Free CIPP-CN sample questions

Correct answer: Mandatory Security Assessment by the Cyberspace Administration of China (CAC)

Under PIPL and the Measures for the Security Assessment of Outbound Data Transfers, a mandatory CAC Security Assessment is triggered if a data processor processes the personal information of more than 1 million individuals. Since the company has 2 million users, it exceeds this threshold, making the CAC Security Assessment the only valid mechanism, superseding SCCs or Certification.

Correct answer: The company must complete a filing with the Human Genetic Resources Administration of China (HGRAC) before the transfer.

Genetic data falls under the Human Genetic Resources (HGR) regulations in addition to PIPL. The export of HGR requires specific approval or filing with the Human Genetic Resources Administration of China (HGRAC/MOST), regardless of the volume thresholds that might otherwise apply under PIPL alone. This is a dual-compliance scenario.

Correct answer: National Core Data

The DSL establishes a category called 'National Core Data' (State Core Data), which refers to data related to national security, the lifelines of the national economy, important aspects of people's livelihood, and major public interests. This is the highest classification level, requiring the strictest protection measures.

Correct answers: Obtain explicit consent from the child's guardian (parent); Establish a specialized rule/policy for children's personal information protection

For children under 14, the law mandates obtaining consent specifically from the guardian/parent. Consent from the child alone is insufficient.

Network operators processing children's data must establish and publish a specialized personal information protection rule specifically for children, separate or distinct from the general privacy policy.

Correct answer: The detailed budget allocated for data monetization

PIPL Article 55 requires a PIA to cover: (1) lawfulness/necessity of purpose/method, (2) impact on rights/interests, and (3) effectiveness of protection measures. Financial budgets for monetization are not a required element of a compliance-focused PIA.

Correct answer: TechFin must store all personal information and important data generated within China locally in China.

As a designated Critical Information Infrastructure Operator (CIIO), TechFin is subject to the strict data localization requirements of the Cybersecurity Law (CSL) and PIPL. CIIOs MUST store personal information and important data collected/generated in China locally. Any export requires a security assessment, but the primary constraint is the default localization requirement.

Correct answer: Cyberspace Administration of China (CAC)

The Cyberspace Administration of China (CAC) is the primary department responsible for the overall planning and coordination of personal information protection and related supervision and administration nationwide.

Correct answer: True

According to PIPL Article 26 and the Supreme People's Court interpretation, image capture in public places for the purpose of maintaining public safety is permitted without individual consent, provided prominent alert signage is displayed and the data is not used for other purposes (like marketing analysis).

Correct answer: Ensure the training data sources are lawful and do not infringe on intellectual property rights.

The Interim Measures mandate that providers must lawfully source training data and ensure it does not infringe on intellectual property rights or contain illegal content.

Correct answers: Processing sensitive personal information; Providing personal information to another personal information handler

PIPL explicitly requires 'separate consent' (or specific consent) for processing sensitive personal information (Article 29).

Article 23 of PIPL requires separate consent when providing personal information to another handler (third-party sharing).