SCENARIO -Please use the following to answer the next question: Penny has recently joined Ace Space, a company that sells homeware accessories online, as its new privacy officer. The company is based in California but thanks to some great publicity from a social media influencer last year, the company has received an influx of sales from the EU and has set up a regional office in Ireland to support this expansion. To become familiar with Ace Space’s practices and assess what her privacy priorities will be, Penny has set up meetings with a number of colleagues to hear about the work that they have been doing and their compliance efforts. Penny’s colleague in Marketing is excited by the new sales and the company’s plans, but is also concerned that Penny may curtail some of the growth opportunities he has planned. He tells her “I heard someone in the breakroom talking about some new privacy laws but I really don’t think it affects us. We’re just a small company. I mean we just sell accessories online, so what’s the real risk?” He has also told her that he works with a number of small companies that help him get projects completed in a hurry. “We’ve got to meet our deadlines otherwise we lose money. I just sign the contracts and get Jim in finance to push through the payment. Reviewing the contracts takes time that we just don’t have.” In her meeting with a member of the IT team, Penny has learned that although Ace Space has taken a number of precautions to protect its website from malicious activity, it has not taken the same level of care of its physical files or internal infrastructure. Penny’s colleague in IT has told her that a former employee lost an encrypted USB key with financial data on it when he left. The company nearly lost access to their customer database last year after they fell victim to a phishing attack. Penny is told by her IT colleague that the IT team “didn’t know what to do or who should do what. We hadn’t been trained on it but we’re a small team though, so it worked out OK in the end.” Penny is concerned that these issues will compromise Ace Space’s privacy and data protection. Penny is aware that the company has solid plans to grow its international sales and will be working closely with the CEO to give the organization a data “shake up”. Her mission is to cultivate a strong privacy culture within the company. Penny has a meeting with Ace Space’s CEO today and has been asked to give her first impressions and an overview of her next steps. What information will be LEAST crucial from a privacy perspective in Penny’s review of vendor contracts?
Answer(s): C
Why “Pricing for data security protections” (Option C) is the least crucial from a privacy perspectiveAudit rights (Option A) – Directly enable the privacy officer to verify that the vendor is meeting contractual privacy and security obligations, which is essential for demonstrating compliance with GDPR-style accountability and for detecting breaches early. Liability for a data breach (Option B) – Determines who bears responsibility and financial exposure when personal data is compromised, shaping how the vendor implements protective measures and influences the organization’s overall risk posture. The data a vendor will have access to (Option D) – Defines the scope of personal data processed on the vendor’s behalf, enforcing the principle of data minimisation and ensuring that only necessary data is shared, which is a core privacy consideration. Pricing for data security protections (Option C) – While cost is important for business decisions, it does not affect the legal or technical privacy obligations themselves. The price paid does not guarantee equivalent security controls; therefore, it is the least relevant factor from a privacy-risk standpoint.
IAPP, Data Processing Agreements (DPAs) – Key Considerations – https://iapp.org/resources/article/data-processing-agreements-key-considerations/ European Data Protection Board, Guidance on Vendor Management and Processing Agreements – https://edpb.europa.eu/guides/best-practices/vendor-management_enThese resources outline the privacy-focused clauses (audit rights, breach liability, data scope) that Penny should prioritize when reviewing contracts, confirming that pricing is secondary to substantive privacy safeguards.
Which of the documents below assists the Privacy Manager in identifying and responding to a request from an individual about what personal information the organization holds about them with whom the information is shared?
Answer(s): D
Correct answer: D – Personal Information InventoryA Personal Information Inventory (PII) is a systematic record that details the types of personal data held, the categories of data subjects, collection purposes, storage locations, retention periods, and third-party disclosures. This enables the Privacy Manager to quickly locate, verify, and respond to an individual's access request, confirming exactly what information is held and with whom it is shared.The Privacy policy outlines overall privacy principles and obligations but does not provide the granular, searchable records needed to answer a specific request. A Records retention schedule only governs how long records are kept; it does not enumerate the content of the records themselves or the sharing relationships. A Risk register focuses on identifying and mitigating privacy risks, not on documenting data holdings or disclosure details for request handling.Why D is best: It directly satisfies the need to locate and disclose personal information on request, making it the essential operational document for the Privacy Manager. The other options support privacy governance or compliance but lack the detailed inventory required for an access request response.
IAPP – Personal Information Inventory Toolkit: https://iapp.org/resources/toolkit/personal-information-inventory/ NIST – Special Publication 800-53 Rev. 5 – Privacy Controls for Federal Information Systems (see “Inventory of Information Resources” control): https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/finalNote: These links are publicly accessible and illustrate the concepts discussed above.
Which of the following is the optimum first step to take when creating a Privacy Officer governance model?
Answer(s): A
Why option A is the optimal first stepStrategic authority: Creating a Privacy Officer governance model requires formal sponsorship and resources; senior leadership endorsement provides the necessary authority, budgetary support, and organizational visibility. Accountability framework: With leadership backing, the Privacy Officer can establish clear accountability lines, define decision-making processes, and embed privacy into enterprise-wide policies. Catalyst for cross-functional collaboration: Leadership involvement signals that privacy is a priority, encouraging other departments (IT, security, legal) to engage proactively rather than reactively.Why the other options are less suitable as the initial stepB – Flexibility for the General Counsel Office: While legal counsel is essential, the GC’s involvement is typically downstream; the governance model must first be defined before allocating flexibility to any single office. C – Internal partnerships with IT and information security: These partnerships are critical for implementation, but they presuppose an already-established governance structure that can define requirements and expectations. D – Leveraging communications and public affairs teams: Public-facing communication is valuable for reputation management, yet it does not provide the foundational governance framework needed to direct privacy initiatives.Therefore, engaging senior leadership first establishes the governance backbone, enabling all subsequent actions to be aligned, resourced, and effectively executed.
International Association of Privacy Professionals (IAPP) – Privacy Officer Competence Framework: https://iapp.org/resources/privacy-officer-competence-framework/ IAPP – Building a Privacy Governance Program: https://iapp.org/resources/building-a-privacy-governance-program/
SCENARIO -Please use the following to answer the next question: Today is your first day at a fast growing international real estate firm headquartered in New York, with offices in Canada and Germany. You are the firm's first ever privacy officer. While touring the office to meet your new colleagues and learn the layout of the office, you notice piles of printing jobs left on the printer in the copy room. You also note a recycle bin and garbage can near the printers. With a quick glance, you see a completed loan application form print out with applicant name, social security number and home address lying in the recycle bin. You make a note to follow up immediately. You are then introduced to the head of IT who gives you a warm welcome and explains his star project this year -enterprise CRM (Customer Relationship Management) mobility. He is very proud that he is leading this innovation that allows firm-wide employees to access the existing CRM database remotely from anywhere on the Internet. The business value of this mobility initiative is significant. Since he doesn't have internal web development expertise, he outsourced the development work to a small IT firm in New York that has just successfully delivered another IT initiative for the company. After the tour you start working on a plan based on your observations. One immediate action is to schedule a meeting with the head of IT to discuss the CRM mobility project. All of the following should be mandatory in the contract for the outsourced vendor EXCEPT?
Technical JustificationInformation security controls (B) – The vendor will process personal data (e.g., client loan details, SSNs) in the CRM system. Any contractual arrangement must mandate that the vendor implements industry-standard technical and organizational safeguards (encryption, access controls, audit logging) to protect that data in transit and at rest, in line with privacy statutes such as GDPR, CCPA, and NY SHIELD Act.Liability for data breach (C) – Because the vendor will have administrative access to the CRM database, the contract must allocate responsibility for any breach involving personal data. This includes required notification timelines, remediation duties, and indemnification provisions that align with the firm’s privacy-policy obligations and potential regulatory penalties.Cyber insurance (D) – Requiring the vendor to maintain appropriate cyber-liability coverage ensures that both the firm and the vendor have financial resources to cover breach-related costs (e.g., forensic investigation,legal fees, third-party claims). This is a common procurement requirement for any service provider handling sensitive data.Generation of reports and metrics (A) – While useful for ongoing monitoring and continuous improvement, reporting on the vendor’s performance is an operational convenience and not a legal or regulatory necessity for protecting personal data. Therefore, it is not mandatory to include as a contractual obligation.Conclusion – The only element that should NOT be mandatory in the vendor contract is the generation of reports and metrics. All other items directly address privacy and data-security obligations.
International Association of Privacy Professionals (IAPP) – “Contracts for Processing Personal Data.” https://iapp.org/resources/article/contracts-for-processing-personal-data/ NIST Special Publication 800-53 Revision 5 – “Security and Privacy Controls for Information Systems and Organizations.” https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/finalThese links provide detailed guidance on the contractual requirements for data-privacy and security controls relevant to outsourced processing activities.
Which of the following is NOT an important factor to consider when developing a data retention policy?
Why option C (Organizational culture) is the correct answerData-retention policies are primarily driven by legal and regulatory obligations (compliance), business needs (what data is required for operations, analytics, contracts), and the technical environment (storage capacity, encryption, access controls). While culture can influence how policies are adopted, it does not directly determine the technical and legal constraints that shape the retention schedule; therefore it is not considered a core factor in the policy-development process.Why the other options are important considerationsA: Technology resource – Determines the feasible retention periods (e.g., storage limits, backup rotation, encryption) and dictates how long data can be safely and cost-effectively kept. B. Business requirement – Defines the operational need for retaining data (e.g., contract length, analytics, customer support) and sets the minimum retention horizon required for business continuity. D. Compliance requirement – Establishes mandatory retention periods imposed by statutes, regulations, or industry standards (e.g., GDPR, HIPAA, SOX), which must be adhered to and cannot be overridden by other considerations.Conclusion Because data-retention policy design is fundamentally anchored in compliance, business necessity, and technological capability, organizational culture —while valuable for implementation and awareness—is not a primary, technical factor to evaluate when formulating the policy itself.
IAPP, Data Retention and Disposal: A Practical Guide – https://iapp.org/resources/data-retention-and-disposal-a-practical-guide/ European Parliament & Council, Regulation (EU) 2016/679 (GDPR) – Article 5(1)(e) – https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679
When supporting the business and data privacy program expanding into a new jurisdiction, it is important to do all of the following EXCEPT?
Answer(s): B
Why option B is the “EXCEPT” (i.e., why it is NOT a required step)Stakeholder identification (Option A) is a prerequisite for any privacy expansion – it ensures the program engages the right internal and external parties. Legal assessment (Option C) is mandatory because every new jurisdiction brings its own statutory obligations (e.g., GDPR-like rules, sector-specific mandates). Cultural consideration (Option D) matters for tailoring policies, training, and enforcement mechanisms so they resonate with local practices and expectations. Appointing a new Privacy Officer (Option B) is not universally required. A jurisdiction may already have a designated officer, the existing global PO may have delegated authority, or the business may rely on a shared-services model. The IAPP standards and model policies only recommend appointing a PO when the current structure cannot provide sufficient local oversight; they do not mandate a new appointment for every market entry. Consequently, this action is not an obligatory step, making it the correct “EXCEPT” answer.Holistic reasoning Supporting a privacy program’s expansion involves systematic analysis of who is impacted (stakeholders), what legal regimes apply, and how cultural nuances shape policy adoption. The decision to create a new Privacy Officer role is driven by governance design rather than a blanket procedural rule, so it is the only option that is not universally compulsory.
IAPP Model Policy & Procedure – Data Privacy Program (Section 3: Governance & Roles) – https://iapp.org/resources/model-policy-data-privacy/ IAPP “Privacy Program Expansion Checklist” – https://iapp.org/resources/privacy-program-expansion-checklist/
When building a data privacy program, what is a good starting point to understand the scope of privacy program needs?
JustificationStart with a data inventory – a complete, accurate record of what personal data is collected, processed, stored, and transferred defines the boundaries of the privacy program. Without knowing the data landscape, any subsequent risk assessment, DPIA, audit, or governance activity would be speculative and incomplete. Risk assessments and DPIAs rely on a clear inventory to identify lawful bases, lawful purposes, and data flows; therefore they cannot serve as the initial step. Audits are review activities that evaluate compliance after controls are in place; they do not establish the scope needed to design those controls. Consequently, a data inventory is the prerequisite foundation on which all other privacy activities are built, making it the logical starting point.Why the other options are less suitableA: Perform Data Protection Impact Assessments (DPIAs) – DPIAs require prior knowledge of processing activities; without an inventory, the scope cannot be defined, rendering a DPIA premature. B. Perform Risk Assessments – Risk assessments evaluate threats to confidentiality, integrity, and availability, but they need a defined data set to assess; an inventory must precede risk identification. D. Review Audits – Audits verify existing controls and compliance; they do not uncover what data assets exist, so they cannot determine program scope.
IAPP, Data Privacy Fundamentals: Building a Privacy Program, https://iapp.org/resources/great-content/data-privacy-fundamentals-building-a-privacy-program/ IAPP, Privacy Program Handbook, https://iapp.org/resources/great-content/privacy-program-handbook/
Which of the following actions is NOT required during a data privacy diligence process for Merger & Acquisition (M&A) deals?
Why option B is the correct answer (i.e., it is not a required activity during the privacy-diligence phase of an M&A transaction)Retention of data-subject-request (DSR) handling is a post-transaction operational activity. During the diligence stage the focus is on identifying and assessing privacy risks associated with the target’s data assets and the contemplated integration. Updating business processes to enable DSR fulfillment occurs later, after the transaction closes and the combined entity has defined its operating model. Consequently, it is not a prerequisite for the privacy-due-diligence workstream.The other three actions are integral to diligence.1. Revise application inventory and conduct data mapping – establishes a clear picture of what personal data the target processes and where it resides, which is the foundation for risk assessment. 2. Compare pre- and post-merger data use – reveals whether the merged entity will introduce new purposes or legal bases that could trigger additional regulatory obligations. 3. Perform a privacy readiness assessment before closing – evaluates controls, governance, and compliance gaps, allowing the parties to negotiate appropriate remediation measures or safeguards.Regulatory expectations support this distinction. Privacy statutes (e.g., GDPR, CCPA) require that the controller processing personal data be able to demonstrate compliance, but they do not obligate the buyer to redesign DSR procedures prior to acquisition. The buyer’s immediate obligations are limited to confirming that the target’s existing DSR mechanisms are adequate and that any gaps will be addressed during integration — a later implementation step rather than a diligence deliverable.In summary, while data-subject-request handling will ultimately need to be operationalized after the merger, updating the target’s DSR processes is not a required component of the privacy-diligence phase itself; thus option B is the answer that is not mandated during that stage.
International Association of Privacy Professionals (IAPP), “M&A Privacy Checklist” – outlines the core diligence activities (inventory, mapping, use-change analysis, readiness assessment) but does not list DSR process redesign as a diligence deliverable. https://iapp.org/resources/article/m-a-privacy-checklist/ EU Commission, “Guidance on Data Protection in Mergers and Acquisitions” (2023) – emphasizes assessment of existing data processing activities and post-transaction integration planning, distinguishing between due-diligence tasks and post-closing operational updates. https://ec.europa.eu/justice/data-protection/business-and-industry/m-a-guidance_en.htm
Post your Comments and Discuss IAPP CIPM exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPM content, but please register or login to continue.