CIPP/E Practice Test

CIPP/E practice test: what's covered

• GDPR
• Data Subject Rights
• Lawful Bases
• International Transfers
• Accountability
• Compliance

Free CIPP/E sample questions

1. A privacy team is tracing the legal lineage of the modern EU data protection framework. Which instrument, drafted by the Council of Europe and signed in 1981, was the first binding international treaty dealing specifically with the automatic processing of personal data?

   • A. Convention 108
   • B. The OECD Privacy Guidelines
   • C. The Data Protection Directive 95/46/EC
   • D. The Charter of Fundamental Rights of the European Union
   Show answer

   Correct: A. Council of Europe Convention 108 (1981) was the first legally binding international instrument on automated processing of personal data. The OECD Guidelines (1980) are influential but non-binding; the 95/46/EC Directive came in 1995; the Charter became binding only with the 2009 Treaty of Lisbon.

2. During a GDPR briefing, a compliance officer is asked which body issued the European Convention on Human Rights (ECHR) — whose Article 8 protects the right to respect for private and family life. Which institution is responsible for the ECHR and the court that enforces it?

   • A. The Council of Europe and the European Court of Human Rights
   • B. The European Union and the Court of Justice of the European Union
   • C. The United Nations and the International Court of Justice
   • D. The European Commission and the European Data Protection Board
   Show answer

   Correct: A. The ECHR is a Council of Europe instrument enforced by the European Court of Human Rights (ECtHR) in Strasbourg. The CJEU is an EU institution interpreting EU law; it is distinct from the ECtHR. Article 8 ECHR underpins the privacy right that later informed the GDPR.

3. A policy analyst is mapping the EU's ordinary legislative procedure for data protection law. Which TWO institutions act as the co-legislators that jointly amend and adopt the legislation proposed by the European Commission? (Choose TWO)

   • A. The European Parliament
   • B. The Council of the European Union
   • C. The Court of Justice of the European Union
   • D. The European Court of Human Rights
   • E. The European Data Protection Board
   Show answer

   Correct: A and B. Under the ordinary legislative procedure, the European Parliament and the Council of the EU are the co-legislators that amend and adopt legislation proposed by the Commission (which holds the right of initiative). The CJEU adjudicates, the ECtHR enforces the ECHR, and the EDPB ensures consistent GDPR application — none are legislators.

4. The GDPR is an EU Regulation rather than a Directive. For a multinational establishing its EU data strategy, what is the most significant legal consequence of this choice of instrument?

   • A. It is directly applicable in all Member States without requiring national transposition
   • B. Each Member State must pass its own implementing law before it takes effect
   • C. It applies only to EU-headquartered companies
   • D. It can be enforced only by the European Commission, not national authorities
   Show answer

   Correct: A. A Regulation is directly applicable across the EU on its entry into force, creating uniform rules without transposition (unlike a Directive such as 95/46/EC). National DPAs enforce it, and it applies extraterritorially under Article 3, not only to EU-based firms.

5. A telecom marketer planning an email and cookie campaign in the EU asks which legal instrument specifically governs unsolicited electronic communications and the use of cookies, sitting alongside the GDPR. Which is it?

   • A. The ePrivacy Directive 2002/58/EC
   • B. The NIS 2 Directive
   • C. The EU Artificial Intelligence Act
   • D. The Electronic Commerce Directive 2000/31/EC
   Show answer

   Correct: A. The ePrivacy Directive (2002/58/EC, as amended) governs confidentiality of communications, cookies and unsolicited direct marketing. NIS 2 addresses cybersecurity; the AI Act governs AI systems; the e-Commerce Directive covers information-society services and liability.

Last updated: 2026-10-19

CIPP/E practice test FAQ