support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. IAPP
  4. CIPP-E

Free CIPP-E Exam Braindumps
Certified Information Privacy Professional/Europe (CIPP/E) Questions 31–35 (page: 8)

Updated On: 12-Sep-2026
Page 8 of 65
PDF with 319 Questions

Article 5(1)(b) of the GDPR states that personal data must be “collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.” Based on Article 5(1)(b), what is the impact of a member state’s interpretation of the word “incompatible”?

  1. It dictates the level of security a processor must follow when using and storing personal data for two different purposes.
  2. It guides the courts on the severity of the consequences for those who are convicted of the intentional misuse of personal data.
  3. It sets the standard for the level of detail a controller must record when documenting the purpose for collecting personal data.
  4. It indicates the degree of flexibility a controller has in using personal data in ways that may vary from its original intended purpose.

Answer(s): D


Reference:

https://gdpr-info.eu/art-5-gdpr/



Tanya is the Data Protection Officer for Curtains Inc., a GDPR data controller. She has recommended that the company encrypt all personal data at rest.
Which GDPR principle is she following?

  1. Accuracy
  2. Storage Limitation
  3. Integrity and confidentiality
  4. Lawfulness, fairness and transparency

Answer(s): C


Reference:

https://www.icaew.com/technical/technology/data/data-protection/data-protection-articles/do-i-have-to-encrypt-personal-data-to-comply-with-dpa-2018



A well-known video production company, based in Spain but specializing in documentaries filmed worldwide, has just finished recording several hours of footage featuring senior citizens in the streets of Madrid. Under what condition would the company NOT be required to obtain the consent of everyone whose image they use for their documentary?

  1. If obtaining consent is deemed to involve disproportionate effort.
  2. If obtaining consent is deemed voluntary by local legislation.
  3. If the company limits the footage to data subjects solely of legal age.
  4. If the company’s status as a documentary provider allows it to claim legitimate interest.

Answer(s): D


Reference:

https://gdpr-info.eu/art-6-gdpr/



A Spanish electricity customer calls her local supplier with questions about the company’s upcoming merger. Specifically, the customer wants to know the recipients to whom her personal data will be disclosed once the merger is final. According to Article 13 of the GDPR, what must the company do before providing the customer with the requested information?

  1. Verify that the request is applicable to the data collected before the GDPR entered into force.
  2. Verify that the purpose of the request from the customer is in line with the GDPR.
  3. Verify that the personal data has not already been sent to the customer.
  4. Verify that the identity of the customer can be proven by other means.

Answer(s): D



Under the GDPR, where personal data is not obtained directly from the data subject, a controller is exempt from directly providing information about processing to the data subject if?

  1. The data subject already has information regarding how his data will be used
  2. The provision of such information to the data subject would be too problematic
  3. Third-party data would be disclosed by providing such information to the data subject
  4. The processing of the data subject’s data is protected by appropriate technical measures

Answer(s): A



  PDF
Viewing page 8 of 65
Viewing questions 36 - 40 out of 319 questions


Post your Comments and Discuss IAPP CIPP-E exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!