IAPP CIPP-A Online Practice Questions and Exam Preparation

IAPP CIPP-A Online Questions & Answers

• Question 1:

  In what way are Singapore residents protected following a data breach in ways that India and Hong Kong residents are not?

  A. The affected individuals must be informed when significant harm is likely to occur.
  B. The relevant authority must be informed of such data breach following its discovery.
  C. The company must have in place a data breach response plan including third-parties.
  D. The breach must be reported to the relevant authority within 72 hours of the discovery.
  A. The affected individuals must be informed when significant harm is likely to occur.

• Question 2:

  The judgement of the Supreme Court in 2017 in the case of Justice K.S. Puttaswamy (retd.) and Anr. vs. Union of India held that?

  A. Right to Privacy is a fundamental right guaranteed by the Constitution.
  B. Right to Privacy is an intrinsic part of Art. 21 of the Constitution.
  C. Right to life and personal liberty includes the right to Privacy.
  D. Right to Privacy is the right to be left alone.
  A. Right to Privacy is a fundamental right guaranteed by the Constitution.

• Question 3:

  What personal information is considered sensitive in most countries in Asia with such definition in privacy laws?

  A. Financial information.
  B. Health information.
  C. Geolocalization information.
  D. Criminal records.
  B. Health information.

  ---

  explanation:

  Explanation/Reference:

• Question 4:

  Cases in which an Indian company is accused of violating provisions of India's IT Act must be heard by?

  A. The High Court.
  B. A Grievance Officer.
  C. An Adjudicating Officer.
  D. The Cyber Appellate Tribunal.
  A. The High Court.

• Question 5:

  According to India's IT Rules 2011, a body corporate operating in India is required to appoint what kind of authority?

  A. A Chief Risk Officer.
  B. A Grievance Officer.
  C. A Data Protection Officer.
  D. A Chief Technology Officer.
  B. A Grievance Officer.

• Question 6:

  Section 43A was amended by India's IT Rules 2011 to include?

  A. A definition of what constitutes reasonable security practices.
  B. A requirement for the creation of a data protection authority.
  C. A list of cases in which privacy policies are not necessary.
  D. A clarification regarding the role of non-automated data.
  A. A definition of what constitutes reasonable security practices.

• Question 7:

  Which Indian institution is vested with powers under the Credit Information Companies (Regulation) Act of 2005?

  A. The Reserve Bank of India.
  B. The National Housing Bank.
  C. The Oriental Bank of Commerce.
  D. The Securities and Exchange Board of India.
  A. The Reserve Bank of India.

• Question 8:

  In June 2011, the Hong Kong Privacy Commissioner determined that data subject consent is NOT valid if it is what?

  A. Provided by the data subject solely in verbal form.
  B. Used for a directly related but separate purpose.
  C. Bundled with other terms of the agreement.
  D. Intended for direct marketing purposes.
  C. Bundled with other terms of the agreement.

• Question 9:

  Based on the model contract released by the Privacy Commissioner for Personal Data (PDPC), Hong Kong, all of the following sections are recommended to be put into a contract to address Ordinance 33 (Data transfer/export) of Hong Kong's Personal Data Privacy Ordinance (PDPO) EXCEPT?

  A. Liability and indemnity.
  B. Exemptions and Definitions.
  C. Termination of the contract.
  D. Obligations of the Transferee.
  E. None of the above.
  E. None of the above.

  ---

  explanation:

  Explanation/Reference:

  Based on the model contract released by the Privacy Commissioner for Personal Data (PDPC), Hong Kong, all of the sections mentioned in the options (A, B, C, and D) are recommended to be put into a contract to address Ordinance 33 (Data transfer/export) of Hong Kong's Personal Data Privacy Ordinance (PDPO). Therefore, none of the options are correct, and the correct answer would be "none of the above".

• Question 10:

  Which provision of Hong Kong's Personal Data (Privacy) Ordinance (PDPO) strengthens the purpose limitation principle (DPP3)?

  A. Notice; because the data subject must be provided with the purpose of the collection.
  B. Public domain; because the data subjects must agree to the purpose before their information is made publicly available.
  C. Prescribed consent; because the data subject must give express consent to their personal information being used for additional purposes.
  D. Finality; because the purpose for collection of personal information from the subject must be directly related to a function of the collector.
  A. Notice; because the data subject must be provided with the purpose of the collection.