Free IAPP CIPP-US Exam Questions

Become IAPP Certified with updated CIPP-US exam questions and correct answers

Page: 1 / 41

Total 201 Questions | Updated On: Apr 28, 2026

Add To Cart

Question 1

Which of the following would NOT be considered a method of obtaining verifiable parental consent before collecting, using or disclosing personal information from children under the Children’s Online Privacy Protection Act (COPPA) of 1998?

A : ing a credit card, debit card, or other online payment system

B : ving the parent call a toll-free telephone number staffed by trained personnel.

C : Having the parent sign a consent form and return it to the operator by postal mail, facsimile, or electronic scan.

D : nding a text message to the parent explaining the intended uses of the information.

Answer: D

Question 2

An organization self-certified under Privacy Shield must, upon request by an individual, do what?

A : pend the use of all personal information collected by the organization to fulfill its original purpose

B : ovide the identities of third parties with whom the organization shares personal information.

C : ovide the identities of third and fourth parties that may potentially receive personal information

D : Identify all personal information disclosed during a criminal investigation

Answer: B

Question 3

A company based in United States receives information about its UK subsidiary’s employees in connection with

the centralized HR service it provides.

How can the UK company ensure an adequate level of data protection that would allow the restricted data

transfer to continue?

A : signing up to an approved code of conduct under UK GDPR to demonstrate compliance with its requirements, both for the parent and the subsidiary companies

B : revising the contract with the United States parent company incorporating EU SCCs, as it continues to be valid for restricted transfers under the UK regime

C : By submitting to the ICO a new application for the UK BCRs using the UK BCR application forms, as their existing authorized EU BCRs are not recognized.

D : allowing each employee the option to opt-out to the restricted transfer, as it is necessary to send their names in order to book the sales bonuses.

Answer: B

Question 4

Which of the following is most likely to provide privacy protection to private-sector employees in the United States?

A : ate law, contract law, and tort law

B : Federal Trade Commission Act (FTC Act)

C : endments one, four, and five of the U.S. Constitution

D : U.S. Department of Health and Human Services (HHS)

Answer: A

Question 5

Mega Corp. is a U.S.-based business with employees in California, Virginia, and Colorado. Which of the following must Mega Corp. comply with in regard to its human resources data?

A : lifornia Privacy Rights Act.

B : lifornia Privacy Rights Act and Virginia Consumer Data Protection Act.

C : lifornia Privacy Rights Act and Colorado Privacy Act.

D : lifornia Privacy Rights Act, Virginia Consumer Data Protection Act, and Colorado Privacy Act.

Answer: D

Page: 1 / 41

Total 201 Questions | Updated On: Apr 28, 2026

Add To Cart