Free CIPP-C Questions for IAPP Certified Information Privacy Professional/ Canada (CIPP/C) CIPP-C Exam as PDF & Practice Test Engine

Exam Code/Number: CIPP-C
Exam Name/Title: Certified Information Privacy Professional/ Canada (CIPP/C)
Certification Provider: IAPP
Corresponding Certification: Certified Information Privacy Professional

Exam Questions: 78
Updated On: Jul 09, 2026

Question #1

What is required through the "circle of care" concept under Canadian health information privacy law?

A. Health information custodians or trustees be specified only by applicable law or regulation

B. Notification to the individual be made in the event of a data breach of personal health information (PHI) by an organization that is based in Canada

C. Consent must be expressed or implied when a custodian discloses personal health information (PHI) to another custodian for the purpose of providing health care.

D. An individual's consent may be implied unless the individual has refused consent or if the purpose of the disclosure is not to provide health care.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #2

A private sector daycare's portal for parents stores their children's photos, allergy information and date of birth. A parent has asked about the portal's security requirements and in three months still not has received an answer. What is missing from the daycare's procedures?

A. Ensuring transparency.

B. Completing a real risk of significant harm assessment (RROSH).

C. Ensuring strong encryption and security measures.

D. Responding to the parent's request within 30 days.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #3

According to the federal Privacy Commissioner, what protection is missing from the Privacy Act regarding outsourcing of government work that contains personal information?

A. A statement requiring the government agency to complete a Privacy Impact Assessment (PIA) prior to outsourcing to a third party.

B. A statement granting the Privacy Commissioner the right to issue orders following an investigation into a possible data breach.

C. A statement indicating that the government institution from which the information is outsourced remains accountable for its security.

D. A statement preventing the vendor to whom the information is outsourced to subcontract its processing.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #4

Under PIPEDA, each of the following situations requires an organization to obtain express consent to use personal information EXCEPT?

A. If there is no risk of significant harm.

B. If the use is inconsistent with the original purpose.

C. If the information is publicly available as defined by the regulation.

D. If the use is outside of the reasonable expectations of an individual.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #5

Which of the following specifically differentiates between regular personal information and employee-related or work-product information?

A. British Columbia's Personal Information Protection Act

B. The Privacy Act.

C. Personal Information Protection and Electronic Documents Act (PIPEDA).

D. The Quebec Act.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #6

In what situation is the federal Privacy Commissioner authorized to proceed to federal court?

A. For a determination on a ruling regarding privacy matters relating to the Charter of Rights and Freedom.

B. For a determination on a ruling by an administrative tribunal regarding privacy.

C. For a determination of whether or not personal information was properly withheld from release.

D. For a determination on a ruling by a provincial Privacy Commissioner.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #7

In which situation could a request for access to one's personal information be denied under the Privacy Act?

A. The personal information was collected by the Royal Canadian Mounted Police while performing policing services for a province or municipality.

B. The personal information is more than 20 years old and relates to the detection or suppression of money laundering.

C. The personal information was obtained in confidence from a foreign state or agency which has consented to the disclosure of the information.

D. The release of the personal information could reasonably be expected to cause injury to a protected species of wildlife.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #8

Work-product information is generally thought of as information about an individual that?

A. Is prepared or collected as part of that individual's responsibilities or activities in connection to their job.

B. Includes internal investigation files and complaints filed about an employee.

C. Is required by an organization to establish an employment relationship.

D. Includes intellectual property developed within the scope of an employee's job function.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Free CIPP-C Questions for IAPP Certified Information Privacy Professional/ Canada (CIPP/C) CIPP-C Exam as PDF & Practice Test Engine

Download Free IAPP CIPP-C Demo