CIPP-C Exam Questions and Answers | Exam-Dumps (Page: 5)

QUESTION: 21

SCENARIO
Please use the following to answer the next question:

A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer’s data handling practices.

The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: “Please act immediately by identifying all personal data received from our company.”

This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup’s rapid market penetration.

As the Company’s data privacy leader, you are sensitive to the criticality of the relationship with the retailer.

Under the General Data Protection Regulation (GDPR), how would the U.S.-based startup company most likely be classified?

As a data supervisor
As a data processor
As a data controller
As a data manager

Answer(s): A

Reference:

https://www.i-scoop.eu/gdpr/data-processor-gdpr/

Reveal Solution Next Question

QUESTION: 22

SCENARIO
Please use the following to answer the next question:

A US-based startup company is selling a new gaming application. One day, the CEO of the company receives an urgent letter from a prominent EU-based retail partner. Triggered by an unresolved complaint lodged by an EU resident, the letter describes an ongoing investigation by a supervisory authority into the retailer’s data handling practices.

The complainant accuses the retailer of improperly disclosing her personal data, without consent, to parties in the United States. Further, the complainant accuses the EU-based retailer of failing to respond to her withdrawal of consent and request for erasure of her personal data. Your organization, the US-based startup company, was never informed of this request for erasure by the EU-based retail partner. The supervisory authority investigating the complaint has threatened the suspension of data flows if the parties involved do not cooperate with the investigation. The letter closes with an urgent request: “Please act immediately by identifying all personal data received from our company.”

This is an important partnership. Company executives know that its biggest fans come from Western Europe; and this retailer is primarily responsible for the startup’s rapid market penetration.

As the Company’s data privacy leader, you are sensitive to the criticality of the relationship with the retailer.

Under the GDPR, the complainant’s request regarding her personal information is known as what?

Right of Access
Right of Removal
Right of Rectification
Right to Be Forgotten

Answer(s): B

Reveal Solution Next Question

QUESTION: 23

In which situation would a policy of “no consumer choice” or “no option” be expected?

When a job applicant’s credit report is provided to an employer
When a customer’s financial information is requested by the government
When a patient’s health record is made available to a pharmaceutical company
When a customer’s street address is shared with a shipping company

Answer(s): D

Reference:

https://privacyproficient.com/what-is-no-option-or-no-consumer-choice/

Reveal Solution Next Question

QUESTION: 24

What is the main challenge financial institutions face when managing user preferences?

Ensuring they are in compliance with numerous complex state and federal privacy laws
Developing a mechanism for opting out that is easy for their consumers to navigate
Ensuring that preferences are applied consistently across channels and platforms
Determining the legal requirements for sharing preferences with their affiliates

Answer(s): C

Reveal Solution Next Question

QUESTION: 25

A large online bookseller decides to contract with a vendor to manage Personal Information (PI).
What is the least important factor for the company to consider when selecting the vendor?

The vendor’s reputation
The vendor’s financial health
The vendor’s employee retention rates
The vendor’s employee training program

Answer(s): B

Reveal Solution Next Question

IAPP CIPP-C Exam (page: 5) IAPP Certified Information Privacy Professional/ Canada (CIPP/C) Updated on: 15-Feb-2026

QUESTION: 21

Reference:

QUESTION: 22

QUESTION: 23

Reference:

QUESTION: 24

QUESTION: 25

IAPP CIPP-C Exam (page: 5)
IAPP Certified Information Privacy Professional/ Canada (CIPP/C)
Updated on: 15-Feb-2026