Free CIPP-A sample questions

Correct answer: India's DPDPA, because it explicitly exempts the processing of personal data made publicly available by the Data Principal.

India's Digital Personal Data Protection Act, 2023 (DPDPA) provides a specific exemption for the processing of personal data that is made publicly available by the Data Principal themselves or by any other person under a legal obligation. Singapore's PDPA exemption for publicly available data is narrower and generally applies to data in public registers like directories. Hong Kong's PDPO does not have a general exemption for publicly available data, meaning its processing is still subject to the Data Protection Principles.

Correct answer: The e-commerce client (data controller), although the data intermediary must promptly inform the client of the breach.

Under Singapore's PDPA, a data intermediary processing personal data on behalf of another organization is only subject to the Protection Obligation and the Retention Limitation Obligation. The primary responsibility for other obligations, including data breach notification, remains with the data controller (the e-commerce client). The data intermediary's contractual duty is to notify its client without undue delay, enabling the client to fulfill its notification obligations to the PDPC and affected individuals.

Correct answers: A clear and conspicuous statement informing the recipient of their right to opt-out.; A response channel for the recipient to communicate their consent to opt-out.; A statement that the recipient's personal data may be used for future direct marketing.

The PDPO's direct marketing provisions require that when using personal data for direct marketing for the first time, the data user must inform the individual of their right to opt-out, provide a response channel to exercise this right, and state the intention to use their data for direct marketing. The contact info of the PCPD and the specific marketing manager are not required elements.

Correct answer: Implementing a consent flow where a parent logs into a dedicated parent portal using their national ID (e.g., Aadhaar) for authentication before granting consent.

The DPDPA requires 'verifiable' parental consent for processing children's data. This implies a higher standard than a simple checkbox or passive consent. Using a robust authentication method like a national ID-linked parent portal provides a strong, auditable trail that reasonably ensures the person giving consent is indeed the parent or legal guardian. This is a much stronger method than the others, which are easily circumvented by the child.

Correct answer: Implement intra-group data transfer agreements with the Australian entity based on model contractual clauses, conduct transfer impact assessments, and obtain explicit employee consent specifically for the transfer to Australia.

This is the most comprehensive strategy. Relying solely on employment contract consent is weak, especially in the employer-employee context. While APEC CBPR is a valid mechanism for Singapore, its recognition in Hong Kong and India is less established as a standalone solution. The most robust approach involves using contractual safeguards (intra-group agreements, often based on model clauses) to ensure the recipient is bound to protect the data, supplemented by specific, explicit consent for the transfer itself. This layered approach addresses the requirements across all three jurisdictions for ensuring the recipient provides a comparable level of protection.

Correct answer: False

As of early 2025, Section 33 of the PDPO has not yet come into effect. While it is part of the ordinance, its implementation has been deferred. Therefore, organizations in Hong Kong currently rely on other measures like contractual clauses and consent to ensure protection for cross-border data transfers, rather than the specific mechanisms outlined in Section 33.

Correct answer: To establish a system for organizations to demonstrate compliance with internationally recognized privacy principles, thereby facilitating data flows among participating economies.

The APEC CBPR system is a voluntary, accountability-based system. Its goal is not to create a single law but to build trust in cross-border data flows by allowing companies to be certified by an 'Accountability Agent' as compliant with the APEC Privacy Framework. This certification helps bridge differences between national privacy laws and facilitates data transfers between participating APEC economies.

Correct answers: The breach affects more than 500 individuals.; The breach is likely to result in significant harm to the affected individuals.

Under Singapore's PDPA, data breach notification to the PDPC is mandatory if (1) the breach is likely to result in significant harm to an individual, OR (2) the breach affects 500 or more individuals. The source of the breach (vendor error) or the type of data (health information) are factors in assessing harm, but the notification triggers are the 'significant harm' threshold and the 'scale' threshold (500 individuals).

Correct answer: DPP2: Accuracy and Duration of Retention

DPP2 explicitly states that personal data should not be kept for longer than is necessary to fulfill the purpose for which it was collected. Keeping recordings indefinitely without a clear, time-bound justification directly contravenes the duration of retention aspect of this principle. While other DPPs might be relevant, the core violation here is the lack of a retention policy.

Correct answer: To appoint a Data Protection Officer based in India and conduct periodic Data Protection Impact Assessments (DPIAs).

The DPDPA imposes additional compliance burdens on organizations designated as Significant Data Fiduciaries. Key among these are the mandatory appointment of a Data Protection Officer (DPO) who must be based in India, and the requirement to undertake periodic Data Protection Impact Assessments (DPIAs) to evaluate and mitigate risks associated with their data processing activities.