19 free IAPP CIPP/C practice questions from the CertStash pack of 76, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 19 free here, all 76 in the pack, and each step includes the one before it.
Get all 76 questions (US$39) · Download the first 10 as a PDF
Question 1
Which question is NOT part of the Office of the Privacy Commissioner of Canada’s (OPC’s) four-point test for establishing whether providing access to genetic testing results goes beyond what is necessary or reasonable?
Show answer and explanation
Correct answer: C. Are the validity and accuracy of individual test results guaranteed to be accurate?
The OPC's four-point test for genetic testing access focuses on necessity and reasonableness through: less privacy-invasive alternatives, proportionality of collection and use to benefits, and effectiveness in achieving legitimate business purposes. The guarantee of validity and accuracy of individual test results is not part of this established test framework; it addresses technical accuracy rather than privacy proportionality.
Why the other options are wrong
- A. This is one of the four questions in the OPC's test.
- B. This is one of the four questions in the OPC's test.
- D. This is one of the four questions in the OPC's test.
Question 2
What is required of a private sector organization that is subject to a finding by a Canadian federal or provincial Privacy Commissioner?
Show answer and explanation
Correct answer: A. In Québec, comply with the finding as a binding decision.
In Québec, findings by the Privacy Commissioner constitute binding decisions that organizations must comply with. This reflects Québec's distinct civil law framework and the authority granted to its commissioner under provincial privacy legislation. Other jurisdictions handle commissioner findings differently, typically through recommendations rather than binding orders.
Why the other options are wrong
- B. Provincial Privacy Commissioners also issue findings that organizations must address, not only the federal OPC.
- C. The 30-day requirement is not a standard across all jurisdictions for compliance with commissioner findings.
- D. Ontario does not require judicial review applications to accept or comply with commissioner findings; findings are typically implemented through organizational compliance, not court proceedings.
Question 3
After an investigation under the Privacy Act, the Privacy Commissioner could do any of the following EXCEPT?
Show answer and explanation
Correct answer: B. Order an institution to take remedial action if it determines that the Act has been breached.
Under the Privacy Act, the Commissioner cannot order an institution to take remedial action. The Commissioner's powers are investigative and recommendatory in nature. The Commissioner can proceed to federal court regarding improper withholding, recommend solutions to address shortcomings, and compel institutions to provide evidence during investigations, but lacks the statutory authority to issue binding remedial orders.
Why the other options are wrong
- A. The Commissioner can proceed to federal court to determine if information was improperly withheld.
- C. The Commissioner regularly recommends solutions to institutions based on investigation findings.
- D. The Commissioner has the power to compel oral or written evidence as part of the investigation process.
Question 4
In Ontario, personal information can be withheld from disclosure in a Freedom of Information (FOI) request. The following information is included in a record that is the subject of a FOI request being handled by a hospital: employee name, employee title, employee designation, employee educational history, employee personal cell phone number, and feedback about the employee from a colleague. Which of the following statements is accurate regarding what can be released?
Show answer and explanation
Correct answer: C. Employee name, title, and designation can be released as it is not classified as personal information.
Under Ontario's Freedom of Information Act, basic organizational information about employees, including name, title, and designation, is not classified as personal information and can be released without consent. This information relates to the employee's role within the organization rather than personal details. Personal information that would require protection includes personal cell phone numbers and subjective feedback, but the organizational identifiers are releasable.
Why the other options are wrong
- A. Employee name and title are organizational information and do not require consent for release.
- B. Employee designation is organizational information, not employment history, and is releasable.
- D. Not all employment-related information is withheld; organizational role information is distinguishable from protected personal information.
Question 5
In which instance is your personal information deemed publicly available?
Show answer and explanation
Correct answer: A. You belong to a professional body and your name exists on a registry that meets legal requirements.
Personal information is deemed publicly available when it appears in a professional registry maintained by a recognized professional body that meets legal requirements for public access. Such registries are designed for public consultation and serve a legitimate regulatory purpose. Information on volunteer contact lists, university application registers, and church donation lists are not publicly maintained registries meeting legal standards for public availability.
Why the other options are wrong
- B. A volunteer organization's internal contact list is not a public registry and does not constitute publicly available information.
- C. University admissions records are confidential institutional databases, not public registries, regardless of legal requirements.
- D. Church donation records maintained for tax receipt purposes are not public registries and remain protected personal information.
Question 6
According to the Alberta Personal Information Protection Act, which of the following data breach reporting notifications to the commissioner is NOT automatically triggered when real risk of significant harm (RROSH) has been determined?
Show answer and explanation
Correct answer: A. Providing a description of the steps the organization will take to notify the affected individual(s).
When real risk of significant harm (RROSH) is determined under the Alberta Personal Information Protection Act, notification to the commissioner must include description of steps taken to mitigate harm, number of individuals affected, and details of personal information involved. The description of future steps the organization will take to notify affected individuals is not automatically triggered; the trigger focuses on what has been done and what information was involved, not prospective notification plans.
Why the other options are wrong
- B. Steps already taken to reduce or mitigate harm must be reported when RROSH is determined.
- C. The estimate of affected individuals is a required element of RROSH notification.
- D. A description of the personal information involved in the breach is a required element of RROSH notification.
Question 7
In what situation is the federal Privacy Commissioner authorized to proceed to federal court?
Show answer and explanation
Correct answer: B. For a determination of whether or not personal information was properly withheld from release.
The federal Privacy Commissioner is authorized to proceed to federal court for determinations regarding whether personal information was properly withheld from release. This addresses disputes over access to information under federal privacy legislation and allows the Commissioner to seek judicial review when information has been improperly denied.
Why the other options are wrong
- A. Charter of Rights and Freedom determinations are not within the Privacy Commissioner's federal court jurisdiction.
- C. Administrative tribunal rulings fall outside the Privacy Commissioner's direct federal court authority.
- D. Provincial Privacy Commissioners' rulings are not subject to federal Privacy Commissioner federal court proceedings.
Question 8
What is the primary motivation for a federal government entity to complete a Privacy Impact Assessment (PIA)?
Show answer and explanation
Correct answer: B. Receiving program approvals from the Treasury Board of Canada.
Federal government entities conduct Privacy Impact Assessments primarily to receive program approvals from the Treasury Board of Canada. Treasury Board requires PIAs as part of its governance and approval process for programs involving personal information handling.
Why the other options are wrong
- A. PIAs are not the primary mechanism for introducing new legislation in the House of Commons.
- C. While the Privacy Commissioner provides guidance, obtaining expertise from them is not the primary motivation for completing a PIA.
- D. Improving collection methods is a secondary benefit, not the primary motivation driving PIA completion.
Question 9
A company wants to invest in DEI initiatives within their organization and plans to survey employees by asking for locality, age, salary, gender, ethnicity, religion, sexual orientation, physical/mental disabilities, department, and job level. The best solution to protect the personal information collected in the survey is to?
Show answer and explanation
Correct answer: D. Adjust all survey questions so that no identifying information can be collected.
The best solution is to adjust survey questions to eliminate the collection of identifying information altogether. This approach follows privacy-by-design principles and the minimization principle, avoiding the collection of sensitive personal data removes the risk entirely rather than trying to protect data that should not have been collected in the first place.
Why the other options are wrong
- A. Pseudonyms alone do not adequately protect the sensitive personal information being collected, as the data remains highly sensitive.
- B. The physical location of a survey tool does not address the fundamental issue of collecting excessive sensitive personal information.
- C. While encryption provides protection, collecting unnecessary sensitive data violates privacy minimization principles; encryption is a secondary control, not the best solution.
Question 10
What must an organization do to fulfill the Personal Information Protection and Electronic Documents Act’s (PIPEDA) transparency requirements when transferring personal information to a foreign country?
Show answer and explanation
Correct answer: C. Advise customers that their data may be accessed by another jurisdiction's courts or law enforcement.
PIPEDA's transparency requirements for international data transfers require organizations to advise customers that their personal information may be accessed by another jurisdiction's courts or law enforcement. This informs individuals of the risks associated with transferring data to foreign countries where different legal protections may apply.
Why the other options are wrong
- A. While consent is important, PIPEDA does not universally require soliciting additional consent for every foreign transfer; transparency about accessibility is the key requirement.
- B. PIPEDA does not grant existing customers an automatic right to refuse information transfer; the focus is on transparency rather than blocking transfers.
- D. PIPEDA does not require detailed comparative legal analysis; it requires practical transparency about the risks of foreign jurisdiction access.
Question 11
According to the Canadian Standards Association (CSA) Model Code, how long should personal information be retained?
Show answer and explanation
Correct answer: D. Personal information should be retained as long as necessary for the fulfillment of the purpose of the collection.
The CSA Model Code establishes that personal information should be retained only as long as it remains necessary to fulfill the original purpose for which it was collected. Once the purpose has been satisfied, the information should be disposed of or anonymized. This principle ensures that data minimization is maintained and unnecessary personal information is not retained indefinitely, balancing organizational needs with privacy protection.
Why the other options are wrong
- A. Complete non-retention is impractical and contradicts the legitimate business need to retain information for necessary purposes.
- B. Indefinite retention is contrary to CSA principles, which require retention only for as long as necessary.
- C. A fixed two-year retention period does not align with the CSA Model Code, which ties retention to purpose fulfillment rather than arbitrary timeframes.
Question 12
The Government of Canada’s Directive on Privacy Impact Assessments applies to all of the following EXCEPT?
Show answer and explanation
Correct answer: B. The Bank of Canada.
The Government of Canada's Directive on Privacy Impact Assessments applies to federal government institutions and their operations. The Bank of Canada, while a Crown Corporation, operates with separate governance and is not subject to this directive in the same manner as other federal government bodies. The Ministry of Health, other Crown Corporations within the federal structure, and Cabinet all fall under federal government privacy directives.
Why the other options are wrong
- A. The Ministry of Health is a federal government institution subject to the Privacy Impact Assessment directive.
- C. Most federal Crown Corporations are subject to the directive as agents of the Crown.
- D. The Cabinet, as part of federal government operations, is subject to privacy directives.
Question 13
Which health information custodians may NOT rely on an implied consent model under Ontario's Personal Health Information Protection Act (PHIPA)?
Show answer and explanation
Correct answer: A. Private insurance companies.
Under Ontario's Personal Health Information Protection Act, private insurance companies cannot rely on an implied consent model and must obtain express consent for collection and use of personal health information. Long-term care homes, ambulance services, and pharmacies are healthcare custodians that may rely on implied consent for health information collection in the course of providing healthcare services, as patients implicitly consent when seeking care.
Why the other options are wrong
- B. Long-term care homes are healthcare custodians that may rely on implied consent under PHIPA.
- C. Ambulance services are healthcare service providers that may rely on implied consent for health information collection.
- D. Pharmacies are regulated health professionals that may rely on implied consent for pharmacy-related health information.
Question 14
A new client is opening a Registered Retirement Savings Plan. Their investment advisor asks for their social insurance number (SIN). The advisor must tell the client that because they are opening a tax reporting product, their SIN is mandatory for tax reporting purposes and?
Show answer and explanation
Correct answer: A. Optional for identity verification purposes.
When opening an RRSP, a social insurance number is mandatory for tax reporting purposes as required by Canada Revenue Agency. However, the advisor must inform the client that the SIN is optional for identity verification purposes, as identity can be verified through other means; only tax reporting legally mandates its collection.
Why the other options are wrong
- B. Identity verification does not require a mandatory SIN; alternative identification methods are acceptable.
- C. Secondary marketing purposes cannot be cited as a reason for SIN collection; the client must be informed it is optional for such uses.
- D. SIN cannot be mandatory for secondary marketing purposes; clients must consent to marketing use separately from tax reporting requirements.
Question 15
What is required for a provincial law to be considered substantially similar to the Personal Information Protection and Electronic Documents Act (PIPEDA)?
Show answer and explanation
Correct answer: C. Consistency with the ten privacy principles, an independent oversight body and a redress mechanism.
A provincial law is deemed substantially similar to PIPEDA when it demonstrates consistency with all ten privacy principles, establishes an independent oversight body, and includes a redress mechanism for addressing privacy breaches and complaints. This three-part test ensures provincial legislation provides equivalent protection to federal standards.
Why the other options are wrong
- A. Requires consistency with only eight of ten principles, which is insufficient; PIPEDA requires all ten principles.
- B. Specifies a process for accessing information rather than a redress mechanism, which is not the correct third requirement.
- D. An appeal process is not the equivalent requirement; a redress mechanism is required instead of an appeal process.
Question 16
Why is biometric information considered sensitive personal information in almost all circumstances?
Show answer and explanation
Correct answer: C. It is distinctive, unlikely to vary over time, difficult to change and largely unique to the individual.
Biometric information is sensitive because it is distinctive to each individual, remains largely stable over time, is difficult or impossible to change, and is largely unique to the person. These characteristics make biometric data permanent identifiers that cannot be easily replaced if compromised, unlike passwords or other credentials.
Why the other options are wrong
- A. While biometric data is user-specific, the core sensitivity lies in its immutable nature rather than storage and access ease.
- B. Biometric data does not work by linking many pieces of information; it is inherently unique and standalone.
- D. The difficulty in recognizing and reproducing biometric data is the opposite of why it is sensitive; its relative immutability makes it valuable and risky.
Question 17
Which falls under the jurisdiction of the Personal Information Protection and Electronic Documents Act (PIPEDA)?
Show answer and explanation
Correct answer: C. Personal information disclosed across provincial or national borders by organizations such as credit reporting agencies or list marketers.
PIPEDA applies to personal information disclosed across provincial or national borders by organizations such as credit reporting agencies and list marketers, as these activities fall under federal jurisdiction regarding interprovincial and international commerce. PIPEDA explicitly exempts journalistic and artistic purposes, defers to substantially similar provincial legislation for health information, and excludes certain business contact information used solely for professional communication.
Why the other options are wrong
- A. PIPEDA contains an exemption for personal information collected for journalistic or artistic purposes.
- B. PIPEDA defers to provinces with substantially similar legislation regarding personal health information handled by private enterprises, creating a provincial carve-out.
- D. Business contact information such as names, titles, and contact details used only for workplace communication is typically excluded from PIPEDA coverage.
Question 18
How would an individual determine whether their personal information was used by the federal government for data matching?
Show answer and explanation
Correct answer: B. By noting the description of the Personal Information Banks available through Info Source.
Individuals can determine whether their personal information was used by the federal government for data matching by reviewing the description of Personal Information Banks available through Info Source, the federal government's public registry of personal information held by institutions. This is the official mechanism for understanding data matching activities. Other options either require initiative from third parties or do not provide specific data matching information.
Why the other options are wrong
- A. Third parties conducting data matching for government are not the appropriate channel for individuals to request this information.
- C. Proposing a Privacy Impact Assessment is not the mechanism for determining past data matching; PIAs are prospective tools.
- D. The Privacy Commissioner's annual report provides general oversight information but is not the specific resource for determining individual data matching.
Question 19
Which of the following specifically differentiates between regular personal information and employee-related or work-product information?
Show answer and explanation
Correct answer: C. British Columbia’s Personal Information Protection Act (PIPA).
British Columbia's Personal Information Protection Act expressly defines employee personal information and work product information as categories separate from ordinary personal information. It sets distinct rules for collecting, using and disclosing employee personal information, so it is the law that specifically draws this distinction.
Why the other options are wrong
- A. The federal Privacy Act governs federal government institutions and does not draw this distinction.
- B. Quebec's private sector act does not define separate categories for employee or work product information.
- D. PIPEDA does not define work product information or create a separate employee information category in the way BC PIPA does.
That was 19 of 76.
The full IAPP CIPP/C pack has all 76 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 38 free as one PDF by email. Get the Half Pack →