IAPP CIPP/C Exam Practice Questions, practice question pack
IAPP · CIPP/C

IAPP CIPP/C Exam Practice Questions

76 questionsPDF by emailUpdated September 2026

US$39

Try 10 questions free

Card, Apple Pay or Google Pay. Your PDF is sent by email as soon as you check out.

Pass or your money backFail the exam after using this pack and we refund it. How the guarantee works
Category:
TRY BEFORE YOU BUY

Three of the 76 questions in this pack

Question 1

In Ontario, a patient attends an appointment with a physician and reveals information about some new symptoms that she has been experiencing. Based on this information, the physician diagnoses the patient with a condition and prepares the report detailing the applicable history and diagnosis. The report is added to the patient’s record. The patient later regrets revealing certain facts and doesn’t want anyone else to know about these symptoms or the diagnosis. She acknowledges that the information she provided was correct and does not question the diagnosis. Which of the following requests would the patient be most successful at pursuing?

  1. That a correction be made to change the diagnosis based on the patient’s wishes.
  2. That the information be restricted from disclosure to other health care providers.
  3. That a copy of the record be kept by the patient for disclosure to physicians.
  4. That details of the diagnosis be deleted from the patient’s health record.
Show answer and explanation

Correct answer: B. That the information be restricted from disclosure to other health care providers.

other health care providers. Under Ontario's health privacy legislation, patients have the right to request restrictions on the disclosure of their health information to other parties, even if the diagnosis itself is accurate. The patient cannot compel deletion of accurate diagnostic information from the record, nor can she change a correct diagnosis based on her wishes after acknowledging the information was accurate. Restricting disclosure to other healthcare providers is a recognized patient right that balances privacy interests with the necessity of maintaining accurate medical records.

Why the other options are wrong

  • A. A patient cannot force correction of accurate diagnostic information based solely on personal preference or regret.
  • C. While patients may request copies of their records, this does not address the patient's primary concern about limiting access to this sensitive information.
  • D. Accurate medical information cannot be deleted from health records; patients may only restrict access to it, not erase it.

Question 2

The Government of Canada’s Directive on Privacy Impact Assessments applies to all of the following EXCEPT?

  1. The Ministry of Health
  2. The Bank of Canada.
  3. Crown Corporations.
  4. The Cabinet.
Show answer and explanation

Correct answer: B. The Bank of Canada.

The Government of Canada's Directive on Privacy Impact Assessments applies to federal government institutions and entities under federal jurisdiction. The Bank of Canada, while a Crown Corporation established by federal legislation, operates as an independent central bank and is not subject to the same Treasury Board directives that apply to government departments and most Crown Corporations engaged in government business. The Ministry of Health, Crown Corporations involved in government operations, and the Cabinet are all subject to the directive.

Why the other options are wrong

  • A. The Ministry of Health, as a federal government department, is subject to the directive.
  • C. Crown Corporations engaged in government business are subject to the Privacy Impact Assessment Directive.
  • D. The Cabinet and its operations fall under federal government privacy directives.

Question 3

Which falls under the jurisdiction of the Personal Information Protection and Electronic Documents Act (PIPEDA)?

  1. Personal information collected by private businesses for journalistic or artistic purposes.
  2. Personal health information (PHI) handled by private enterprises in provinces that have adopted substantially similar legislation.
  3. Personal information disclosed across provincial or national borders by organizations such as credit reporting agencies or list marketers.
  4. Personal information such as names, titles and contact information used by businesses to communicate with employees regarding their profession.
Show answer and explanation

Correct answer: C. Personal information disclosed across provincial or national borders by organizations such as credit reporting agencies or list marketers.

national borders by organizations such as credit reporting agencies or list marketers. PIPEDA applies to personal information disclosed across provincial or national borders by organizations such as credit reporting agencies and list marketers engaged in commercial activities. This is a core application of PIPEDA's interprovincial and international scope. Options A and B are excluded from PIPEDA (journalistic purposes and provincial health information legislation respectively), and Option D relates to employee contact information in a professional context, which may fall outside PIPEDA depending on specific circumstances, but cross-border commercial data flows are clearly within PIPEDA's jurisdiction.

Why the other options are wrong

  • A. Personal information collected for journalistic or artistic purposes is explicitly excluded from PIPEDA.
  • B. Personal health information handled by private enterprises in provinces with substantially similar legislation is excluded under PIPEDA's provincial exemption.
  • D. Employee contact information used for professional communications may not constitute personal information requiring PIPEDA protection in certain contexts.

See all 10 free questions Get the full pack, US$39

76 practice questions for IAPP Certified Information Privacy Professional/Canada (CIPP/C), with full explanations.

Every question comes with the correct answer, the reasoning behind it, and a short note on why each wrong option is wrong. Work through it once with the answers, then again with the questions-only copy under exam conditions.

  • 76 questions mapped to the CIPP/C Body of Knowledge and exam blueprint
  • Answers and explanations for every question, including the wrong options
  • A questions-only PDF for timed practice runs
  • Instant delivery by email the moment you check out
  • Free monthly updates for as long as the exam is live
  • Pass or your money back

A CIPP/C attempt costs US$550 (US$375 for a retake). This pack is US$39, paid once.

Try 10 questions free before you buy.

Last updated September 2026 · 76 questions

What makes the CIPP/C hard

CIPP/C is the Canadian concentration of IAPP’s privacy professional certification: 90 questions in 150 minutes with an optional 15 minute break, 75 scored and 15 unscored pilot items, and a pass mark of 300 on the 100 to 500 scale. IAPP refreshes the Body of Knowledge every year, and recent revisions have leaned into Quebec’s Law 25, now the strictest private sector regime in the country and the source of a growing share of the harder questions.

The exam is built around the split between federal and provincial, and between private and public sector. The private sector side covers PIPEDA and its ten fair information principles, the substantially similar provincial statutes in Quebec, Alberta and British Columbia, the Digital Privacy Act’s breach reporting requirements, CASL, and Quebec’s Law 25 obligations around privacy impact assessments, consent, automated decision making and cross border transfers. The public sector side covers the federal Privacy Act and Access to Information Act, the provincial freedom of information statutes, and health privacy laws such as Ontario’s PHIPA.

Scenario questions typically describe an organisation, a data flow or a complaint and ask which law and which principle applies, so the fastest gains come from knowing which statute governs each combination of sector, province and data type.

About the exam

CIPP/C is IAPP’s Canadian privacy law certification. It covers the Canadian privacy environment, federal and provincial private sector privacy law including PIPEDA, Quebec’s Law 25 and the Alberta and BC PIPAs, public sector and health privacy law, anti-spam law, breach notification, and the roles and powers of the privacy commissioners and courts. There are no prerequisites.

Exam domains

  • The Canadian privacy environment and legal framework
  • Federal private-sector privacy law: PIPEDA and CASL
  • Provincial private-sector privacy law: Quebec Law 25, Alberta PIPA, BC PIPA
  • Public-sector privacy and access laws, federal and provincial
  • Health information privacy laws
  • Regulators, enforcement, breach notification and cross-border data flows

IAPP publishes a question range per domain rather than percentages.

90 multiple-choice questions (75 scored), 150 minutes plus an optional 15-minute break, pass mark 300 on a 100 to 500 scale, US$550 per attempt (US$375 for a retake), Pearson VUE test centre or OnVUE online, maintained with 20 CPE credits per two-year term.

Reviews

There are no reviews yet.

Only logged in customers who have purchased this product may leave a review.

Questions before you buy

What do I get when I buy the IAPP CIPP/C pack?

76 practice questions as a PDF, each with the correct answer, a full explanation and a note on why the other options are wrong, plus a separate questions-only PDF for timed practice.

How quickly do I receive it?

Your PDF is prepared and sent to your email address after checkout, and you get a confirmation as soon as it is on its way.

Is there a free sample?

Yes. Ten questions from this pack, with answers and explanations, are free on this page and as a PDF, so you can judge the quality before you pay.

Are updates included?

Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.

What if I fail the exam?

We refund the pack. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.

Can I share it with colleagues?

Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.

Related products