CIPM Practice Questions 2026: 10 Sample Questions Explained

Correct: B

Article 3(2)(a) extends the GDPR to controllers and processors outside the EU where they offer goods or services to data subjects in the Union, regardless of payment. The French-language site and euro pricing are exactly the factors Recital 23 lists as evidence of intent to target EU users. Having no EU establishment (A) is irrelevant under the targeting test; the 250-employee figure (C) relates only to the records exemption in Art. 30(5); and special category data (D) is not a trigger for territorial scope.

Correct: B

Valid consent must be "freely given" (Art. 4(11), Art. 7). Recital 43 warns that consent is not a valid basis where there is a clear imbalance between the parties — the employment relationship being the classic example. The employer would normally need a different basis, such as legitimate interests (Art. 6(1)(f)) with a balancing test, or compliance with a legal obligation. Consent need not be written (A), employees can consent in some contexts (C), and there is no fixed one-year expiry (D) — though consent must be refreshable and withdrawable.

Correct: B

Article 9(1) lists the special categories: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data about sex life or sexual orientation. Salary (A) and a home address (C) are ordinary personal data. Criminal conviction data (D) is the trap — it is sensitive, but it sits under Article 10, not Article 9, and is subject to its own stricter conditions.

Correct: C

Under Article 28(10), a processor that goes beyond the controller's documented instructions and determines its own purposes and means becomes a controller in respect of that processing — and takes on full controller liability for it. For the original payroll service it remains a processor; roles are assessed per processing operation. It is not a sub-processor (B), which processes on another processor's behalf, and not a joint controller (D), because the clients don't jointly determine the benchmarking purpose with it.

Correct: B

Article 12(3) requires the controller to respond without undue delay and in any event within one month of receipt. That period may be extended by up to two further months where necessary, taking into account the complexity and number of requests — but the controller must inform the data subject of the extension, with reasons, within the first month. The 72-hour figure (A) is the breach-notification deadline under Art. 33; 40 days (C) was the old UK Data Protection Act 1998 rule, now a common distractor.

Correct: C

Article 33(1) exempts a breach from authority notification where it is unlikely to result in a risk to individuals. But Article 33(5) still requires the controller to document all breaches — their facts, effects and remedial action — so the authority can verify compliance. So "nothing" (D) is wrong. Authority notification (A) is only triggered where risk is likely; notifying individuals (B) is reserved for high risk under Art. 34.

Correct: B

Article 35(1) requires a DPIA where a type of processing is likely to result in a high risk — particularly using new technologies. Article 35(3) names three cases where one is always required: systematic and extensive profiling with legal/significant effects; large-scale processing of special category or criminal data; and large-scale systematic monitoring of a publicly accessible area. It is not required for all processing (A), is not limited to public authorities (C), and does not depend on whether a DPO exists (D).

Correct: B

In Schrems II (C-311/18) the CJEU upheld SCCs in principle but held that the exporter must verify, case by case, whether the destination country offers essentially equivalent protection — a transfer impact assessment (TIA) — and apply supplementary technical, contractual or organisational measures where it does not. The EDPB's Recommendations 01/2020 set out the six-step method. SCCs alone are not automatically enough (A); routine prior authorisation (C) is not required for SCCs; and consent (D) is a narrow derogation under Art. 49, not a replacement.

Correct: B

Under the one-stop-shop mechanism (Art. 56), the supervisory authority of the controller's main or single establishment is the lead authority for its cross-border processing — here, Ireland. Other "concerned" authorities cooperate through the Art. 60 procedure, and local authorities can still handle purely local complaints. The EDPB (C) resolves disputes between authorities under Art. 65 but is not itself the lead; the Commission (D) has no supervisory role over individual cases.

Correct: B

Article 83(5) sets the upper tier — up to €20 million or 4% of the undertaking's total worldwide annual turnover of the preceding year, whichever is higher — for breaches of the basic principles (Art. 5), lawful basis (Art. 6), consent conditions (Art. 7), special categories (Arts. 9–10), data subject rights (Arts. 12–22) and unlawful transfers. The lower tier (A), €10 million or 2%, under Art. 83(4), covers more procedural failures such as records, DPO and DPIA obligations. Options C and D are invented figures.

Correct: C

Article 4(11) defines consent as a freely given, specific, informed and unambiguous indication of the data subject's wishes given by a statement or clear affirmative action. Written form is not required — but under Art. 7(1) the controller must be able to demonstrate that consent was given, so there must be a record. Pre-ticked boxes, silence and inactivity do not qualify (Recital 32).

Correct: B

Article 20(1) limits portability to data the subject has provided, where the legal basis is consent (Art. 6(1)(a) or 9(2)(a)) or contract (Art. 6(1)(b)), and the processing is automated. It does not apply to processing based on legitimate interests or legal obligation, which rules out "always" (A). Public-authority processing in the exercise of official authority is specifically excluded (Art. 20(3)).

Correct: B

Article 30 obliges both controllers (Art. 30(1)) and processors (Art. 30(2)) to maintain records. Article 30(5) exempts organisations with fewer than 250 employees — unless the processing is likely to result in a risk to individuals, is not occasional, or includes special category or criminal data. In practice that carve-out swallows the exemption for many small firms, so the "under 250" rule is a frequent trap.

Correct: A, B and D

Article 17(3) lists the exemptions from erasure: freedom of expression and information (A), compliance with a legal obligation (B), public-interest/public-health and archiving or research purposes, and the establishment, exercise or defence of legal claims (D). Mere business inconvenience (C) is not a lawful ground — the controller must point to a specific Art. 17(3) exemption. On a multi-select item the exam awards credit only for the complete correct set, so missing one or adding C scores the whole question wrong.

Correct: B

Article 28(3), final paragraph, requires the processor to immediately inform the controller if, in its opinion, an instruction infringes the GDPR or other data-protection law. The processor does not simply comply (A) — it can face direct liability under Art. 82 if it acts outside lawful instructions. There is no obligation to report the controller to the authority (C) or to tear up the contract (D) as the first step; flagging the issue is the required action.