IAPP Certified Information Privacy Manager (CIPM) Exam Practice Test

Answer : A

A physical control that can limit privacy risk is keypad or biometric access. This is a type of access control that restricts who can enter or access a physical location or device where personal data is stored or processed. Keypad or biometric access requires a code or a biological feature (such as a fingerprint or a face scan) to authenticate the identity and authorization of the person seeking access. This can prevent unauthorized access, theft, loss, or damage of personal data by outsiders or insiders, .Reference:[CIPM - International Association of Privacy Professionals], [Free CIPM Study Guide - International Association of Privacy Professionals]

Answer : C

Crafting policies which ensure minimal data is collected is least likely to be achieved by implementing a Data Lifecycle Management (DLM) program, as it is more related to the data collection stage, not the data management stage. A DLM program focuses on how to handle the data after it has been collected, such as how to store, use, share, and dispose of it. The other options are more likely to be achieved by implementing a DLM program, as they help to optimize the data storage costs, comply with the data retention obligations, and protect the data confidentiality.Reference:CIPM Body of Knowledge, Domain III: Privacy Program Management Activities, Task 1: Manage data inventory.

Answer : D

A Privacy Impact Assessment (PIA) is a process that helps an organization identify and evaluate the potential privacy risks and impacts of a new or existing project, program, system, or service that involves the collection, use, disclosure, or retention of personal information. A PIA also helps an organization identify and implement appropriate measures to mitigate or eliminate those risks and impacts, and ensure compliance with applicable privacy laws, regulations, and standards. A PIA should be completed to effectively make changes that involve customer personal information, such as converting paper records into electronic form, uploading the records into a new third-party marketing tool, and merging the customer personal information in the marketing tool with information from other applications. A PIA can help an organization assess the necessity, proportionality, and legality of the proposed changes, as well as the potential privacy risks to the customers and the organization, such as unauthorized access, disclosure, modification, or loss of personal information, identity theft, fraud, reputational damage, or legal liability. A PIA can also help an organization implement appropriate measures to mitigate or eliminate those risks, such as data minimization, encryption, anonymization, pseudonymization, consent management, access control, security safeguards, contractual clauses, data protection impact assessments (DPIAs), data subject rights, breach notification procedures, and privacy policies.

CIPM Body of Knowledge (2021), Domain IV: Privacy Program Operational Life Cycle, Section C: Monitoring and Managing Program Performance Subsection 1: Privacy Impact Assessments1

CIPM Study Guide (2021), Chapter 9: Monitoring and Managing Program Performance Section 9.1: Privacy Impact Assessments2

CIPM Textbook (2019), Chapter 9: Monitoring and Managing Program Performance Section 9.1: Privacy Impact Assessments3

CIPM Practice Exam (2021), Question 1464

Answer : C

A data inventory is a good starting point to understand the scope of privacy program needs, as it provides a comprehensive overview of what personal data is collected, processed, stored, shared, and disposed of by the organization. A data inventory can help identify the legal obligations, risks, and gaps in the privacy program, as well as the opportunities for improvement and optimization. The other options are also important components of a privacy program, but they are more effective when based on a data inventory.Reference:CIPM Body of Knowledge, Domain II: Privacy Program Operational Life Cycle, Task 1: Assess the current state of the privacy program.

Answer : B

When expanding into a new jurisdiction, it is not necessary to appoint a new Privacy Officer (PO) for that jurisdiction, unless the local law requires it. The other options are important steps to ensure compliance with the new jurisdiction's privacy laws and regulations, as well as to align the privacy program with the business objectives and culture of the new market.Reference:CIPM Body of Knowledge, Domain I: Privacy Program Governance, Task 1: Establish the privacy program vision and strategy.

Answer : C

Organizational culture is not an important factor to consider when developing a data retention policy. A data retention policy is a document that defines how long an organization retains personal information for various purposes and how it disposes of it securely when it is no longer needed. A data retention policy should be based on factors such as: business requirements, such as operational needs, customer expectations, contractual obligations, or industry standards; compliance requirements, such as legal obligations, regulatory mandates, or audit recommendations; and technology resources, such as storage capacity, backup systems, encryption methods, or disposal tools. Organizational culture, which refers to the values, beliefs, norms, and behaviors that shape how an organization operates and interacts with its stakeholders, is not a relevant factor for determining data retention periods or disposal methods.

CIPM Body of Knowledge (2021), Domain IV: Privacy Program Operational Life Cycle, Section B: Protecting Personal Information, Subsection 4: Data Retention

CIPM Study Guide (2021), Chapter 8: Protecting Personal Information, Section 8.4: Data Retention

CIPM Textbook (2019), Chapter 8: Protecting Personal Information, Section 8.4: Data Retention

CIPM Practice Exam (2021), Question 141

Answer : D

Providing a dedicated privacy space with the privacy policy, explanatory documents and operation frameworks helps build trust with customers and stakeholders. A dedicated privacy space is a section on an organization's website or app that provides clear and transparent information about how the organization processes personal information and respects data subject rights. It can include documents such as: a privacy policy that explains what personal information is collected, why it is collected, how it is used, who it is shared with, and how it is protected; explanatory documents that provide more details or examples of specific processing activities or scenarios; and operation frameworks that describe the procedures and mechanisms for data subject requests, complaints, inquiries, or feedback. A dedicated privacy space can help customers and stakeholders understand the organization's privacy practices, choices, and values, and enhance their confidence and trust.

CIPM Body of Knowledge (2021), Domain II: Privacy Program Framework, Section A: Privacy Program Framework Components, Subsection 1: Privacy Policies

CIPM Study Guide (2021), Chapter 4: Privacy Program Framework Components, Section 4.1: Privacy Policies

CIPM Textbook (2019), Chapter 4: Privacy Program Framework Components, Section 4.1: Privacy Policies

CIPM Practice Exam (2021), Question 140