host a town-hall discussion for all IT employees – A town-hall can raise awareness, but it is a broad communication forum rather than a structured, scenario-based drill. It does not guarantee that participants will practice decision-making, role assignment, or communication under pressure, which are the critical gaps identified.Therefore, the most helpful approach to address the IT concerns is to under-take a tabletop exercise , as it directly builds response capability, clarifies responsibilities, and generates actionable insights that align with the CEO’s goal of a comprehensive privacy transformation.
1. International Association of Privacy Professionals (IAPP) – “Tabletop Exercise Guide for PrivacyProfessionals” – https://iapp.org/resources/tabletop-exercise-guide/ 2. ISO/IEC 27001:2022 – Annex A.16.1: Security Incident Management – Guidance on developing and testing incident response processes – https://www.iso.org/standard/75773.htmlThese resources provide detailed frameworks for conducting effective tabletop exercises and aligning them with privacy and information-security program objectives.
SCENARIO -Please use the following to answer the next question: For 15 years, Albert has worked at Treasure Box – a mail order company in the United States (U.S.) that used to sell decorative candles around the world, but has recently decided to limit its shipments to customers in the 48 contiguous states. Despite his years of experience, Albert is often overlooked for managerial positions. His frustration about not being promoted, coupled with his recent interest in issues of privacy protection, have motivated Albert to be an agent of positive change. He will soon interview for a newly advertised position, and during the interview, Albert plans on making executives aware of lapses in the company’s privacy program. He feels certain he will be rewarded with a promotion for preventing negative consequences resulting from the company’s outdated policies and procedures. For example, Albert has learned about the AICPA (American Institute of Certified Public Accountans)/CICA (Canadian Institute of Chartered Accountants) Privacy Maturity Model (PMM). Albert thinks the model is a useful way to measure Treasure Box’s ability to protect personal data. Albert has noticed that Treasure Box fails to meet the requirements of the highest level of maturity of this model; at his interview, Albert will pledge to assist the company with meeting this level in order to provide customers with the most rigorous security available. Albert does want to show a positive outlook during his interview. He intends to praise the company’s commitment to the security of customer and employee personal data against external threats. However, Albert worries about the high turnover rate within the company, particularly in the area of direct phone marketing. He sees many unfamiliar faces every day who are hired to do the marketing, and he often hears complaints in the lunch room regarding long hours and low pay, as well as what seems to be flagrant disregard for company procedures. In addition, Treasure Box has had two recent security incidents. The company has responded to the incidents with internal audits and updates to security safeguards. However, profits still seem to be affected and anecdotal evidence indicates that many people still harbor mistrust. Albert wants to help the company recover. He knows there is at least one incident the public in unaware of, although Albert does not know the details. He believes the company’s insistence on keeping the incident a secret could be a further detriment to its reputation. One further way that Albert wants to help Treasure Box regain its stature is by creating a toll-free number for customers, as well as a more efficient procedure for responding to customer concerns by postal mail. In addition to his suggestions for improvement, Albert believes that his knowledge of the company’s recent business maneuvers will also impress the interviewers. For example, Albert is aware of the company’s intention to acquire a medical supply company in the coming weeks. With his forward thinking, Albert hopes to convince the managers who will be interviewing him that he is right for the job. The company may start to earn back the trust of its customer base by following Albert’s suggestion regarding which handling procedure?
Answer(s): C
role=iapp, Tito1=Data Retention, Tito2=Privacy MaturityJustificationCorrect choice – Escalation (C)The interview scenario centers on how Treasure Box should handle and respond to customer-raised privacy and security concerns . A robust escalation procedure ensures that complaints are promptly routed to the appropriate privacy-risk function, investigated, and resolved in a manner that demonstrates transparency and commitment to protection. By formalizing escalation, the company can rebuild credibility, show that it takes every concern seriously, and align its operational response with the highest level of the AICPA/CICA Privacy Maturity Model (PMM), directly supporting trust restoration.Why the other options are less appropriateAccess (A) – Focuses on granting data subjects the right to view their personal data. While access is a privacy principle, the immediate need is not about providing data extracts but about processing and resolving raised issues. Correction (B) – Concerns rectifying inaccurate data. The scenario does not highlight data inaccuracies; it highlights distrust stemming from how complaints are handled. Data Integrity (D) – Involves ensuring data is accurate and complete. Although important, the trust issue is tied to response handling rather than the static correctness of the data itself.Technical fit with Privacy Maturity ModelThe PMM’s highest maturity level emphasizes continuous monitoring, incident response, and escalation of privacy concerns . Implementing a clear escalation workflow aligns directly with attaining that maturity and the associated security posture Albert intends to champion.Conclusion Adopting a formal escalation procedure for customer privacy concerns directly addresses the trust gap, demonstrates adherence to advanced privacy maturity, and is the actionable step Albert can propose to earn executive confidence.
AICPA/CICA Privacy Maturity Model – https://www.aicpa.org/content/dam/aicpa/interestareas/forensicandvaluationservices/privacy/framework.pdf NIST Privacy Framework – https://www.nist.gov/publications/nist-privacy-framework
“Collection”, “access” and “destruction” are aspects of what privacy management process?
Answer(s): A
JustificationCorrect choice – A. The data governance strategy“Collection”, “access” and “destruction” are core lifecycle activities that privacy managers must define, monitor, and enforce as part of an organization-wide data-governance program. Governance frameworks (e.g., ISO 27701, NIST Privacy Framework) explicitly embed these stages to ensure that personal data is gathered only with lawful basis, accessed only by authorized parties, and securely destroyed when no longer needed. By integrating these activities into a formal strategy, an entity can demonstrate accountability, control risk, and meet regulatory obligations throughout the data lifecycle.Why the other options are less appropriateB: The breach response plan – focuses on detecting, containing, and remediating privacy incidents after a breach occurs; it does not prescribe routine collection, ongoing access controls, or scheduled destruction. C. The metric life cycle – pertains to measuring performance of privacy controls, not the administrative processes of gathering, granting, or deleting data. D. The business case – is a justification document outlining the value and feasibility of a privacy initiative; it does not delineate operational stages such as collection, access, and destruction.
ISO/IEC 27701:2019 – Privacy Information Management System (PIMS) – Requirements and Guidelines – https://www.iso.org/standard/72695.html NIST Privacy Framework – A Tool for Managing Privacy Risk – https://csrc.nist.gov/Projects/Privacy-FrameworkEnd of response.
What does it mean to “rationalize” data protection requirements?
Why option B is the best answer“Rationalizing” data-protection obligations means identifying the points of convergence among multiple statutes, standards, and regulatory expectations so that a single, cohesive set-of-controls can satisfy several requirements simultaneously. This approach reduces duplication of effort, streamlines governance, and makes it easier to demonstrate consistent compliance to auditors and regulators. By focusing on the overlap rather than the penalties, redundancy, or relative stringency of individual rules, organizations can build a scalable privacy-by-design framework that addresses the core obligations common to all applicable laws.Why the other options are less appropriateOption A concentrates on penalties and risk cost-evaluation, which is a financial-risk exercise, not a systematic method for harmonizing legal obligations. Option C suggests eliminating redundant rules altogether; however, laws may share compliance criteria for legitimate policy reasons, and removing a regulation is outside the remit of a privacy manager. Option D recommends prioritizing weaker requirements, which can lead to non-compliance with stronger, more stringent mandates that may still apply.This rationale aligns with the principles of privacy-by-design and risk-based program development that the CIPP certification expects candidates to master.
International Association of Privacy Professionals (IAPP), Privacy Program Management – Chapter 3: “Designing a Unified Privacy Framework,” https://iapp.org/resources/media/Privacy-Program-Management.pdf European Data Protection Board (EDPB), Guidance on the Relationship between the GDPR and Other Legal Obligations, https://edpb.europa.eu/law/official-guidance-guideline/relationship-between-gdpr-and-other-legal-obligations_en.pdf
Which term describes a piece of personal data that alone may not identify an individual?
Answer(s): D
JustificationD: Single attribute – A single data element, such as an eye color or ZIP code, may not uniquely identify a person, yet it can become identifying when combined with other attributes. This matches the definition of a piece of personal data that, on its own, may not identify an individual. A. Unbundled data – This term refers to data that has been separated from a combined set, but it does not specifically convey the idea of being non-identifying by itself. B. Singularity – “Singularity” is a generic concept of uniqueness and is not used in privacy terminology to describe a non-identifying data point. C. Non-aggregated infopoint – While the phrase sounds plausible, it is not a standard term in data-privacy frameworks and lacks the clear distinction of “single attribute.”Therefore, D. Single attribute is the most accurate and widely accepted term.
1. European Data Protection Board (EDPB) – Glossary of Data Protection Terms, “Single attribute”definition – https://edpb.europa.eu/law/glossary_en 2. International Association of Privacy Professionals (IAPP) – Privacy Officer Study Guide, section on“Identifiers and Attributes” – https://iapp.org/resources/privacy-management/privacy-office-training/privacy-study-guide/
SCENARIO -Please use the following to answer the next question: Your organization, the Chicago (U.S.)-based Society for Urban Greenspace, has used the same vendor to operate all aspects of an online store for several years. As a small nonprofit, the Society cannot afford the higher-priced options, but you have been relatively satisfied with this budget vendor, Shopping Cart Saver (SCS). Yes, there have been some issues. Twice, people who purchased items from the store have had their credit card information used fraudulently subsequent to transactions on your site, but in neither case did the investigation reveal with certainty that the Society’s store had been hacked. The thefts could have been employee-related. Just as disconcerting was an incident where the organization discovered that SCS had sold information it had collected from customers to third parties. However, as Jason Roland, your SCS account representative, points out, it took only a phone call from you to clarify expectations and the “misunderstanding” has not occurred again. As an information-technology program manager with the Society, the role of the privacy professional is only one of many you play. In all matters, however, you must consider the financial bottom line. While these problems with privacy protection have been significant, the additional revenues of sales of items such as shirts and coffee cups from the store have been significant. The Society’s operating budget is slim, and all sources of revenue are essential. Now a new challenge has arisen. Jason called to say that starting in two weeks, the customer data from the store would now be stored on a data cloud. “The good news,” he says, “is that we have found a low-cost provider in Finland, where the data would also be held. So, while there may be a small charge to pass through to you, it won’t be exorbitant, especially considering the advantages of a cloud.” You begin to research and discover that a number of the leading cloud service providers have signed a letter of intent to work together on shared conventions and technologies for privacy protection. You make a note to find out if Jason’s Finnish provider is signing on. After conducting research, you discover a primary data protection issue with cloud computing. Which of the following should be your biggest concern?
Why option B is the best answer The foremost privacy risk in moving the Society’s customer data to a foreign cloud service is the vendor’s reluctance to disclose how it protects that data. Transparent security practices are required to assess compliance with data-protection laws, demonstrate due-diligence in contractual safeguards, and enable the organization to verify that safeguards (encryption, access controls, breach-notification procedures) meet its privacy obligations. Without this information the Society cannot validate the provider’s security posture, limiting its ability to enforce contractual privacy clauses or to respond to regulatory inquiries.Why the other options are less appropriateA – Open programming model – While an open API can increase the attack surface, it is not inherently a privacy-specific risk; openness can be controlled through authentication and scope-based access, and the primary privacy concern remains the vendor’s willingness to disclose security controls. C – Lack of vendors in the market – The cloud market is extensive and competitive; scarcity of providers is not a privacy issue but rather a business-availability concern. D – Reduced resilience leading to data loss – Resilience is a reliability/availability concern. Data loss may affect operations, but the immediate privacy breach vector stems from inadequate security transparency, which directly compromises personal data protection.Bottom line – The critical privacy red flag is the vendor’s unwillingness to share security information, making option B the biggest concern.
Cloud Security Alliance (CSA) – Security Guidance for Critical Areas: Data Protection (2023). https://cloudsecurityalliance.org/research/guidance/security-guidance/ NIST Special Publication 800-144 – Recommendations for Cloud Computing Security (2019). https://csrc.nist.gov/publications/detail/sp/800-144/final
SCENARIO -Please use the following to answer the next question: Your organization, the Chicago (U.S.)-based Society for Urban Greenspace, has used the same vendor to operate all aspects of an online store for several years. As a small nonprofit, the Society cannot afford the higher-priced options, but you have been relatively satisfied with this budget vendor, Shopping Cart Saver (SCS). Yes, there have been some issues. Twice, people who purchased items from the store have had their credit card information used fraudulently subsequent to transactions on your site, but in neither case did the investigation reveal with certainty that the Society s store had been hacked. The thefts could have been employee-related. Just as disconcerting was an incident where the organization discovered that SCS had sold information it had collected from customers to third parties. However, as Jason Roland, your SCS account representative, points out, it took only a phone call from you to clarify expectations and the “misunderstanding” has not occurred again. As an information-technology program manager with the Society, the role of the privacy professional is only one of many you play. In all matters, however, you must consider the financial bottom line. While these problems with privacy protection have been significant, the additional revenues of sales of items such as shirts and coffee cups from the store have been significant. The Society’s operating budget is slim, and all sources of revenue are essential. Now a new challenge has arisen. Jason called to say that starting in two weeks, the customer data from the store would now be stored on a data cloud. “The good news,” he says, “is that we have found a low-cost provider in Finland, where the data would also be held. So, while there may be a small charge to pass through to you, it won’t be exorbitant, especially considering the advantages of a cloud.” You begin to research and discover that a number of the leading cloud service providers have signed a letter of intent to work together on shared conventions and technologies for privacy protection. You make a note to find out if Jason’s Finnish provider is signing on. What is the best way to prevent the Finnish vendor from transferring data to another party?
JustificationCorrect choice – C. Include transfer prohibitions in the vendor contractA contractual clause that expressly forbids any sub-processing or international transfer of the Society’s customer data creates a legally enforceable obligation. It obligates the Finnish provider to obtain prior consent for any new deployment or onward transfer, providing the strongest and most direct control over data movement. This aligns with data-protection regulations (e.g., GDPR Art. 28) that require controllers to embed transfer-restriction provisions in processor agreements.Why the other options are less suitableA: Restrict the vendor to using company security controls – Technical controls alone cannot prevent the provider from moving data to another entity; they address confidentiality and integrity but not jurisdiction-level transfer rights. B. Offer company resources to assist with the processing – Providing additional resources does not alter the provider’s ability to transfer data and adds cost without improving legal enforceability. D. Lock the data down in its current location – Cloud data is inherently replicated and moved for redundancy; a “lock-down” is not technically feasible and does not address contractual transfer rights.Conclusion Embedding explicit transfer-prohibition language in the vendor contract is the most effective, regulator-compliant method to stop an unauthorized data transfer to another party.
GDPR Article 28 – Processor contracts and data-transfer restrictions: https://gdpr.eu/article-28-data-processor/ EU Model Clause requirements for international data transfers: https://ec.europa.eu/info/law/law-topic/data-protection_en
SCENARIO -Please use the following to answer the next question: Your organization, the Chicago (U.S.)-based Society for Urban Greenspace, has used the same vendor to operate all aspects of an online store for several years. As a small nonprofit, the Society cannot afford the higher-priced options, but you have been relatively satisfied with this budget vendor, Shopping Cart Saver (SCS). Yes, there have been some issues. Twice, people who purchased items from the store have had their credit card information used fraudulently subsequent to transactions on your site, but in neither case did the investigation reveal with certainty that the Society’s store had been hacked. The thefts could have been employee-related. Just as disconcerting was an incident where the organization discovered that SCS had sold information it had collected from customers to third parties. However, as Jason Roland, your SCS account representative, points out, it took only a phone call from you to clarify expectations and the “misunderstanding” has not occurred again. As an information-technology program manager with the Society, the role of the privacy professional is only one of many you play. In all matters, however, you must consider the financial bottom line. While these problems with privacy protection have been significant, the additional revenues of sales of items such as shirts and coffee cups from the store have been significant. The Society’s operating budget is slim, and all sources of revenue are essential. Now a new challenge has arisen. Jason called to say that starting in two weeks, the customer data from the store would now be stored on a data cloud. “The good news,” he says, “is that we have found a low-cost provider in Finland, where the data would also be held. So, while there may be a small charge to pass through to you, it won’t be exorbitant, especially considering the advantages of a cloud.” You begin to research and discover that a number of the leading cloud service providers have signed a letter of intent to work together on shared conventions and technologies for privacy protection. You make a note to find out if Jason’s Finnish provider is signing on. What process can best answer your questions about the vendor’s data security safeguards?
Correct Option: A – Second-party supplier auditWhy the audit is the most appropriate methodDirect assessment of security controls: A formal, on-site or remote audit performed by a qualified assessor (or by the organization’s own privacy team using audit checklists) can verify that the cloud provider implements the specific technical and organizational safeguards required by law (e.g., encryption at rest, access controls, incident-response procedures). Evidence of compliance: Audits produce documented findings, audit reports, and certifications (e.g., ISO 27001, SOC 2) that can be referenced when validating the provider’s data-security posture. Alignment with the “privacy-by-design” principle: The audit can be scoped to evaluate data-processing activities, third-party sharing policies, and data-subject rights mechanisms—all critical for a nonprofit handling personal data. Controls cost-effective decision-making: Because the Society must stay within limited budgets, an audit focused on the provider’s actual controls—rather than conducting broad external checks—delivers the most actionable data without unnecessary expense.Why the other options are less suitableB: Reference check with other clients – References can provide anecdotal satisfaction but rarely reveal detailed technical safeguards or compliance status; they may also be limited to non-technical feedback and cannot verify specific security controls. C. Table-top demonstration of a potential threat – Simulations are useful for training but do not demonstrate that the provider’s existing security measures are effective; they only illustrate hypothetical attack scenarios without validating the provider’s implemented defenses. D. Public records search for earlier legal violations – This search may uncover past enforcement actions but cannot confirm current security controls, data-handling policies, or contractual commitments, nor does it address the provider’s present-day safeguards.
ISO/IEC 27001:2022 – International standard for information security management systems. https://www.iso.org/standard/64754.html International Association of Privacy Professionals (IAPP) – “Vendor Audits and Due Diligence” guide. https://iapp.org/resources/vendor-audits/
Post your Comments and Discuss IAPP CIPM exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPM content, but please register or login to continue.