CIPP/E EXAM QUESTIONS AND DETAILED ANSWERS
NEWEST 2026/2027
What is the importance of the Treaty of Rome (1957) on the Data Protection Directive and the
GDPR? - ANSWER---Allowed the Data Protection Directive and GDPR to be setup as
harmonization for European member states.
How many member states in the European Union? - ANSWER---28 member statesAllowed the
Data Protection Directive and GDPR to be setup as harmonization for European member states
28 member states
What is the European Economic Area composed of? - ANSWER---EU member states + Iceland +
Liechtenstien + Norway
What are the key characteristics of the Data Protection Directive? - ANSWER---- Places
obligations on member states
- Is transposed into 28 national laws in the EU
- Differs across member states
- Formed the Article 29 Working Party
In what ways is the GDPR different from the Data Protection Directive? - ANSWER---The GDPR:
- is directly applicable and enforceable as law
- provides one set of data protection rules for all
- allows member states a degree of tailoring
, CIPP/E EXAM QUESTIONS AND DETAILED ANSWERS
NEWEST 2026/2027
- forms the European Data Protection Board (EDPB)
What are the special categories of personal data? - ANSWER---- racial origin
- ethic origin
- political opinions
- religious beliefs
- philosophical beliefs
- trade-union membership
- genetic data
- biometric data
- health data
- sex life
- sexual orientation
(- criminal convictions and offences can only be processed by authorities with safeguards)
, CIPP/E EXAM QUESTIONS AND DETAILED ANSWERS
NEWEST 2026/2027
What is a supervisory authority? - ANSWER---A Data Protection Authority (DPA) - an entity
appointed to enforce privacy or data protection laws and regulation in a particular jurisdiction.
What is the definition of data processing? - ANSWER---Any operation or set of operations which
is performed on personal data or on sets of personal data, whether or not by automated
means.
What are the GDPR data processing principles? - ANSWER---- Lawfulness, fairness, and
transparency of processing
- Purpose limitation
- Data minimization and proportionality
- Data quality and accuracy
- Storage limitation
- Integrity and confidentiality
- Accountability
What are the two types of scope needed for the GDPR to apply? - ANSWER---- territorial scope
- material scope
, CIPP/E EXAM QUESTIONS AND DETAILED ANSWERS
NEWEST 2026/2027
When is territorial scope satisfied? - ANSWER---GDPR applies if a controller or processor:
(1) is established in the EU,
(2) offers goods or services to EU residents,
(3) monitors behavior of EU residents,
(4) is outside the EU, but EU member state law applies
Companies without presence in the EU need to comply!
What is outside the material scope of the GDPR? - ANSWER---- Activities outside the scope of
EU law
- Investigating and detecting crimes
- Law enforcement, national security, and defense
- Purely personal or household activities
What are the lawful bases for processing data? - ANSWER---- Consent
- Contract
- Legal obligation
NEWEST 2026/2027
What is the importance of the Treaty of Rome (1957) on the Data Protection Directive and the
GDPR? - ANSWER---Allowed the Data Protection Directive and GDPR to be setup as
harmonization for European member states.
How many member states in the European Union? - ANSWER---28 member statesAllowed the
Data Protection Directive and GDPR to be setup as harmonization for European member states
28 member states
What is the European Economic Area composed of? - ANSWER---EU member states + Iceland +
Liechtenstien + Norway
What are the key characteristics of the Data Protection Directive? - ANSWER---- Places
obligations on member states
- Is transposed into 28 national laws in the EU
- Differs across member states
- Formed the Article 29 Working Party
In what ways is the GDPR different from the Data Protection Directive? - ANSWER---The GDPR:
- is directly applicable and enforceable as law
- provides one set of data protection rules for all
- allows member states a degree of tailoring
, CIPP/E EXAM QUESTIONS AND DETAILED ANSWERS
NEWEST 2026/2027
- forms the European Data Protection Board (EDPB)
What are the special categories of personal data? - ANSWER---- racial origin
- ethic origin
- political opinions
- religious beliefs
- philosophical beliefs
- trade-union membership
- genetic data
- biometric data
- health data
- sex life
- sexual orientation
(- criminal convictions and offences can only be processed by authorities with safeguards)
, CIPP/E EXAM QUESTIONS AND DETAILED ANSWERS
NEWEST 2026/2027
What is a supervisory authority? - ANSWER---A Data Protection Authority (DPA) - an entity
appointed to enforce privacy or data protection laws and regulation in a particular jurisdiction.
What is the definition of data processing? - ANSWER---Any operation or set of operations which
is performed on personal data or on sets of personal data, whether or not by automated
means.
What are the GDPR data processing principles? - ANSWER---- Lawfulness, fairness, and
transparency of processing
- Purpose limitation
- Data minimization and proportionality
- Data quality and accuracy
- Storage limitation
- Integrity and confidentiality
- Accountability
What are the two types of scope needed for the GDPR to apply? - ANSWER---- territorial scope
- material scope
, CIPP/E EXAM QUESTIONS AND DETAILED ANSWERS
NEWEST 2026/2027
When is territorial scope satisfied? - ANSWER---GDPR applies if a controller or processor:
(1) is established in the EU,
(2) offers goods or services to EU residents,
(3) monitors behavior of EU residents,
(4) is outside the EU, but EU member state law applies
Companies without presence in the EU need to comply!
What is outside the material scope of the GDPR? - ANSWER---- Activities outside the scope of
EU law
- Investigating and detecting crimes
- Law enforcement, national security, and defense
- Purely personal or household activities
What are the lawful bases for processing data? - ANSWER---- Consent
- Contract
- Legal obligation
