CIPP-E Exam Questions and Answers | Exam-Dumps (Page: 7)

QUESTION: 31

Article 5(1)(b) of the GDPR states that personal data must be "collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes." Based on Article 5(1)(b),

what is the impact of a member state's interpretation of the word "incompatible"?

It dictates the level of security a processor must follow when using and storing personal data for two different purposes.
It guides the courts on the severity of the consequences for those who are convicted of the intentional misuse of personal data.
It sets the standard for the level of detail a controller must record when documenting the purpose for collecting personal data.
It indicates the degree of flexibility a controller has in using personal data in ways that may vary from its original intended purpose.

Answer(s): D

Explanation:

The purpose limitation principle requires that personal data be collected for specified, explicit and legitimate purposes and not be further processed in a manner that is incompatible with those purposes. However, the GDPR does not provide a clear definition of what constitutes an incompatible purpose. Instead, it leaves room for interpretation by the member states, taking into account the context and circumstances of the processing. This means that the degree of flexibility a controller has in using personal data for a new purpose may vary depending on the member state's law and guidance. Some factors that may affect the compatibility assessment include the link between the original and the new purpose, the expectations of the data subject, the nature of the data, the impact of the further processing, and the safeguards applied by the controller.

Reference:

GDPR Article 5(1)(b), which states the purpose limitation principle. GDPR Article 6(4), which lists the criteria for assessing the compatibility of a new purpose. ICO guidance, which explains the purpose limitation principle and provides examples of compatible and incompatible purposes.
[EDPB guidelines], which provide further guidance on the application of the purpose limitation principle.

Reveal Solution Next Question

QUESTION: 32

Tanya is the Data Protection Officer for Curtains Inc., a GDPR data controller. She has recommended that the company encrypt all personal data at rest.
Which GDPR principle is she following?

Accuracy
Storage Limitation
Integrity and confidentiality
Lawfulness, fairness and transparency

Answer(s): C

Explanation:

The GDPR requires that personal data is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. This principle is known as integrity and confidentiality, or sometimes as security. Encryption is one of the possible technical measures that can be used to protect personal data at rest, as it makes the data unintelligible to anyone who does not have the key to decrypt it. By recommending that the company encrypts all personal data at rest, Tanya is following the principle of integrity and confidentiality, as she is ensuring that the personal data is secure and protected from unauthorised access or accidental damage.

Reference:

1: Article 5(1)(f) of the GDPR 2: A guide to the data protection principles | ICO 3: Encryption | ICO

https://www.icaew.com/technical/technology/data/data-protection/data-protection- articles/do-i- have-to-encrypt-personal-data-to-comply-with-dpa-2018

Reveal Solution Next Question

QUESTION: 33

A well-known video production company, based in Spain but specializing in documentaries filmed worldwide, has just finished recording several hours of footage featuring senior citizens in the streets of Madrid. Under what condition would the company NOT be required to obtain the consent of everyone whose image they use for their documentary?

If obtaining consent is deemed to involve disproportionate effort.
If obtaining consent is deemed voluntary by local legislation.
If the company limits the footage to data subjects solely of legal age.
If the company's status as a documentary provider allows it to claim legitimate interest.

Answer(s): D

Explanation:

According to the GDPR, consent is one of the six lawful bases for processing personal data, but not the only one. The other five are: contract, legal obligation, vital interests, public task and legitimate interests. Legitimate interests can be invoked by controllers who process personal data for their own benefit or for the benefit of third parties, as long as such processing does not override the rights and freedoms of the data subjects, especially if they are children. The GDPR also recognizes that processing personal data for journalistic purposes or the purposes of academic, artistic or literary expression may be necessary for the exercise of the right to freedom of expression and information, which is a legitimate interest. Therefore, the company may not need to obtain the consent of everyone whose image they use for their documentary, if they can demonstrate that their processing is necessary for the purposes of their journalistic, artistic or literary expression, and that they have taken into account the reasonable expectations of the data subjects and the potential impact on their privacy. The company should also comply with any relevant national laws or codes of conduct that may apply to such processing.

Reference:

GDPR, Article 6(1)(a)-(f)
GDPR, Recital 47

GDPR, Article 85

Reveal Solution Next Question

QUESTION: 34

A Spanish electricity customer calls her local supplier with Questions: about the company's upcoming merger. Specifically, the customer wants to know the recipients to whom her personal data will be disclosed once the merger is final. According to Article 13 of the GDPR, what must the company do before providing the customer with the requested information?

Verify that the request is applicable to the data collected before the GDPR entered into force.
Verify that the purpose of the request from the customer is in line with the GDPR.
Verify that the personal data has not already been sent to the customer.
Verify that the identity of the customer can be proven by other means.

Answer(s): D

Explanation:

According to Article 13 of the GDPR, the controller (in this case, the electricity supplier) has the obligation to provide the data subject (in this case, the customer) with information about the processing of their personal data, including the recipients or categories of recipients of the personal data, if any. However, before providing such information, the controller must verify the identity of the data subject, to ensure that the information is not disclosed to unauthorized persons. This verification can be done by other means than the personal data already collected, such as asking for additional information, sending a verification code, or using a secure online portal. The other options (A, B, and C) are not relevant for this verification, as they do not relate to the identity of the data subject, but to the scope, purpose, and history of the processing.

Reference:

Article 13 of the GDPR
The right to be informed (transparency) (Article 13 & 14 GDPR) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

https://fpf.org/wp-content/uploads/2018/11/GDPR_CCPA_Comparison-Guide.pdf

Reveal Solution Next Question

QUESTION: 35

Under the GDPR, where personal data is not obtained directly from the data subject, a controller is exempt from directly providing information about processing to the data subject if?

The data subject already has information regarding how his data will be used
The provision of such information to the data subject would be too problematic
Third-party data would be disclosed by providing such information to the data subject
The processing of the data subject's data is protected by appropriate technical measures

Answer(s): A

Explanation:

According to Article 14 of the GDPR, where personal data is not obtained directly from the data subject, the controller must provide the data subject with certain information about the processing, such as the identity of the controller, the purposes and legal basis of the processing, the categories of personal data concerned, the recipients or categories of recipients of the personal data, and the rights of the data subject. However, there are some exceptions to this obligation, as specified in Article 14(5). One of them is when the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases, the controller must take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available.

Reference:

CIPP/E Certification - International Association of Privacy Professionals, Free CIPP/E Study Guide - International Association of Privacy Professionals, GDPR - EUR-Lex, Right to be Informed - General Data Protection Regulation (GDPR)

https://dataprivacymanager.net/gdpr-exemptions-from-the-obligation-to-provide- information-to-the- individual-data-subject/

Reveal Solution Next Question

IAPP CIPP-E Exam (page: 7) IAPP Certified Information Privacy Professional/Europe (CIPP/E) Updated on: 15-Feb-2026

QUESTION: 31

Explanation:

Reference:

QUESTION: 32

Explanation:

Reference:

QUESTION: 33

Explanation:

Reference:

QUESTION: 34

Explanation:

Reference:

QUESTION: 35

Explanation:

Reference:

IAPP CIPP-E Exam (page: 7)
IAPP Certified Information Privacy Professional/Europe (CIPP/E)
Updated on: 15-Feb-2026