IAPP CIPP-C Certification Sample Questions

02. A customer complains to a privacy commissioner about the way a national retailer handled loyalty program information. What distinguishes the federal commissioner's authority from that of some provincial commissioners?
a) The federal commissioner issues binding orders, while provincial commissioners may only recommend.
b) The federal commissioner prosecutes offences, while provincial commissioners conduct audits.
c) The federal commissioner declares provincial statutes substantially similar, while provincial commissioners enforce PIPEDA.
d) The federal commissioner investigates and recommends, while some provincial commissioners issue binding orders.

03. A physician loses an unencrypted laptop holding patient names, test results, diagnoses, and treatment notes. What should the clinic do first?
a) Wait for evidence that someone actually opened the files.
b) Treat it as a breach and start the response plan.
c) Notify only the patients whose results were abnormal.
d) Log the loss in the equipment register.

04. A small business believes privacy law does not reach it because customer files are kept only on paper. Which response is most accurate?
a) Privacy law reaches only records held in automated databases.
b) Paper files are covered only when they hold financial details, such as account numbers.
c) Personal information recorded on paper can fall within privacy law.
d) Coverage begins after the files are scanned and loaded into a searchable system.

05. A business drafts its customer consent language by copying an EU template that speaks of controllers, processors, and data subjects. What is the strongest concern?
a) The wording relies on another regime's defined terms rather than Canadian consent expectations.
b) Consent collected through an online form is not recognized in Canada.
c) Imported wording is sufficient because the European standard is more demanding.
d) European terminology becomes mandatory once a Canadian business has European customers.

06. A hospital is a public body under its province's access and privacy statute and is also a custodian of personal health information. It is deciding which rules govern the identifiable treatment records its care team creates. Which law is most directly relevant?
a) The provincial access and privacy statute that applies to public bodies.
b) The federal private-sector privacy statute.
c) The provincial health information privacy statute for custodians.
d) The federal Privacy Act.

07. A retailer finds that customers send access requests to store staff, to a marketing address, and to social media accounts, and that many of those requests reach nobody able to answer them. Which privacy program weakness is most evident?
a) The organization lacks a reliable inventory of its systems and holdings.
b) The organization's privacy notice does not explain how requests are submitted.
c) The organization's retention schedule allows records to be disposed of too quickly.
d) The organization has not set a service standard for responding to access requests.

08. A physician group runs clinics in two provinces, each of which has its own health privacy legislation for custodians, and keeps one shared electronic record system hosted in a third province. Which statute governs the records created at each clinic?
a) The health privacy statute of the province where the care was provided.
b) The statute of the province where the record system is hosted.
c) Whichever provincial statute the group names in its own privacy policy.
d) The federal private-sector statute, because the records cross provincial boundaries.

09. A federal institution plans to use an automated model to rank benefit applicants for review, combining application data with earlier fraud-investigation records. What should the institution do first?
a) Obtain each applicant's express consent to the automated review.
b) Complete a privacy impact assessment and provide it to the Commissioner ahead of launch.
c) Confirm the investigation records will be held long enough to retrain the model, and extend the schedule.
d) Publish the model's scoring weights in its information inventory.

10. A privacy officer is deciding whether particular information should be treated as sensitive. Which factor is most useful in that judgment?
a) Whether the information was collected online or in person.
b) The number of individuals whose records are held.
c) The harm disclosure could cause in context.
d) The retention period and disposal method the organization has assigned.