Read the following steps: Perform frequent data back-ups. Perform test restorations to verify integrity of backed-up data. Maintain backed-up data offline or on separate servers. These steps can help an organization recover from what?
Answer(s): C
Why option C (Ransomware attacks) is the correct answerFrequent backups combined with offline storage and regular integrity testing are the core controls used to restore data that has been encrypted or otherwise rendered unavailable by ransomware incidents.Ransomware typically targets data availability and integrity by encrypting files and demanding payment; organizations that can recover from clean backups mitigate the impact of such attacks. The described practice of maintaining backups offline or on separate servers aligns with industry guidance (e.g., NIST SP 800-53 PL-2, NIST Cybersecurity Framework “Backup and Recovery”) for defending against ransomware-induced data loss.Why the other options are less appropriateA: Phishing attacks – The controls described address data restoration, not the prevention or detection of credential-stealing or social-engineering tactics. Phishing is mitigated by user awareness, email filtering, and multi-factor authentication, not by backup strategies. B. Authorization errors – These involve improper access rights or mis-configurations; they are typically addressed through access-control reviews, role-based permissions, and audit logs, not through backup frequency or offline storage. D. Stolen encryption keys – Protecting keys requires key management, rotation, and HSM controls. While backups may store encrypted data, stealing a key does not directly relate to the ability to recover data from backups; the focus is on key confidentiality, not data restoration.Bottom line: The steps outlined constitute a robust backup-and-recovery program specifically designed to enable an organization to survive a ransomware attack and restore encrypted or locked data without paying the ransom.
NIST Special Publication 800-53 Revision 5 – System and Communications Protection Controls (PL-2 Backup and Restore) : https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final International Association of Privacy Professionals (IAPP) – Data Breach Response Plan Guide (includes backup and recovery best practices): https://iapp.org/resources/detail/data-breach-response-plan/
The General Data Protection Regulation (GDPR) specifies fines that may be levied against data controllers for certain infringements. Which of the following will be subject to administrative fines of up to 10 000 000 EUR, or in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year?
Answer(s): B
Why option B is the correct answerUnder Article 83(2) of the GDPR, infringements that may be subject to administrative fines of up to €10 million or 2 % of worldwide annual turnover are those classified as “less severe” violations. Failure to implement technical and organisational measures that ensure data protection by design and by default (Article 25) falls squarely within this lower-tier category. The regulation expressly lists such failures among the circumstances giving rise to the 10 million/2 % cap. The other options either correspond to higher-tier infringements (e.g., processing outside the original purpose – Article 5(1)(b) – is punishable up to €20 million or 4 % of turnover) or pertain to procedural rights that, while important, are not the primary trigger for the specific €10 million/2 % ceiling.Why the other options are less suitableOption A – Failure to demonstrate consent : Lack of demonstrable consent relates to the lawful-basis condition for processing. Non-compliance here is generally treated as a higher-tier violation (up to the 4 % cap), not the 2 % cap. Option C – Processing outside the original purpose : This breaches the purpose limitation principle (Article 5(1) (b)). Such breaches are expressly covered by the higher-tier fine structure (up to 4 %). Option D – Failure to provide rectification means : While a data-subject rights violation, it is not singled out in the GDPR’s fine-tier table as a “2 %” offence; it is assessed under the broader rights-violation provisions, which can attract the higher tier.Key GDPR provisionsArticle 25 – Data protection by design and by default : Mandates that appropriate technical and organisational measures be integrated into processing activities. Article 83(2) – Schedule of administrative fines : Defines the €10 million or 2 % cap for less severe infringements, explicitly including breaches of Article 25.
EUR-Lex – GDPR (Regulation (EU) 2016/679) – Official text of the regulation, Articles 25 and 83: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 IAPP – GDPR Fines and Penalties Overview – Practical guidance on fine tiers and examples: https://iapp.org/resources/gdpr-fines-and-penalties/These sources confirm that the failure to implement technical and organisational measures for data-protection-by-design is a classic trigger for the €10 million or 2 % fine.
SCENARIO -Please use the following to answer the next question. Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the development of the company’s flagship product, the Handy Helper. The Handy Helper is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After having had a successful launch in the United States, the Handy Helper is about to be made available for purchase worldwide. The packaging and user guide for the Handy Helper indicate that it is a “privacy friendly” product suitable for the whole family, including children, but does not provide any further detail or privacy notice. In order to use the application, a family creates a single account, and the primary user has access to all information about the other users. Upon start up, the primary user must check a box consenting to receive marketing emails from Omnipresent Omnimedia and selected marketing partners in order to be able to use the application. Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a European distributor of Handy Helper when he fielded many questions about the product from the distributor. Sanjay needed to look more closely at the product in order to be able to answer the questions as he was not involved in the product development process. In speaking with the product team, he learned that the Handy Helper collected and stored all of a user’s sensitive medical information for the medical appointment scheduler. In fact, all of the user’s information is stored by Handy Helper for the additional purpose of creating additional products and to analyze usage of the product. This data is all stored in the cloud and is encrypted both during transmission and at rest. Consistent with the CEO’s philosophy that great new product ideas can come from anyone, all Omnipresent Omnimedia employees have access to user data under a program called “Eureka.” Omnipresent Omnimedia is hoping that at some point in the future, the data will reveal insights that could be used to create a fully automated application that runs on artificial intelligence, but as of yet, Eureka is not well-defined and is considered a long-term goal. What security controls are missing from the Eureka program?
Why option B is the correct choiceLeast-privilege principle violated – The Eureka program grants every employee unrestricted read-access to all user data. In a proper privacy-by-design framework, access to personal data must be confined to the minimum set of individuals who need to know for the specific purpose for which the data is processed. Omnipresent’s “Eureka” access model fails this requirement, making it a missing security control. Direct link to GDPR Art. 32 (Security of processing) – Article 32 obliges controllers to implement “appropriate technical and organisational measures” that include restricting access to personal data to personnel who possess the necessary expertise and authority. The Eureka access model does not meet this obligation. Implication for privacy – By allowing any employee to view sensitive medical information, the program increases the attack surface (insider threat, accidental disclosure) and breaches the data-minimisation and purpose-limitation expectations of data subjects. This is precisely the control that is absent.Why the other options are less suitableOption A – “Storage of medical data in the cloud is not permissible under GDPR.” Cloud storage is expressly permitted under GDPR when adequate safeguards are applied. The issue is not the location (cloud vs. on-premises) but how the data is protected and accessed.Option C – “Collection of data without a defined purpose might violate the fairness principle.” While indefinite purpose definition can raise lawful-basis concerns, this statement describes a purpose-definition issue, not a missing security control. The question explicitly asks for a missing security control, so option C is off-topic.Option D – “Encryption of the data at rest prevents European users from having the right of access and the right of portability of their data.” Encryption actually supports compliance with data-subject rights; it does not block access or portability. This option misstates the effect of encryption and therefore does not describe a missing control.Conclusion Option B correctly identifies the gap: the Eureka program fails to enforce role-based, need-to-know access controls, a core security control required by privacy regulations such as GDPR and standards like ISO/IEC 27001.
GDPR – Article 32: Security of processing – https://eur-lex.europa.eu/eli/reg/2016/679/oj (see Section 2 “Security of processing” and Recital 78 on access controls). ISO/IEC 27001:2022 – Annex A.9 Access control – https://www.iso.org/standard/74755.html (provides guidance on limiting access to information assets to the “need-to-know” basis).These sources substantiate the requirement for need-to-know access and illustrate the control missing from the Eureka program.
What is the main purpose in notifying data subjects of a data breach?
Answer(s): D
JustificationCorrect option (D) – “To allow individuals to take any actions required to protect themselves from possible consequences.”Under most privacy statutes (e.g., GDPR Art. 33, CCPA § 1798.150), the primary aim of breach notification is to empower the data subject with timely, actionable information so they can mitigate potential harms (identity theft, fraud, reputational damage, etc.). Notification creates a concrete mechanism for individuals to assess exposure, monitor accounts, enact personal safeguards, and seek recourse, which aligns directly with the protective purpose mandated by regulators.Why the other options are less appropriateA: “To avoid financial penalties and legal liability.” – While compliance can reduce penalties, this is a secondary benefit, not the purpose of the notification requirement. B. “To enable regulators to understand trends and developments that may shape the law.” – Regulators may collect aggregated breach reports for policy development, but the statutory duty to notify is centered on the affected individuals, not on data collection for regulatory insight. C. “To ensure organizations have accountability for the sufficiency of their security measures.” – Accountability is demonstrated through overall security governance and breach reporting, yet the specific notification act is intended for the data subjects’ direct use, not merely as an organizational audit tool.Conclusion – The central rationale for breach notification is to give individuals the information they need to protect themselves, making option D the most accurate answer.
International Association of Privacy Professionals (IAPP), Data Breach Notification Guide – https://iapp.org/resources/article/data-breach-notification-guide/ IAPP, Privacy Incident Response: A Practical Guide – https://iapp.org/resources/article/privacy-incident-response/
Under the General Data Protection Regulation (GDPR), which situation would be LEAST likely to require a Data Protection Impact Assessment (DPIA)?
Why the correct option (D) is the least likely to require a DPIAA DPIA is mandatory when processing is high-risk – for example, when it involves:Large-scale processing of special-category data (e.g., health or genetic data) – Option A. Systematic monitoring of public spaces or behaviour – Option B. Profiling or surveillance of employees that can affect their rights – Option C.Option D describes an online magazine sending a generic daily digest to a mailing list. The activity:Does not process special-category data. Is not large-scale profiling or systematic monitoring of individuals. Involves only a low-risk, routine marketing communication.Consequently, the processing in Option D falls outside the GDPR scope that triggers a DPIA, making it the least likely scenario requiring one.Why the other options are more likely to require a DPIAA: Health clinic processing genetic and health data – explicit special-category data; processing is intrinsically high-risk → DPIA required. B. Camera system monitoring driving behavior on highways – systematic public-space monitoring; individuals are tracked automatically → DPIA required under the “systematic monitoring” criterion. C. HR tool that monitors employees’ internet activity – employee surveillance and potential profiling; impacts personal freedoms → DPIA advisable to assess necessity and proportionality.
European Parliament & Council, Regulation (EU) 2016/679 (GDPR), Art. 35 – Data protection impact assessment: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 UK Information Commissioner’s Office, Guide to Data Protection Impact Assessments (DPIA): https://ico.org.uk/for-organisations/guide-to-data-protection/dpia/
Under the General Data Protection Regulation (GDPR), which of the following situations would LEAST likely require a controller to notify a data subject?
Why option B is the least likely to trigger a data-subject notification under the GDPRA personal data breach must be communicated to the supervisory authority and , when the breach is likely to result in a risk to the rights and freedoms of natural persons, also to the affected data subjects (Art. 33 & 34 GDPR). The risk assessment is the decisive factor. If the breach is unlikely to cause harm—such as loss of confidentiality, discrimination, financial loss, or damage to reputation—notification to the data subject is not mandatory.Analysis of each optionA – Encrypted USB key with sensitive personal data is stolen *Even though the data are encrypted, the loss of a device that holds sensitive personal data creates a high probability of unauthorized access. The risk to individuals (e.g., identity theft, reputational damage) is typically considered significant, so a controller would usually be required to notify the data subjects.C – Personal data of a group of individuals is erroneously sent to the wrong mailing list *This is a classic example of a “personal data breach” where the data are disclosed to an unintended audience. Unless the controller can demonstrate that the likelihood of resulting harm is negligible, the GDPR obliges notification to the affected persons.D – Hacker publishes usernames, phone numbers and purchase history online after a cyber-attack *The public posting of personal identifiers and purchase details is a clear breach that is likely to cause harm (e.g., targeted phishing, reputation damage). Notification to the data subjects is almost always required.B – Direct marketing email is sent with recipients visible in the ‘cc’ field *While sending an email with visible CC fields may constitute a privacy incident, it generally does not involve loss, destruction, or unauthorized disclosure of personal data in a way that creates a risk to individuals’ rights. The information disclosed (other recipients’ email addresses) is typically low-risk, and the controller can often mitigate the issue without notifying the subjects. Consequently, this scenario is the least likely to require a data-subject notification.Conclusion Based on the GDPR’s risk-based approach, the situation described in B poses the lowest likelihood of triggering a mandatory data-subject notification, whereas the other options involve a higher probability of rights-impact and therefore would more likely require notification.
General Data Protection Regulation (EU) 2016/679 , Articles 33 and 34 – Obligations for notifying supervisory authorities and data subjects of a personal data breach. https://eur-lex.europa.eu/legal-content/EN/TXT/? uri=CELEX%3A32016R2791 UK Information Commissioner’s Office (ICO) , “Guide to the General Data Protection Regulation.” Chapter on personal data breaches and notification requirements. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/
SCENARIO -Please use the following to answer the next question: Penny has recently joined Ace Space, a company that sells homeware accessories online, as its new privacy officer. The company is based in California but thanks to some great publicity from a social media influencer last year, the company has received an influx of sales from the EU and has set up a regional office in Ireland to support this expansion. To become familiar with Ace Space’s practices and assess what her privacy priorities will be, Penny has set up meetings with a number of colleagues to hear about the work that they have been doing and their compliance efforts. Penny’s colleague in Marketing is excited by the new sales and the company’s plans, but is also concerned that Penny may curtail some of the growth opportunities he has planned. He tells her “I heard someone in the breakroom talking about some new privacy laws but I really don’t think it affects us. We’re just a small company. I mean we just sell accessories online, so what’s the real risk?” He has also told her that he works with a number of small companies that help him get projects completed in a hurry. “We’ve got to meet our deadlines otherwise we lose money. I just sign the contracts and get Jim in finance to push through the payment. Reviewing the contracts takes time that we just don’t have.” In her meeting with a member of the IT team, Penny has learned that although Ace Space has taken a number of precautions to protect its website from malicious activity, it has not taken the same level of care of its physical files or internal infrastructure. Penny’s colleague in IT has told her that a former employee lost an encrypted USB key with financial data on it when he left. The company nearly lost access to their customer database last year after they fell victim to a phishing attack. Penny is told by her IT colleague that the IT team “didn’t know what to do or who should do what. We hadn’t been trained on it but we’re a small team though, so it worked out OK in the end.” Penny is concerned that these issues will compromise Ace Space’s privacy and data protection. Penny is aware that the company has solid plans to grow its international sales and will be working closely with the CEO to give the organization a data “shake up”. Her mission is to cultivate a strong privacy culture within the company. Penny has a meeting with Ace Space’s CEO today and has been asked to give her first impressions and an overview of her next steps. To establish the current baseline of Ace Space’s privacy maturity, Penny should consider all of the following factors EXCEPT?
Technical JustificationA: Documented procedures – Core to any privacy-maturity assessment. Formal SOPs, policies, and process maps demonstrate repeatable governance, risk-based controls, and compliance evidence. Without documented procedures, maturity cannot be measured or improved. B. Employee training program – Directly influences privacy culture and competency. Training records, frequency, and relevance are standard maturity indicators (e.g., ISO/IEC 27701, IAPP Privacy Maturity Model). C. Vendor engagement protocols – Critical because third-party processing often introduces the greatest privacy risk. Assessing contracts, due-diligence, and monitoring shows how the organization manages external data flows, a key maturity dimension. D. Content sharing practices on social media – While relevant for brand reputation and marketing compliance, these practices are not a foundational element of privacy-maturity. They do not affect data-handling controls, governance, or risk-mitigation mechanisms that the baseline evaluates. Therefore they are excluded from the core assessment factors.Hence, the factor that should not be considered when establishing the current privacy-maturity baseline is D. Ace Space’s content sharing practices on social media .
ISO/IEC 27701:2019 – Privacy Information Management System (PIMS) requirements and guidance. International Association of Privacy Professionals (IAPP) – “Privacy Maturity Model” (2023).
SCENARIO -Please use the following to answer the next question: Penny has recently joined Ace Space, a company that sells homeware accessories online, as its new privacy officer. The company is based in California but thanks to some great publicity from a social media influencer last year, the company has received an influx of sales from the EU and has set up a regional office in Ireland to support this expansion. To become familiar with Ace Space’s practices and assess what her privacy priorities will be, Penny has set up meetings with a number of colleagues to hear about the work that they have been doing and their compliance efforts. Penny’s colleague in Marketing is excited by the new sales and the company’s plans, but is also concerned that Penny may curtail some of the growth opportunities he has planned. He tells her “I heard someone in the breakroom talking about some new privacy laws but I really don’t think it affects us. We’re just a small company. I mean we just sell accessories online, so what’s the real risk?” He has also told her that he works with a number of small companies that help him get projects completed in a hurry. “We’ve got to meet our deadlines otherwise we lose money. I just sign the contracts and get Jim in finance to push through the payment. Reviewing the contracts takes time that we just don’t have.” In her meeting with a member of the IT team, Penny has learned that although Ace Space has taken a number of precautions to protect its website from malicious activity, it has not taken the same level of care of its physical files or internal infrastructure. Penny’s colleague in IT has told her that a former employee lost an encrypted USB key with financial data on it when he left. The company nearly lost access to their customer database last year after they fell victim to a phishing attack. Penny is told by her IT colleague that the IT team “didn’t know what to do or who should do what. We hadn’t been trained on it but we’re a small team though, so it worked out OK in the end.” Penny is concerned that these issues will compromise Ace Space’s privacy and data protection. Penny is aware that the company has solid plans to grow its international sales and will be working closely with the CEO to give the organization a data “shake up”. Her mission is to cultivate a strong privacy culture within the company. Penny has a meeting with Ace Space’s CEO today and has been asked to give her first impressions and an overview of her next steps. What is the best way for Penny to understand the location, classification and processing purpose of the personal data Ace Space has?
Answer(s): A
Justification for selecting Option AThe primary goal is to determine where personal data is stored (location), what categories of data exist (classification), and why each data set is processed (purpose). A data inventory is the foundational artefact that catalogues every data element, its source, storage location, and business context. By mapping the data flows that move this inventory through systems, processes, and third-party services, Penny can visualise the end-to-end journey of personal information. This mapping directly feeds into privacy risk assessments , informs subsequent PIAs, and satisfiesGDPR-style accountability requirements that mandate knowledge of data flows and purposes. Options B, C and D address valuable but secondary steps:B – Vendor audit – useful for evaluating third-party safeguards but does not provide the internal classification or purpose details that must be established first. C – Privacy Impact Assessment – is typically performed after the baseline data map is in place; it evaluates risks of specific projects rather than establishing the overall data landscape. D – Cloud-contract review – isolates server location only; it ignores the broader classification of data types and the governance purpose behind their collection and use.Thus, Option A delivers the comprehensive, initial insight required to understand location, classification, and processing purpose, making it the most appropriate first action for Penny’s privacy mandate.
1. International Association of Privacy Professionals (IAPP) – Data Mapping Toolkit:https://iapp.org/resources/tools/data-mapping-toolkit/ 2. European Commission – Guide on Personal Data Breach Notification and Data Mapping (PDF):https://ec.europa.eu/info/law/law-topic/data-protection_en.pdf
Post your Comments and Discuss IAPP CIPM exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPM content, but please register or login to continue.