CIPP/E
Preparation
Practice Questions
1. Which Article of the Universal Declaration of Human Rights (1948) represents the right to
private life?
(a) Article 12
(b) Article 19
(c) Article 29(2)
(d) Article 24
2. Under which legislative procedure must both the European Parliament and the Council of the
European Union assent before a piece of EU legislation can be passed?
(a) Consultation Procedure
(b) Consent Procedure
(c) Ordinary Procedure
(d) General legislation Procedure
3. What type of processing does Convention 108 apply to?
(a) Automatic and manual processing of personal data
(b) Automatic processing of personal data
(c) Manual processing of personal data
(d) Any processing of personal data
4. Which of the following is NOT a category of sensitive personal data as de ned by Article 9(1) of
the GDPR ?
(a) Racial or ethnic origin
(b) Political opinions
(c) Religious or philosophical beliefs
(d) National insurance number
5. Which of the following is an activity to which the GDPR would not apply to?
(a) Keeping a data base with people’s e-mail addresses, because e-mail addresses are not
personal data
(b) Keeping an address book for personal use, because this would fall into the household
exemption
(c) A school processing personal data, because this falls into matters outside the scope of EU
law
(d) Automatic processing of personal data, because only manual processing of personal data is
covered by the GDPR
6. Which of the following need is NOT a requirement under Article 14(3) of the GDPR in the
context of when fair processing information must be provided to data subjects whose personal
data were obtained from a third party?
(a) Fair processing information must be provided within a reasonable period after obtaining the
personal data, but at least within 1 month of receiving the personal data
(b) If personal data is used for communication with the data subject, fair processing information
must be provided at the latest at the time of the rst communication to that data subject
(c) If a disclosure to another recipient is envisaged, fair processing information must be provided
at the latest when the personal data is rst disclosed
(d) Fair processing information must be provided without undue delay and in an event within 72
hours of receiving the personal data
© Inhousew Limited Page 1 of 3
fi
fi
fi
7. In which circumstance do data subjects have the right to restrict processing of their personal
data under Article 18?
(a) Where the data subject contests the accuracy of the personal data
(b) Where the data subject has moved outside of the EEA
(c) Where the data subject has sent a request to the relevant supervisory authority
(d) Where the data subject is a government employee
8. What is a legal requirement if a controller instructs a processor to process personal data?
(a) A contract re ecting the requirements as set out in Article 28 GDPR must be entered into
between the controller and the processor
(b) The processor must complete a questionnaire which meets the requirements of Article 32 of
the GPDR
(c) The processor must be audited by the relevant supervisory authority before it can be
instructed
(d) The processor must have agreed to enter into binding corporate rules
9. Which EU institution makes adequacy decisions which recognise that another country provides
an equivalent level of protection for personal data as the EU does?
(a) European Parliament
(b) Council of the European Union
(c) European Council
(d) European Commission
10. Which of the following is a type ne that the GDPR stipulates may be imposed by a
supervisory authority?
(a) Up to the greater of €10m or 2% of annual turnover in the nancial year
(b) Up to the greater of €15m or 3% of annual turnover in the nancial year
(c) Up to the greater of €22m or 5% of annual turnover in the nancial year
(d) Up to the greater of €25m or 6% of annual turnover in the nancial year
© Inhousew Limited Page 2 of 3
fl
fi
fi
fi
fi
fi
CIPP/E
Preparation
Answers
Question Number Answer
1 A
2 C
3 B
4 D
5 B
6 D
7 A
8 A
9 D
10 A
© Inhousew Limited Page 3 of 3
