Free IAPP CIPP-US Exam Questions

Become IAPP Certified with updated CIPP-US exam questions and correct answers

Page: 1 / 41

Total 201 Questions | Updated On: Feb 06, 2026

Add To Cart

Question 1

A company based in United States receives information about its UK subsidiary’s employees in connection with

the centralized HR service it provides.

How can the UK company ensure an adequate level of data protection that would allow the restricted data

transfer to continue?

A : signing up to an approved code of conduct under UK GDPR to demonstrate compliance with its requirements, both for the parent and the subsidiary companies

B : revising the contract with the United States parent company incorporating EU SCCs, as it continues to be valid for restricted transfers under the UK regime

C : By submitting to the ICO a new application for the UK BCRs using the UK BCR application forms, as their existing authorized EU BCRs are not recognized.

D : allowing each employee the option to opt-out to the restricted transfer, as it is necessary to send their names in order to book the sales bonuses.

Answer: B

Question 2

What privacy concept grants a consumer the right to view and correct errors on his or her credit report?

A : cess

B : tice

C : tion

D : oice

Answer: B

Question 3

When does the Telemarketing Sales Rule require an entity to share a do-not-call request across its organization?

A : en the operational structures of its divisions are not transparent

B : en the goods and services sold by its divisions are very similar

C : en a call is not the result of an error or other unforeseen cause

D : en the entity manages user preferences through multiple platforms

Answer: C

Question 4

An organization self-certified under Privacy Shield must, upon request by an individual, do what?

A : pend the use of all personal information collected by the organization to fulfill its original purpose

B : ovide the identities of third parties with whom the organization shares personal information.

C : ovide the identities of third and fourth parties that may potentially receive personal information

D : Identify all personal information disclosed during a criminal investigation

Answer: B

Question 5

The Cable Communications Policy Act of 1984 requires which activity?

A : livery of an annual notice detailing how subscriber information is to be used

B : Destruction of personal information a maximum of six months after it is no longer needed

C : tice to subscribers of any investigation involving unauthorized reception of cable services

D : taining subscriber consent for disseminating any personal information necessary to render cable services

Answer: C

Page: 1 / 41

Total 201 Questions | Updated On: Feb 06, 2026

Add To Cart