IAPP CIPP-C Certification Sample Questions

02. A privacy officer is assessing whether a privacy issue involves “sensitive” information. Which factor is most useful?
a) Server brand and version.
b) File size and format.
c) Context and potential harm.
d) Department budget level.

03. Which statement best describes the role of the Office of the Privacy Commissioner of Canada?
a) It enacts provincial privacy laws and imposes criminal penalties.
b) It investigates complaints and promotes compliance with federal privacy laws
c) It approves all Canadian privacy policies before organizations publish them.
d) It replaces provincial commissioners whenever health information is involved.

04. A physician loses an unencrypted laptop containing patient names, test results, diagnoses, and treatment notes. What should the clinic do first?
a) Activate breach response.
b) Wait for media reports.
c) Delete incident records.
d) Blame the laptop vendor.

05. A business uses customer consent language copied from an EU template that refers to “controllers,” “processors,” and “data subjects.” What is the best CIPP/C-aligned concern?
a) Canadian law bans privacy notices.
b) EU terms are required in Canada.
c) Consent cannot be written online.
d) The terminology may confuse users.

06. An Ontario hospital is deciding which privacy law governs the collection, use, and disclosure of identifiable patient records by its care team. Which law is most directly relevant?
a) Federal CASL.
b) Ontario PHIPA.
c) Alberta PIPA.
d) EU GDPR.

07. A marketing team wants to scrape online posts and combine them with purchase records to create customer profiles. What should the privacy officer emphasize?
a) Public availability is not enough.
b) Scraped data is always anonymous.
c) Online posts are never regulated.
d) Purchase records cancel consent.

08. An organization keeps personal information for many years because “storage is cheap and old records may be useful.” What is the strongest privacy concern?
a) Cheap storage removes privacy risk.
b) Long retention always improves accuracy.
c) Retention may exceed identified purposes.
d) Old records become non-personal data.

09. A small business believes privacy laws do not apply because it stores customer files only on paper. Which response is most accurate?
a) Privacy law applies only to automated databases.
b) Paper records may still be regulated if they contain personal information.
c) Paper records are regulated only if they include financial information.
d) Privacy law applies only after paper records are scanned.

10. A department wants to use artificial intelligence to rank benefit applicants for review. The model will combine application data with previous fraud-investigation records. What should the department prioritize?
a) Removal of all audit logs.
b) Immediate silent deployment.
c) Privacy and fairness review.
d) Public posting of scores.