Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. IAPP
  5. CIPM

IAPP CIPM Exam Questions
Certified Information Privacy Manager (Page 3 )

Updated On: 24-Feb-2026
Page 3 of 65
PDF with 326 Questions

SCENARIO
Please use the following to answer the next question:

Order(ly) is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. A family creates a single account and the primary user has access to all information about the other users. In order to be able to use the application, the primary user must check a box consenting to receive marketing emails from the developer and selected marketing partners.

After having had a successful launch in the United States, Order(ly) is about to be made available for purchase worldwide. The privacy officer for the potential European distributor of Order(ly) collects and stores the sensitive medical information of its users for the medical appointment scheduler. In fact, all of the user's information is stored by Order(ly) for the purpose of creating additional products and analyzing usage of the products. This data is stored in the cloud and is encrypted both during transmission and at rest.

Consistent with the CEO's philosophy that great new product ideas can come from anyone, all employees have access to user data with the additional hopes that at some point in the future the data will reveal insights that could be used to create a fully automated application that runs on artificial intelligence. At this time, however, this latter initiative is not well-defined and is considered a long-term goal.

What administrative safeguards should be implemented to protect the collected data while in use by the product management team?

  1. Document the data flows for the collected data.
  2. Conduct a Privacy Impact Assessment (PIA) to evaluate the risks involved.
  3. Implement a policy restricting data access on a "need to know" basis.
  4. Limit data transfers to the US by keeping data collected in Europe within a local data center.

Answer(s): C



SCENARIO
Please use the following to answer the next question:

Order(ly) is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. A family creates a single account and the primary user has access to all information about the other users. In order to be able to use the application, the primary user must check a box consenting to receive marketing emails from the developer and selected marketing partners.

After having had a successful launch in the United States, Order(ly) is about to be made available for purchase worldwide. The privacy officer for the potential European distributor of Order(ly) collects and stores the sensitive medical information of its users for the medical appointment scheduler. In fact, all of the user's information is stored by Order(ly) for the purpose of creating additional products and analyzing usage of the products. This data is stored in the cloud and is encrypted both during transmission and at rest.

Consistent with the CEO's philosophy that great new product ideas can come from anyone, all employees have access to user data with the additional hopes that at some point in the future the data will reveal insights that could be used to create a fully automated application that runs on artificial intelligence. At this time, however, this latter initiative is not well-defined and is considered a long-term goal.

What element of the Privacy by Design (PbD) framework might Order(ly) violate?

  1. Failure to obtain opt-in consent to marketing.
  2. Failure to observe data localization requirements.
  3. Failure to implement the least privilege access standard.
  4. Failure to integrate privacy throughout the system development life cycle.

Answer(s): D



SCENARIO
Please use the following to answer the next question:

Julia is a product manager at Avatar, where she is responsible for leading the development of the company's flagship product, Order(ly). Order(ly) is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After having had a successful launch in the

United States, Order(ly) is about to be made available for purchase worldwide.

The packaging and user guide for Order(ly) indicate that it is a "privacy friendly" product suitable for the whole family, including children, but does not provide any further detail or privacy notice. In order to use the application, a family creates a single account, and the primary user has access to all information about the other users. Upon start up, the primary user must check a box consenting to receive marketing emails from Avatar and selected marketing partners in order to be able to use the application.

Jacob, the head of privacy at Avatar, was working on an agreement with a European distributor of Order(ly) when he fielded many questions about the product from the distributor. Jacob needed to look more closely at the product in order to be able to answer the questions as he was not involved in the product development process.

In speaking with the product team, he learned that Order(ly) collected and stored all of a user's sensitive medical information for the medical appointment scheduler. In fact, all of the user's information is stored by Order(ly) for the additional purpose of creating additional products and to analyze usage of the product. This data is all stored in the cloud and is encrypted both during transmission and at rest.

Consistent with the CEO's philosophy that great new product ideas can come from anyone, all Avatar employees have access to user data under a program called BGIdeas. Avatar is hoping that at some point in the future, the data will reveal insights that could be used to create a fully automated application that runs on artificial intelligence, but as of yet, BGIdeas is not well-defined and is considered a long-term goal.

What can Jacob do to minimize the risks of offering the product in Europe?

  1. Jacob should advise the distributor that Order(ly) has certified to the Privacy Shield Framework and there should be no issues.
  2. Jacob should work with Julia to review and remediate Order(ly) as a gating item before it is released.
  3. Jacob should document the data life cycle of the data collected by Order(ly).
  4. Jacob should write a privacy policy to include with Order(ly)user guide.

Answer(s): B



All of the following are accurate regarding the use of technical security controls EXCEPT?

  1. Technical security controls are part of a data governance strategy.
  2. Technical security controls deployed for one jurisdiction often satisfy another jurisdiction.
  3. Most privacy legislation lists the types of technical security controls that must be implemented.
  4. A person with security knowledge should be involved with the deployment of technical security controls.

Answer(s): C



An organization's privacy officer was just notified by the benefits manager that she accidentally sent out the retirement enrollment report of all employees to a wrong vendor.

Which of the following actions should the privacy officer take first?

  1. Perform a risk of harm analysis.
  2. Report the incident to law enforcement.
  3. Contact the recipient to delete the email.
  4. Send firm-wide email notification to employees.

Answer(s): C






Post your Comments and Discuss IAPP CIPM exam dumps with other Community members:

Join the CIPM Discussion