IAPP cipp-a practice test

Certified Information Privacy Professional/Asia (CIPP/A)

Last exam update: Nov 18 ,2025
Page 1 out of 6. Viewing questions 1-15 out of 90

Question 1

In the Asia-Pacific Economic Cooperation (APEC) Privacy Framework, what exception is allowed to
the Access and Correction principle?

  • A. Paper-based records.
  • B. Publicly-available information.
  • C. Foreign intelligence.
  • D. Unreasonable expense.
Mark Question:
Answer:

B


Reference:
https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwj5zqzzs_jwAh
XDRBUIHUjACjcQFjAAegQIBhAD&url
=https%3A%2F%2Fwww.apec.org%2F-%2Fmedia%2FAPEC%2FPublications%2F2005%2F12%2FAPEC-
Privacy-Framework%2F05_ecsg_privacyframewk.pdf&usg=AOvVaw0O1-P2AWJ-BA0TYPGcIJgD

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 2

How can the privacy principles issued in 1980 by the Organisation for Economic Cooperation and
Development (OECD) be defined?

  • A. Guidelines governing the protection of privacy and trans-border data flows issued in collaboration with the Federal Trade Commission.
  • B. Guidelines governing the protection of privacy and trans-border data flows of personal data in states that are members.
  • C. Mandatory rules governing the protection of privacy and trans-border data flows within the European Union.
  • D. Mandatory rules governing the protection of privacy and trans-border data flows among binding member states.
Mark Question:
Answer:

B


Reference:
https://www.oecd.org/sti/ieconomy/oecd_privacy_framework.pdf
(page 3)

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 3

Which concept is NOT an element of Cross Border Privacy Rules (CBPR)?

  • A. Enforcement by Accountability Agents.
  • B. Self-assessment against CBPR Question:naire.
  • C. Consultation with Privacy Enforcement (PE) Authority.
  • D. Dispute resolution via the Accountability Agent's compliance program.
Mark Question:
Answer:

B


Reference:
https://www.apec.org/About-Us/About-APEC/Fact-Sheets/What-is-the-Cross-Border-
Privacy
- Rules-System

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 4

What term is defined by the European Commission to mean any data that relates to an identified or
identifiable individual?

  • A. Personally identifiable information.
  • B. Sensitive information.
  • C. Personal data.
  • D. Identified data.
Mark Question:
Answer:

C


Reference:
https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 5

What personal information is considered sensitive in almost all countries with privacy laws?

  • A. Marital status.
  • B. Health information.
  • C. Employment history.
  • D. Criminal convictions.
Mark Question:
Answer:

B


Reference:
https://www.burges-salmon.com/news-and-insight/legal-updates/gdpr-personal-data-
and-sensitive- personal-data/

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 6

Which jurisdiction was the first to consider IP addresses to be personal information?

  • A. India.
  • B. Hong Kong.
  • C. The United States.
  • D. The European Union.
Mark Question:
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 7

In the area of human rights, what separates Singapore from many other Asian countries?

  • A. It is not a member of the Association of Southeast Asian Nations (ASEAN).
  • B. It has not signed the International Covenant on Civil and Political Rights.
  • C. It has not adopted the ASEAN Human Rights Declaration.
  • D. It is not a member of the United Nations.
Mark Question:
Answer:

B


Reference:
https://www.fidh.org/en/region/asia/singapore/government-s-response-to-un-review-a-
major- setback-for-human-rights

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 8

Besides the Personal Data Protection Act (PDPA), which of the following is a potential source of
privacy protection for Singapore citizens?

  • A. Constitutional protections of personal information.
  • B. International agreements protecting privacy.
  • C. The tort of invasion of privacy.
  • D. Breach of confidence law.
Mark Question:
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 9

Which of the following would NOT be exempt from Singapore’s PDPA?

  • A. A government automobile registration website.
  • B. A private party room at a popular restaurant.
  • C. A documentary filmed at a rock concert.
  • D. A video from a store's dosed-circuit TV.
Mark Question:
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 10

SCENARIO – Please use the following to answer the next QUESTION:
Delilah is seeking employment in the marketing department of Good Mining Private Limited, an
industry leader in drilling mines in Singapore. Delilah, while filling in the standard paper application
form, is asked to provide details about emergency contacts, medical history, blood type and her
insurance policy. These fields need to be filled in no matter which department Delilah applies to. The
form also asks Delilah to expressly consent to the collection, use and disclosure of her personal data.
A week after submitting the form, Delilah is invited by Evan, the Director of Marketing at Good
Mining, to coffee. Just before Delilah leaves, she gives her business card containing her current
business contact information to Evan. Evan then uses the business card to add Delilah's details to
Good Mining's business development database, which is kept on a local server. Good Mining uses the
database to inform people about networking and client events that Good Mining organizes.
Why is it legal for Evan to add the information on Delilah's business card to the business
development
database?

  • A. Because Delilah "consented" to her business contact information being used by Good Mining by passing it to Evan voluntarily.
  • B. Because any business contact information can be freely used, collected or disclosed by Good Mining.
  • C. Because Good Mining does not export the information to a cloud vendor.
  • D. Because Delilah initiated the relationship with Good Mining.
Mark Question:
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 11

SCENARIO – Please use the following to answer the next QUESTION:
Delilah is seeking employment in the marketing department of Good Mining Private Limited, an
industry leader in drilling mines in Singapore. Delilah, while filling in the standard paper application
form, is asked to provide details about emergency contacts, medical history, blood type and her
insurance policy. These fields need to be filled in no matter which department Delilah applies to. The
form also asks Delilah to expressly consent to the collection, use and disclosure of her personal data.
A week after submitting the form, Delilah is invited by Evan, the Director of Marketing at Good
Mining, to coffee. Just before Delilah leaves, she gives her business card containing her current
business contact information to Evan. Evan then uses the business card to add Delilah's details to
Good Mining's business development database, which is kept on a local server. Good Mining uses the
database to inform people about networking and client events that Good Mining organizes.
Why is Good Mining Private's standard form NOT compliant with Singapore's data protection law?

  • A. It is not available in an electronic format.
  • B. It does not contain the contact information for the HR manager.
  • C. It asks for Delilah's consent to use and disclose her personal data.
  • D. It asks for details that are not relevant to the job Delilah is applying for.
Mark Question:
Answer:

D

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 12

Which of the following does Singapore's PDPC NOT have the power to do?

  • A. Order an organization to stop collecting personal data.
  • B. Order an organization to destroy collected personal data.
  • C. Order an organization to award compensation to a complainant.
  • D. Order an organization to pay a financial penalty to the government.
Mark Question:
Answer:

D


Reference:
https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Advisory-Guidelines/Advisory-
Guidelines- on-Enforcement-of-DP-Provisions-1-Feb-2021.pdf?la=en

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 13

SCENARIO – Please use the following to answer the next QUESTION:
Singabank is a boutique bank in Singapore. After being notified during the hiring process, Singabank
employees are subject to constant and thorough monitoring and tracking through CCTV cameras,
computer monitoring software and keyboard loggers. Singabank does this to ensure its employees
are complying with Singabank's data security policy. Bigbank is now considering acquiring
Singabank's retail banking division. As part of its due diligence, Bigbank is seeking for Singabank to
disclose to it all of its surveillance material on its employees, whether or not they are part of the
retail banking division. Jimmy works in Singabank's investment banking division.
What would make Singabank's monitoring of its employees illegal?

  • A. If the employees did not explicitly consent to it.
  • B. If the bank's data security policy was being overhauled.
  • C. If the bank collected employees' sensitive personal information.
  • D. If the employees were not provided contact information to ask Question:s about the monitoring.
Mark Question:
Answer:

A

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 14

SCENARIO – Please use the following to answer the next QUESTION:
Singabank is a boutique bank in Singapore. After being notified during the hiring process, Singabank
employees are subject to constant and thorough monitoring and tracking through CCTV cameras,
computer monitoring software and keyboard loggers. Singabank does this to ensure its employees
are complying with Singabank's data security policy. Bigbank is now considering acquiring
Singabank's retail banking division. As part of its due diligence, Bigbank is seeking for Singabank to
disclose to it all of its surveillance material on its employees, whether or not they are part of the
retail banking division. Jimmy works in Singabank's investment banking division.
Assuming the monitoring was legal, can Singabank disclose Jimmy's personal data to Bigbank?

  • A. No, because Jimmy is not in the division that Bigbank seeks to acquire.
  • B. No, because the data was collected for the express purpose of complying with Singabank's privacy policies.
  • C. Yes, if Singabank informs Jimmy of the disclosure of his personal data before it occurs.
  • D. Yes, if Jimmy's personal data is necessary for Bigbank to determine whether to proceed with the acquisition.
Mark Question:
Answer:

C

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000

Question 15

In which of the following cases would a Singaporean be prevented from accessing information about
herself from an organization?

  • A. The information was collected in the previous 12 months.
  • B. The information is related to an individual's credit rating.
  • C. The cost of providing the information proved to be unreasonable.
  • D. Any personal information about others has been deleted from the document.
Mark Question:
Answer:

B

User Votes:
A
50%
B
50%
C
50%
D
50%
Discussions
vote your answer:
A
B
C
D
0 / 1000
To page 2