[Jul-2026] Verified IAPP Exam Dumps with CIPP-E Exam Study Guide [Q95-Q111]

Rate this post

[Jul-2026] Verified IAPP Exam Dumps with CIPP-E Exam Study Guide

Best Quality IAPP CIPP-E Exam Questions PrepAwayPDF Realistic Practice Exams [2026]

IAPP CIPP-E certification exam is a valuable credential for privacy professionals who work in Europe or with European data. CIPP-E exam is designed to test the candidate’s knowledge of GDPR and data protection principles, and is offered by the world’s largest association of privacy professionals. Certified Information Privacy Professional/Europe (CIPP/E) certification is valid for three years and can be renewed by earning continuing education credits.

More about Test

The IAPP CIPP-E exam will test the candidate’s understanding of the privacy laws and guidelines in Europe. It includes 90 questions taking 2.5 hours. The candidate will also be tested on how well they conceptualize the legal prerequisites for transferring delicate personal data to and from the US, the EU as well as other jurisdictions. To add more, all IAPP tests’ passing score is 300, with the range being between 100 and 500 points. The first attempt of the test costs $550, while a retake goes for $375. The maintenance fee for the certification is $250 and is prompted when you enroll for your initial IAPP exam. Also, the certificate should be renewed every two years. The maintenance price is included in the membership fee for all members. In all, you can take the exam through computer delivery, which can be done through Pearson VUE, which is partnering with IAPP to avail the exams. As a rule, the official test can be taken in any of the 6000 testing centers across the world. Once you pay the exam fee on the IAPP website, the candidate will be redirected to the Pearson VUE website to get their HOST location. The candidate will also get the exam time and date on the website by clicking on the My Purchases segment on their MyIAPP account. Also, such an exam is available all through the year but candidates are encouraged to apply for it at least 90 days before the actual date. Note that the date and time will vary depending on the location of the candidate. Finally, if candidates already have another IAPP certification, they get this exam at a discounted price of $375.

NEW QUESTION 95
SCENARIO
Please use the following to answer the next question:
Jack worked as a Pharmacovigiliance Operations Specialist in the Irish office of a multinational pharmaceutical company on a clinical trial related to COVID-19. As part of his onboarding process Jack received privacy training He was explicitly informed that while he would need to process confidential patient data in the course of his work, he may under no circumstances use this data for anything other than the performance of work-related (asks This was also specified in the privacy policy, which Jack signed upon conclusion of the training.
After several months of employment, Jack got into an argument with a patient over the phone. Out of anger he later posted the patient’s name and hearth information, along with disparaging comments, on a social media website. When this was discovered by his Pharmacovigilance supervisors. Jack was immediately dismissed Jack’s lawyer sent a letter to the company stating that dismissal was a disproportionate sanction, and that if Jack was not reinstated within 14 days his firm would have no alternative but to commence legal proceedings against the company. This letter was accompanied by a data access request from Jack requesting a copy of “all personal data, including internal emails that were sent/received by Jack or where Jack is directly or indirectly identifiable from the contents In relation to the emails Jack listed six members of the management team whose inboxes he required access.
The company conducted an initial search of its IT systems, which returned a large amount of information They then contacted Jack, requesting that he be more specific regarding what information he required, so that they could carry out a targeted search Jack responded by stating that he would not narrow the scope of the information requester.
Under Article 82 of the GDPR (“Right to compensation and liability-), which party is liable for the damage caused by the data breach?

Both parties are exempt, as the company is involved in human health research

Jack and the pharmaceutical company are jointly liable.

The pharmaceutical company is liable.

Jack is liable

Article 82 of the GDPR introduces a right to compensation for damage caused as a result of an infringement of the GDPR1. Article 82 (1) states that any person who has suffered material or non-material damage as a result of an infringement of the GDPR shall have the right to receive compensation from the controller or processor for the damage suffered1. Article 82 (2) states that any controller involved in processing shall be liable for the damage caused by processing which infringes the GDPR1. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller1. Article 82 (3) states that a controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage1. In this case, Jack is liable for the damage caused by the data breach, as he violated the GDPR by posting the patient’s name and health information, along with disparaging comments, on a social media website. This constitutes an infringement of the GDPR, as it violates the principles of lawfulness, fairness, and transparency (Article 5 (1) (a)), purpose limitation (Article 5 (1) (b)), data minimisation (Article 5 (1) ), accuracy (Article 5 (1) (d)), integrity and confidentiality (Article 5 (1) (f)), and the rights of the data subject (Articles 12-23)1. The pharmaceutical company is not liable for the damage caused by the data breach, as it can prove that it is not in any way responsible for the event giving rise to the damage. The company provided privacy training to Jack, informed him of the privacy policy, obtained his consent, and dismissed him as soon as the breach was discovered. Therefore, the company complied with the obligations of the GDPR, such as the accountability principle (Article 5 (2)), the data protection by design and by default principle (Article 25), the security of processing principle (Article 32), and the notification of a personal data breach to the supervisory authority principle (Article 33)1. Therefore, option D is the correct answer. References: Art. 82 GDPR – Right to compensation and liability, Article 82 GDPR – GDPRhub

NEW QUESTION 96
Which of the following was the first to implement national law for data protection in 1973?

France

Sweden

Germany

United Kingdom

NEW QUESTION 97
SCENARIO
Please use the following to answer the next question:
Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:
* Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.
* Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).
* Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees.
These records are available to former students after registering through Granchester’s Alumni portal.
* Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.
* Under their security policy, the University encrypts all of its personal data records in transit and at rest.
In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna’s data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level.
Mindful of Anna’s training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.
One of Anna’s tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.
Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.
Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.
Which of the University’s records does Anna NOT have to include in her record of processing activities?

Student records

Staff and alumni records

Frank’s performance database

Department for Education records

NEW QUESTION 98
Which change was introduced by the 2009 amendments to the e-Privacy Directive 2002/58/EC?

A voluntary notification for personal data breaches applicable to all data controllers.

A voluntary notification for personal data breaches applicable to electronic communication providers.

A mandatory notification for personal data breaches applicable to all data controllers.

A mandatory notification for personal data breaches applicable to electronic communication providers.

NEW QUESTION 99
SCENARIO
Please use the following to answer the next question:
Anna and Frank both work at Granchester University. Anna is a lawyer responsible for data protection, while Frank is a lecturer in the engineering department. The University maintains a number of types of records:
* Student records, including names, student numbers, home addresses, pre-university information, university attendance and performance records, details of special educational needs and financial information.
* Staff records, including autobiographical materials (such as curricula, professional contact files, student evaluations and other relevant teaching files).
* Alumni records, including birthplaces, years of birth, dates of matriculation and conferrals of degrees.
These records are available to former students after registering through Granchester’s Alumni portal.
Department for Education records, showing how certain demographic groups (such as first-generation students) could be expected, on average, to progress. These records do not contain names or identification numbers.
* Under their security policy, the University encrypts all of its personal data records in transit and at rest.
In order to improve his teaching, Frank wants to investigate how his engineering students perform in relational to Department for Education expectations. He has attended one of Anna’s data protection training courses and knows that he should use no more personal data than necessary to accomplish his goal. He creates a program that will only export some student data: previous schools attended, grades originally obtained, grades currently obtained and first time university attended. He wants to keep the records at the individual student level. Mindful of Anna’s training, Frank runs the student numbers through an algorithm to transform them into different reference numbers. He uses the same algorithm on each occasion so that he can update each record over time.
One of Anna’s tasks is to complete the record of processing activities, as required by the GDPR. After receiving her email reminder, as required by the GDPR. After receiving her email reminder, Frank informs Anna about his performance database.
Ann explains to Frank that, as well as minimizing personal data, the University has to check that this new use of existing data is permissible. She also suspects that, under the GDPR, a risk analysis may have to be carried out before the data processing can take place. Anna arranges to discuss this further with Frank after she has done some additional research.
Frank wants to be able to work on his analysis in his spare time, so he transfers it to his home laptop (which is not encrypted). Unfortunately, when Frank takes the laptop into the University he loses it on the train. Frank has to see Anna that day to discuss compatible processing. He knows that he needs to report security incidents, so he decides to tell Anna about his lost laptop at the same time.
Before Anna determines whether Frank’s performance database is permissible, what additional information does she need?

More information about Frank’s data protection training.

More information about the extent of the information loss.

More information about the algorithm Frank used to mask student numbers.

More information about what students have been told and how the research will be used.

Before Anna determines whether Frank’s performance database is permissible, she needs to know more information about the following aspects of the data processing:
* The purpose and legal basis of the data processing, which should be clearly defined and documented in a data protection impact assessment (DPIA) or a similar document12.
* The nature and extent of the personal data involved, which should be limited to what is necessary for the purpose and not retained longer than necessary12.
* The measures taken to ensure the security and confidentiality of the personal data, such as encryption, pseudonymization, access control, etc12.
* The rights and interests of the data subjects, such as their right to access, rectify, erase or restrict their personal data, as well as their right to object or withdraw consent12.
* The potential risks and consequences of the data processing for the rights and freedoms of the data subjects, such as identity theft, discrimination, reputational damage, etc12.
In this case, Anna needs to know more information about what students have been told and how the research will be used. This is because:
* The purpose of using student records for research purposes is not clear from Frank’s description. He does not specify whether he has obtained consent from the students or their parents/guardians, or whether he has informed them about his research objectives and methods.
* The nature and extent of using student records for research purposes is not clear from Frank’s description. He does not specify which student records he is using (e.g., by name or by reference number), how many records he is using (e.g., by cohort or by class), or how long he will keep them (e.
g., until graduation or indefinitely).
* The measures taken to ensure the security and confidentiality of using student records for research purposes are not clear from Frank’s description. He does not specify whether he has encrypted his program or his laptop before transferring it to his home device, whether he has backed up his program or his laptop before losing it on the train, or whether he has reported his lost laptop to his IT department.
Therefore, Anna needs more information about these aspects before she can determine whether Frank’s performance database is permissible under the GDPR.
References: 1: Free CIPP/E Study Guide – International Association of Privacy Professionals 2: CIPP/E Certification – International Association of Privacy Professionals

NEW QUESTION 100
An unforeseen power outage results in company Z’s lack of access to customer data for six hours. According to article 32 of the GDPR, this is considered a breach. Based on the WP 29’s February, 2018 guidance, company Z should do which of the following?

Notify affected individuals that their data was unavailable for a period of time.

Document the loss of availability to demonstrate accountability

Notify the supervisory authority about the loss of availability

Conduct a thorough audit of all security systems

According to Article 32 of the GDPR, the controller and the processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the processing, including the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident1. A personal data breach is defined as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed2. Therefore, a power outage that results in the loss of availability of customer data for six hours is considered a personal data breach under the GDPR.
Based on the WP 29’s February, 2018 guidance, which was endorsed by the European Data Protection Board, company Z should document the loss of availability to demonstrate accountability3. The guidance states that controllers must document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken, regardless of whether the breach needs to be notified to the supervisory authority or the data subjects. This documentation must enable the supervisory authority to verify compliance with the GDPR and must be made available to the supervisory authority on request4.
The other options (A, C, and D) are not required by the GDPR or the guidance, although they may be advisable or beneficial depending on the circumstances. Option A is not mandatory, as the GDPR only requires the controller to communicate the personal data breach to the data subject when the breach is likely to result in a high risk to the rights and freedoms of natural persons5. A temporary loss of availability may not pose such a high risk, unless it affects the data subject’s essential services or activities. Option C is also not obligatory, as the GDPR only requires the controller to notify the supervisory authority of the personal data breach within 72 hours unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons6. A short-term loss of availability may not entail such a risk, unless it affects a large number of data subjects or sensitive data. Option D is not specified by the GDPR or the guidance, although it may be a good practice to conduct a thorough audit of all security systems after a personal data breach to identify and address any vulnerabilities or weaknesses that may have contributed to the incident or may lead to future incidents. References:
* 1: Article 32 of the GDPR
* 2: Article 4 (12) of the GDPR
* 3: Endorsed WP29 Guidelines
* 4: Article 33 (5) of the GDPR
* 5: Article 34 (1) of the GDPR
* 6: Article 33 (1) of the GDPR
* 7: Guidelines on Personal data breach notification under Regulation 2016/679, WP250 rev.01
* 8: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
* 9: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679

NEW QUESTION 101
A company plans to transfer employee health information between two of its entities in France. To maintain the security of the processing, what would be the most important security measure to apply to the health data transmission?

Inform the data subject of the security measures in place.

Ensure that the receiving entity has signed a data processing agreement.

Encrypt the transferred data in transit and at rest.

Conduct a data protection impact assessment.

NEW QUESTION 102
According to the European Data Protection Board, if a controller that is not established in the EU but still subject to the GDPR becomes aware of a personal data breach, which supervisory authority or authorities must be notified?

Only the supervisory authority of the EU member state in which the controller’s EU representative (pursuant to Article 27) is established.

Only one lead supervisory authority, as a controller benefits from the one-stop shop mechanism under the GDPR’s enforcement regime.

Every supervisory authority of the EU member states where the controller is offering goods or services.

Every supervisory authority for which affected data subjects reside in their EU member state.

The General Data Protection Regulation (GDPR) introduces a duty for controllers to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. The GDPR also requires controllers to communicate the personal data breach to the affected data subjects without undue delay, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.
The GDPR applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the EU, regardless of whether the processing takes place in the EU or not. The GDPR also applies to the processing of personal data of data subjects who are in the EU by a controller or processor not established in the EU, where the processing activities are related to the offering of goods or services to data subjects in the EU or the monitoring of their behaviour as far as their behaviour takes place within the EU.
The GDPR provides that where a controller or a processor is not established in the EU, but is subject to the GDPR, the controller or the processor shall designate in writing a representative in the EU. The representative shall be established in one of the member states where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are. The representative shall act on behalf of the controller or the processor and may be addressed by any supervisory authority or data subject on any issues related to the processing of personal data under the GDPR.
The GDPR also establishes a one-stop shop mechanism, which aims to ensure the consistent and effective application of the GDPR across the EU. The one-stop shop mechanism allows a controller or a processor with establishments in several member states to have a single supervisory authority as its interlocutor, which is the supervisory authority of the main establishment or of the single establishment of the controller or processor.
The one-stop shop mechanism also enables a controller or a processor that is not established in the EU, but is subject to the GDPR, to deal with a single lead supervisory authority, which is the supervisory authority of the member state where the representative of the controller or processor is established.
Based on the GDPR and the guidelines of the European Data Protection Board (EDPB), if a controller that is not established in the EU but still subject to the GDPR becomes aware of a personal data breach, the controller must notify the supervisory authority of the EU member state in which the controller’s EU representative (pursuant to Article 27) is established. This is the only supervisory authority that the controller must notify, as the controller benefits from the one-stop shop mechanism and has a single lead supervisory authority. The controller does not need to notify every supervisory authority of the EU member states where the controller is offering goods or services or where the affected data subjects reside, as this would be contrary to the principle of consistency and the aim of simplification of the one-stop shop mechanism.
References:
GDPR, Articles 3, 4, 27, 28, 29, 33, 34, 51, 55, 56, 57, 58, 60, 61, 62, 63, 64, 65, 66, 67, and 68.
EDPB Guidelines 9/2022 on personal data breach notification under GDPR, pages 5, 6, 7, 8, 9, 10, 11, 12, 13,
14, 15, and 16.
EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, pages 19, 20, 21, 22, 23,
24, 25, 26, 27, and 28.
EDPB Guidelines 3/2018 on the territorial scope of the GDPR, pages 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, and 15.

NEW QUESTION 103
Which of the following is NOT an explicit right granted to data subjects under the GDPR?

The right to request access to the personal data a controller holds about them.

The right to request the deletion of data a controller holds about them.

The right to opt-out of the sale of their personal data to third parties.

The right to request restriction of processing of personal data, under certain scenarios.

NEW QUESTION 104
SCENARIO
Please use the following to answer the next question:
Jack worked as a Pharmacovigiliance Operations Specialist in the Irish office of a multinational pharmaceutical company on a clinical trial related to COVID-19. As part of his onboarding process Jack received privacy training He was explicitly informed that while he would need to process confidential patient data in the course of his work, he may under no circumstances use this data for anything other than the performance of work-related (asks This was also specified in the privacy policy, which Jack signed upon conclusion of the training.
After several months of employment, Jack got into an argument with a patient over the phone. Out of anger he later posted the patient’s name and hearth information, along with disparaging comments, on a social media website. When this was discovered by his Pharmacovigilance supervisors. Jack was immediately dismissed Jack’s lawyer sent a letter to the company stating that dismissal was a disproportionate sanction, and that if Jack was not reinstated within 14 days his firm would have no alternative but to commence legal proceedings against the company. This letter was accompanied by a data access request from Jack requesting a copy of “all personal data, including internal emails that were sent/received by Jack or where Jack is directly or indirectly identifiable from the contents In relation to the emails Jack listed six members of the management team whose inboxes he required access.
The company conducted an initial search of its IT systems, which returned a large amount of information They then contacted Jack, requesting that he be more specific regarding what information he required, so that they could carry out a targeted search Jack responded by stating that he would not narrow the scope of the information requester.
Under Article 82 of the GDPR (“Right to compensation and liability-), which party is liable for the damage caused by the data breach?

Both parties are exempt, as the company is involved in human health research

Jack and the pharmaceutical company are jointly liable.

The pharmaceutical company is liable.

Jack is liable

NEW QUESTION 105
Which of the following regulates the use of electronic communications services within the European Union?

Regulator (EU) 2015/2120 of the European Parliament and of the Council of 25 November 2015.

Regulation (EU) 2017/1953 of the European Parliament and of the Council of 25 October 2017.

Directive 2002/58’EC of the European Parliament and of the Council of 12 July 2002.

Directive (EU) 2019.789 of the European Parliament and of the Council of 17 April 2019.

NEW QUESTION 106
SCENARIO
Please use the following to answer the next question:
Joe started the Gummy Bear Company in 2000 from his home in Vermont, USA.
Today, it is a multi-billion-dollar candy company operating in every continent. All of the company’s IT servers are located in Vermont. This year Joe hires his son Ben to join the company and head up Project Big, which is a major marketing strategy to triple gross revenue in just 5 years. Ben graduated with a PhD in computer software from a top university. Ben decided to join his father’s company, but is also secretly working on launching a new global online dating website company called Ben Knows Best.
Ben is aware that the Gummy Bear Company has millions of customers and believes that many of them might also be interested in finding their perfect match. For Project Big, Ben redesigns the company’s online web portal and requires customers in the European Union and elsewhere to provide additional personal information in order to remain a customer. Project Ben begins collecting data about customers’ philosophical beliefs, political opinions and marital status.
If a customer identifies as single, Ben then copies all of that customer’s personal data onto a separate database for Ben Knows Best. Ben believes that he is not doing anything wrong, because he explicitly asks each customer to give their consent by requiring them to check a box before accepting their information. As Project Big is an important project, the company also hires a first year college student named Sam, who is studying computer science to help Ben out.
Ben calls out and Sam comes across the Ben Knows Best database. Sam is planning on going to Ireland over Spring Beak with 10 of his friends, so he copies all of the customer information of people that reside in Ireland so that he and his friends can contact people when they are in Ireland.
Joe also hires his best friend’s daughter, Alice, who just graduated from law school in the U.S., to be the company’s new General Counsel. Alice has heard about the GDPR, so she does some research on it. Alice approaches Joe and informs him that she has drafted up Binding Corporate Rules for everyone in the company to follow, as it is important for the company to have in place a legal mechanism to transfer data internally from the company’s operations in the European Union to the U.S.
Joe believes that Alice is doing a great job, and informs her that she will also be in-charge of handling a major lawsuit that has been brought against the company in federal court in the U.S. To prepare for the lawsuit, Alice instructs the company’s IT department to make copies of the computer hard drives from the entire global sales team, including the European Union, and send everything to her so that she can review everyone’s information. Alice believes that Joe will be happy that she did the first level review, as it will save the company a lot of money that would otherwise be paid to its outside law firm.
In preparing the company for its impending lawsuit, Alice’s instruction to the company’s IT Department violated Article 5 of the GDPR because the company failed to first do what?

Send out consent forms to all of its employees.

Minimize the amount of data collected for the lawsuit.

Inform all of its employees about the lawsuit.

Encrypt the data from all of its employees.

NEW QUESTION 107
According to Article 84 of the GDPR, the rules on penalties applicable to infringements shall be laid down by?

The local Data Protection Supervisory Authorities.

The European Data Protection Board.

The EU Commission.

The Member States.

NEW QUESTION 108
A grade school is planning to use facial recognition to track student attendance. Which of the following may provide a lawful basis for this processing?

The school places a notice near each camera.

The school gets explicit consent from the students.

Processing is necessary for the legitimate interests pursed by the school.

A state law requires facial recognition to verify attendance.

NEW QUESTION 109
In which situation would GDPR principles prevail over principles of the EU Data Act?

When a cloud processing provider facilitates a switch to another provider.

When identifying a legal basis or legal bases for processing data.

When granting users access to data from connected products.

When the data in scope is considered personal data.

NEW QUESTION 110
Under Article 21 of the GDPR, a controller must stop profiling when requested by a data subject, unless it can demonstrate compelling legitimate grounds that override the interests of the individual. In the Guidelines on Automated individual decision-making and Profiling, the WP 29 says the controller needs to do all of the following to demonstrate that it has such legitimate grounds EXCEPT?

Carry out an exercise that weighs the interests of the controller and the basis for the data subject’s objection.

Consider the impact of the profiling on the data subject’s interest, rights and freedoms.

Demonstrate that the profiling is for the purposes of direct marketing.

Consider the importance of the profiling to their particular objective.

NEW QUESTION 111
An organization conducts body temperature checks as a part of COVID-19 monitoring. Body temperature is measured manually and is not followed by registration, documentation or other processing of an individual’s personal data.
Which of the following best explain why this practice would NOT be subject to the GDPR?

Body temperature is not considered personal data.

The practice does not involve completion by automated means.

Body temperature is considered pseudonymous data.

The practice is for the purpose of alleviating extreme risks to public health.

IAPP CIPP-E certification is a globally recognized credential that demonstrates an individual’s knowledge and expertise in the field of privacy and data protection within the European Union. Certified Information Privacy Professional/Europe (CIPP/E) certification is developed and administered by the International Association of Privacy Professionals and covers essential principles and practices of privacy and data protection. CIPP-E exam is comprehensive and covers various topics related to EU data protection laws and regulations, privacy frameworks and concepts, data processing and retention, and incident management and response.

Authentic Best resources for CIPP-E: https://www.prepawaypdf.com/IAPP/CIPP-E-practice-exam-dumps.html

More about Test

Related posts:

admin

You might also like

Leave a Reply Cancel reply