• Home
• IAPP Exams
• CIPP-A - Certified Information Privacy Professional/Asia (CIPP/A)

CIPP-A IAPP Practice Test Questions and Exam Dumps

Question 1

In the Asia-Pacific Economic Cooperation (APEC) Privacy Framework, what exception is allowed to the Access and Correction principle?

A. Paper-based records
B. Publicly-available information
C. Foreign intelligence
D. Unreasonable expense

Answer: D

Explanation:
The APEC Privacy Framework is a guideline developed to promote a consistent level of protection for personal information among member economies. One of its core principles is the Access and Correction principle, which states that individuals should be given access to their personal data and be allowed to correct it where it is inaccurate or out-of-date.

However, the framework also acknowledges that absolute access may not always be practical or appropriate. Therefore, it permits specific exceptions to the right of access, and one such allowed exception is when providing access would impose an unreasonable expense on the organization or data controller.

This provision aims to maintain a balance between the individual's right to access their information and the legitimate operational burdens on organizations. For instance, if retrieving or compiling the data would require extraordinary effort, financial resources, or time due to the structure of the system, the organization may justifiably deny access based on this principle. However, this must be handled carefully and transparently, often with the burden of justification falling on the organization.

Let’s briefly consider the other options:

A. Paper-based records – The APEC Framework applies to both electronic and non-electronic forms of data. There is no specific exemption simply because records are in paper form.

B. Publicly-available information – While the framework addresses how publicly available data is handled, it doesn’t consider this an exception to Access and Correction rights. Individuals can still request corrections to inaccurate public data under many privacy regulations.

C. Foreign intelligence – While national security concerns, including intelligence operations, are often grounds for exceptions in domestic privacy laws, the APEC Framework itself doesn't cite foreign intelligence as a specific exception to Access and Correction. This is more commonly found in domestic security legislation.

In contrast, unreasonable expense is clearly acknowledged within the framework as a legitimate reason for denying access, provided the justification is reasonable and documented.

Therefore, the correct answer is D.

Question 2

What is the appropriate way to describe the privacy principles introduced in 1980 by the Organisation for Economic Cooperation and Development (OECD)?

A. Guidelines governing the protection of privacy and trans-border data flows issued in collaboration with the Federal Trade Commission.
B. Guidelines governing the protection of privacy and trans-border data flows of personal data in states that are members.
C. Mandatory rules governing the protection of privacy and trans-border data flows within the European Union.
D. Mandatory rules governing the protection of privacy and trans-border data flows among binding member states.

Answer: B

Explanation:
The Organisation for Economic Cooperation and Development (OECD) published a foundational document in 1980 titled Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. These guidelines were among the first major international efforts to set out comprehensive principles for the responsible handling of personal information in the context of a rapidly digitizing world.

Importantly, the OECD principles were intended to serve as non-binding guidelines, not mandatory rules. They were created to help member countries develop consistent privacy policies and to facilitate the free flow of information across borders while protecting individuals' privacy. This balanced approach was particularly significant because it recognized the tension between protecting privacy and encouraging international commerce in a globalized digital economy.

The guidelines apply to OECD member states and have been influential far beyond them, serving as a foundational model for numerous national and international data protection frameworks. They include eight core principles: Collection Limitation, Data Quality, Purpose Specification, Use Limitation, Security Safeguards, Openness, Individual Participation, and Accountability. These concepts have deeply influenced later privacy regulations, such as the EU’s GDPR and the APEC Privacy Framework.

Looking at the answer choices:

A is incorrect because the guidelines were not issued in collaboration with the U.S. Federal Trade Commission. While the FTC is a major data privacy enforcer in the U.S., it did not co-author the OECD principles.

C is incorrect because the OECD guidelines are not binding rules and do not apply exclusively within the European Union. The EU has its own separate and more stringent regulations, such as the GDPR, which is legally binding.

D is also incorrect because, again, the OECD guidelines are not mandatory. They are voluntary principles, and compliance is encouraged rather than enforced through law among member states.

B is the correct description. It correctly frames the OECD principles as guidelines—not binding legal rules—that relate to the protection of privacy and cross-border data flows of personal data, and that apply to member states of the OECD.

Thus, the most accurate characterization of the 1980 OECD privacy principles is that they are non-binding guidelines aimed at harmonizing privacy protection across different legal systems while supporting international data exchange.

Question 3

Which concept is NOT an element of Cross Border Privacy Rules (CBPR)?

A. Enforcement by Accountability Agents
B. Self-assessment against CBPR questionnaire
C. Consultation with Privacy Enforcement (PE) Authority
D. Dispute resolution via the Accountability Agent's compliance program

Answer: C

Explanation:
The Cross Border Privacy Rules (CBPR) system was developed by the Asia-Pacific Economic Cooperation (APEC) forum to ensure the protection of personal data as it moves across national borders within APEC member economies. The system is designed to promote consumer trust and business confidence by providing a framework for participating companies to demonstrate their compliance with agreed-upon privacy standards.

Several core elements define the CBPR system:

A. Enforcement by Accountability Agents – This is a critical feature of the CBPR system. Accountability Agents are third-party entities recognized by APEC member economies to evaluate and certify organizations based on their privacy practices. These agents also play a role in monitoring ongoing compliance and enforcement actions when necessary.

B. Self-assessment against CBPR questionnaire – Companies seeking certification under the CBPR must begin by completing a detailed self-assessment based on a standardized questionnaire. This questionnaire examines how their privacy practices align with the APEC Privacy Framework and the CBPR program requirements.

D. Dispute resolution via the Accountability Agent's compliance program – Another integral part of the CBPR system is the provision for dispute resolution. Individuals who believe their privacy rights have been violated can lodge complaints through the participating organization’s Accountability Agent. The agent is then responsible for managing and resolving these complaints in line with its established procedures.

Now consider C. Consultation with Privacy Enforcement (PE) Authority – This is not a formal or required element of the CBPR system. While PE Authorities, such as national privacy or data protection authorities, may have roles in enforcement or oversight in their respective jurisdictions, the CBPR structure does not include mandatory consultation with PE Authorities as a built-in step in the certification, compliance, or dispute resolution processes. The system is designed to function largely through Accountability Agents rather than direct government or regulatory body involvement in its day-to-day operations.

Thus, consultation with PE Authorities may occur under separate circumstances or under domestic law, but it is not considered an official, required component of the CBPR structure itself.

Therefore, the correct answer is C.

Question 4

Which term has been defined by the European Commission as referring to any information that concerns an individual who is either identified or can be identified?

A. Personally identifiable information
B. Sensitive information
C. Personal data
D. Identified data

Answer: C

Explanation:
Under European Union law, especially in the context of the General Data Protection Regulation (GDPR), the term personal data has a specific and carefully defined meaning. According to Article 4(1) of the GDPR, personal data refers to “any information relating to an identified or identifiable natural person.” This includes not only direct identifiers like a name or identification number but also indirect identifiers like location data, online identifiers (such as IP addresses), or factors specific to a person’s physical, physiological, genetic, mental, economic, cultural, or social identity.

The concept of "identifiable" is broad in EU law. A person is considered identifiable if they can be singled out from other individuals either directly or indirectly, particularly by reference to identifiers or combinations of data that make it possible to determine who they are. This means that even data that does not name someone outright—such as metadata, behavioral patterns, or device IDs—can be considered personal data if it can be reasonably linked back to a specific individual.

Looking at the answer options:

A. Personally identifiable information (PII) is a term commonly used in U.S. privacy law and regulation. While it shares a similar meaning with "personal data," its scope is generally narrower than how the GDPR defines personal data. PII often focuses on specific identifiers like names, Social Security numbers, or email addresses, but may not always include broader categories like online identifiers or inferred data.

B. Sensitive information typically refers to a subset of personal data that requires higher levels of protection due to its nature. Under the GDPR, this is known as “special categories of personal data” and includes information about racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, and so on. This term does not cover the full scope of what is meant by "any data that relates to an identified or identifiable individual."

D. Identified data is not a standard legal term under the GDPR or European Commission documents. It might informally describe data where the person is already identified, but it lacks the formal legal recognition and scope that “personal data” has.

Therefore, personal data is the precise term defined by the European Commission and codified in the GDPR to mean any data that can identify or be linked to an individual. It is a cornerstone concept in EU data protection law and serves as the foundation for understanding what kinds of data are regulated under the GDPR.

Hence, the correct answer is C.

Question 5

What personal information is considered sensitive in almost all countries with privacy laws?

A. Marital status
B. Health information
C. Employment history
D. Criminal convictions

Answer: B

Explanation:
In the context of global privacy laws, health information is widely recognized as a category of sensitive personal data. Most countries that have comprehensive data protection regulations—including those in Europe (GDPR), Asia-Pacific (APEC Framework), North America (such as HIPAA in the U.S.), and others—explicitly define health-related information as sensitive due to the personal and potentially stigmatizing nature of the data.

Sensitive personal data typically includes information that, if disclosed or misused, could result in significant harm or discrimination against an individual. Health data fits this definition because it relates to a person’s physical or mental condition, medical history, treatments, or diagnoses. As such, it is usually afforded stronger legal protections than other categories of personal data.

For example:

• The General Data Protection Regulation (GDPR) in the European Union designates health data as a special category of data that cannot be processed unless specific conditions are met.

• The Health Insurance Portability and Accountability Act (HIPAA) in the United States provides a regulatory framework to ensure the confidentiality and security of health records.

• Similarly, in jurisdictions such as Canada, Australia, and Japan, health data is subject to heightened protections under their respective privacy laws.

Now, let's consider the other options:

• A. Marital status is generally considered personal information but not typically classified as sensitive unless combined with other data or used in discriminatory contexts. It is often collected in demographic forms or surveys without triggering enhanced privacy protections.

• C. Employment history is also considered personal data, and while it should be handled securely, it is not generally treated as sensitive unless it includes other elements such as disciplinary actions or health-related employment information.

• D. Criminal convictions are considered sensitive in many jurisdictions, particularly in Europe under the GDPR, but not universally. Some countries place less legal emphasis on protecting this type of information compared to health data, depending on the nature of the offense or public safety interests.

In contrast, health information is the most consistently protected category of sensitive data worldwide due to its potential impact on privacy, dignity, and well-being. Regulatory frameworks around the world impose stricter conditions for the collection, processing, and sharing of health data than for other types of personal information.

Therefore, the correct answer is B.

Question 6

Which of the following jurisdictions was the earliest to recognize IP addresses as a form of personal information?

A. India
B. Hong Kong
C. The United States
D. The European Union

Answer: D

Explanation:
The European Union was the first jurisdiction to officially recognize IP addresses as personal information. This position was clarified and reinforced through both legal interpretation and formal regulatory guidance, particularly from European data protection authorities and courts.

The foundation for this recognition began with the EU Data Protection Directive (Directive 95/46/EC), which established the idea of “personal data” as information relating to an identified or identifiable individual. However, the matter of whether IP addresses fall under this definition was specifically addressed in later decisions.

A key development came from the Article 29 Working Party, an advisory body made up of representatives from the data protection authorities of each EU member state. In Opinion 4/2007, the Working Party concluded that IP addresses should generally be treated as personal data, especially in cases where an individual could be identified indirectly through the use of an IP address in conjunction with other data.

The most decisive confirmation came from the European Court of Justice (ECJ) in the case Patrick Breyer v. Germany (2016). In that ruling, the ECJ determined that dynamic IP addresses can qualify as personal data if the data controller (such as a website operator) has legal means to identify the data subject with the help of additional information held by an internet service provider. This was a landmark decision because it legally solidified the interpretation that both static and dynamic IP addresses are considered personal information under EU law.

By contrast:

A. India has been slower to formalize data protection laws. While it has proposed frameworks for personal data protection, recognition of IP addresses as personal data has not been as clearly or consistently articulated in legislation or court decisions.

B. Hong Kong has a well-established data protection regime under the Personal Data (Privacy) Ordinance (PDPO), but it did not lead the way in defining IP addresses as personal information. Its interpretations tend to align with or follow global trends rather than establish them.

C. The United States has a fragmented approach to privacy regulation. IP addresses may or may not be considered personally identifiable information (PII) depending on the context, state law, or specific regulation (e.g., under the California Consumer Privacy Act or certain federal guidelines), but the U.S. did not pioneer this recognition. The classification of IP addresses as personal information remains inconsistent across different U.S. jurisdictions.

Thus, the European Union was the first to formally treat IP addresses as personal data, making D the correct answer.

Question 7

In the area of human rights, what separates Singapore from many other Asian countries?

A. It is not a member of the Association of Southeast Asian Nations (ASEAN).
B. It has not signed the International Covenant on Civil and Political Rights.
C. It has not adopted the ASEAN Human Rights Declaration.
D. It is not a member of the United Nations.

Answer: B

Explanation:
Singapore stands out from many other Asian countries primarily because it has not signed the International Covenant on Civil and Political Rights (ICCPR). The ICCPR is a key international treaty that aims to protect civil and political rights, including freedoms of expression, assembly, and religion, as well as the right to a fair trial and democratic participation. Adopted by the United Nations in 1966, it is one of the foundational documents in the international human rights framework.

While many countries in Asia—such as Japan, South Korea, India, the Philippines, and others—have ratified or at least signed the ICCPR, Singapore has not done so. This positions it differently from a legal and international obligations standpoint when it comes to upholding civil and political rights.

Now let’s examine the other options:

• A. Singapore is a founding member of the Association of Southeast Asian Nations (ASEAN), so this statement is false. ASEAN plays a central role in regional cooperation across Southeast Asia, including limited engagement with human rights.

• C. Singapore has adopted the ASEAN Human Rights Declaration, along with other ASEAN member states. Although this declaration has been criticized for lacking strong enforcement mechanisms and containing loopholes, Singapore’s participation in it is not what separates it from other Asian nations.

• D. Singapore is a member of the United Nations. It joined the UN in 1965 shortly after gaining independence. Therefore, this statement is incorrect as well.

The most distinguishing factor, and the correct answer, is Singapore’s decision not to sign the ICCPR, which sets it apart in terms of international human rights commitments. This absence signifies that Singapore is not legally bound to the range of obligations the treaty entails, including those related to free speech, peaceful assembly, and democratic freedoms—rights that are often at the center of international human rights discussions. This has drawn attention from human rights advocates and international organizations, who often call for Singapore to align more closely with global norms on civil and political rights.

Therefore, the correct answer is B.

Question 8

Apart from the Personal Data Protection Act (PDPA), which of the following could serve as a source of privacy protection for individuals living in Singapore?

A. Constitutional protections of personal information
B. International agreements protecting privacy
C. The tort of invasion of privacy
D. Breach of confidence law

Answer: D

Explanation:
While the Personal Data Protection Act (PDPA) is the main statutory framework in Singapore that governs the collection, use, and disclosure of personal data, there are also other legal avenues that provide certain degrees of privacy protection. Among these, the law of breach of confidence stands out as a key supplementary source.

The breach of confidence doctrine in Singapore arises from common law and is recognized by the courts as a way to protect private or confidential information that has been improperly disclosed. This legal principle is used in both commercial and personal contexts. For example, if someone shares private information in a setting where confidentiality is either implied or explicitly agreed upon, and that information is later disclosed without permission, the person harmed could potentially bring a claim under breach of confidence.

This common law principle requires three elements to be satisfied:

1. The information must have the necessary quality of confidence.

2. The information must have been communicated in circumstances importing an obligation of confidence.

3. There must be unauthorized use or disclosure of the information.

In contrast:

A. Constitutional protections of personal information do not exist in Singapore. The Singapore Constitution does not contain an explicit right to privacy or personal data protection. The courts have been reluctant to recognize broad constitutional privacy rights in the absence of specific legislative provisions.

B. International agreements protecting privacy may influence policy or inspire legal reforms, but they do not generally have direct legal effect in Singapore unless they are incorporated into domestic law. Singapore's legal system does not automatically apply international treaties unless they are formally adopted through local legislation.

C. The tort of invasion of privacy is not recognized as an independent cause of action in Singapore. While it is a valid tort in some jurisdictions (like the United States), Singapore courts have historically rejected the recognition of a standalone privacy tort. They have instead relied on other legal constructs, such as breach of confidence or defamation, to handle cases involving privacy interests.

Therefore, the only option among the four that is actively recognized under Singapore law as a valid legal route for protecting private information—apart from the PDPA—is breach of confidence law.

This makes D the correct answer.

Question 9

Which of the following would NOT be exempt from Singapore’s PDPA?

A. A government automobile registration website.
B. A private party room at a popular restaurant.
C. A documentary filmed at a rock concert.
D. A video from a store's closed-circuit TV.

Answer: D

Explanation:
Singapore’s Personal Data Protection Act (PDPA) governs how organizations collect, use, disclose, and care for personal data. However, it includes several exemptions for specific contexts, particularly where personal data is collected for personal, artistic, journalistic, or governmental purposes.

Let’s look at the exemptions in detail before explaining why option D is the correct answer.

• A. A government automobile registration website: Government agencies are exempt from the PDPA. The PDPA only applies to private sector organizations. Therefore, any data processing or collection carried out by a government department, such as through an automobile registration portal, is not subject to the PDPA. This is explicitly stated in Section 4(1)(c) of the PDPA.

• B. A private party room at a popular restaurant: If the personal data collected here is done for personal or domestic purposes, the activity may be exempt from the PDPA. Section 4(1)(b) of the PDPA notes that individuals who collect, use, or disclose personal data for personal or domestic purposes are exempt. For example, someone filming a private birthday party for personal memories would not be held to PDPA requirements.

• C. A documentary filmed at a rock concert: If this activity is conducted for artistic or journalistic purposes, it falls under one of the exclusions of the PDPA. The law allows such uses of personal data in situations where the primary intent is media, art, or journalism. So, footage of concert-goers that appears in a documentary would likely be exempt under the journalism or artistic purpose clause.

• D. A video from a store’s closed-circuit TV (CCTV): This option does not fall under any of the PDPA exemptions. A retail store is a private organization, and the use of CCTV to monitor customers or employees constitutes the collection of personal data. Under the PDPA, organizations that deploy CCTV are required to inform individuals that video surveillance is taking place and must handle the data in accordance with data protection obligations, including securing it properly and using it only for stated purposes.

This makes option D unique among the choices—it involves an organization (not a government agency, individual, or artist/journalist) collecting personal data in a context that is explicitly covered by the PDPA. Stores must comply with notice and consent provisions, data protection principles, and reasonable security safeguards when using CCTV.

Therefore, the correct answer is D.

Question 10

In the situation where Delilah voluntarily gives her business card to Evan, who then adds her contact details to Good Mining’s business development database, what legally justifies this action under Singapore's data protection laws?

A. Because Delilah "consented" to her business contact information being used by Good Mining by passing it to Evan voluntarily.
B. Because any business contact information can be freely used, collected or disclosed by Good Mining.
C. Because Good Mining does not export the information to a cloud vendor.
D. Because Delilah initiated the relationship with Good Mining.

Answer: A

Explanation:
Under Singapore’s Personal Data Protection Act (PDPA), the collection, use, and disclosure of personal data generally require the individual's consent, whether it is expressed or implied. However, the law also recognizes certain exceptions for the collection of business contact information, which includes names, telephone numbers, email addresses, and other details that identify a person in a professional capacity.

In this scenario, Delilah gives Evan her business card voluntarily. This act can reasonably be interpreted as implied consent for Evan, and by extension Good Mining, to use her business contact information for purposes that are consistent with professional communication. This includes adding her contact information to a database for client or networking events, as long as it is used in the context of business development or outreach.

Let’s examine the options one by one:

A. This is the correct answer. By voluntarily handing her business card to Evan, Delilah gives implied consent for the use of her business contact information for professional communication. The PDPA recognizes that such contact details provided in a business context may be used without express written consent, as long as the use is reasonable and in line with the purpose for which the information was provided.

B. This is incorrect. While business contact information may not always require full express consent, it cannot be “freely” used without regard to purpose. The PDPA still requires that the use be reasonable and aligned with the individual's expectations at the time the data was provided. Businesses are still responsible for ensuring they don't use the data in ways that are misleading or beyond the original intent.

C. This is irrelevant. Whether or not the data is stored on a local server or exported to the cloud has no bearing on the lawfulness of collection and use. Data residency or storage location might have implications for security or data export rules, but not for consent-based collection in this context.

D. This is incorrect. While Delilah applied for a job and therefore engaged with the company, that engagement was specific to a job application, not a marketing or business networking relationship. The handing over of the business card—separate from the job application process—is the relevant action that signifies implied consent to use her business contact details.

Therefore, the most legally accurate reason that Evan can add Delilah’s business card information to the company’s development database is that she voluntarily provided the information, signaling implied consent for its reasonable professional use.

The correct answer is A.

Related Exams

• AIGP - Artificial Intelligence Governance Professional
• CIPP-US - Certified Information Privacy Professional/United States (CIPP/US)
• CIPM - Certified Information Privacy Manager
• CIPP-E - Certified Information Privacy Professional/Europe (CIPP/E)
• CIPT - Certified Information Privacy Technologist (CIPT)
• CIPP-A - Certified Information Privacy Professional/Asia (CIPP/A)
• CIPP-C - Certified Information Privacy Professional/Canada (CIPP/C)