IAPP Certified Information Privacy Professional/China

QUESTION NO: 1
Which regulatory body oversees the protection of personal financial data in China?
Response:

A. Cyberspace Administration of China (CAC) B. National Health Commission (NHC) C. People's Bank of China (PBOC) D. Ministry of Public Security (MPS)

Correct Answer: C

QUESTION NO: 2
According to PIPL, which principle ensures that only relevant data necessary to achieve processing objectives is collected?
Response:

A. Data Minimization B. Fairness and Impartiality C. Lawfulness and Consent D. Data Transparency

Correct Answer: A

QUESTION NO: 3
What is a key accountability requirement for personal information processors under PIPL?
Response:

A. Storing personal information indefinitely B. Registering with all international privacy organizations C. Outsourcing all data processing activities D. Establishing an internal data protection policy and conducting compliance audits

Correct Answer: D

QUESTION NO: 4
A healthcare provider needs to share sensitive patient information with a research institution for a study on a rare disease. Which of the following steps must be taken to ensure compliance with PIPL?
Response:

A. Transfer the data to a foreign research partner immediately B. Use the data only for commercial gain C. Anonymize the data and obtain patient consent where applicable D. Transfer patient data without consent if the research benefits the public

Correct Answer: C

QUESTION NO: 5
Under Chinese regulations, what must healthcare organizations do when handling genetic data?
Response:

A. Conduct data audits regularly and encrypt sensitive information B. Store data indefinitely for future research use C. Allow third-party access to the data for healthcare marketing D. Share data automatically with public health agencies

Correct Answer: A

QUESTION NO: 6
Which of the following would make a cross-border data transfer illegal under PIPL?
Response:

A. Obtaining separate user consent for the transfer B. Conducting a legal review before the transfer C. Using encryption methods for secure transmission D. Failing to meet cross-border data security requirements set by the CAC

Correct Answer: D

QUESTION NO: 7
Which of the following processing activities falls outside the scope of the PIPL?
Response:

A. Data collection for business marketing campaigns B. Cross-border transfers of customer data C. Processing of employee records by private companies D. Data processing for national security purposes

Correct Answer: D

QUESTION NO: 8
Which of the following is an example of a proper accountability practice under PIPL?
Response:

A. Storing outdated user data indefinitely B. Allowing third-party access without formal agreements C. Conducting regular personal information protection audits D. Sharing user data with partners without disclosing processing terms

Correct Answer: C

QUESTION NO: 9
What is required when an organization processes sensitive personal data on a large scale under PIPL?
Response:

A. Designating a personal information protection officer B. Registration with all global data protection bodies C. Conducting monthly government inspections D. Public disclosure of processing methods

Correct Answer: A

QUESTION NO: 10
What is one of the main risks that PIPL aims to prevent in automated decision-making processes?
Response:

A. Financial losses in marketing campaigns B. Over-reliance on cloud computing C. System maintenance delays D. Discriminatory decisions affecting individuals' rights

Correct Answer: D

QUESTION NO: 11
When can organizations legally collect sensitive health data in China?
Response:

A. With explicit user consent or as required by law B. During research without disclosing data collection methods C. When used for marketing and product development D. After notifying government authorities only

Correct Answer: A

QUESTION NO: 12
A company processes the personal information of users in China for a mobile application. What steps must the company take to comply with the Personal Information Protection Law (PIPL)?
Response:

A. Avoid collecting sensitive personal data entirely. B. Store all user data locally in China. C. Ensure transparency, implement data minimization, and conduct security assessments. D. Only obtain the users' consent for data collection.

Correct Answer: C

QUESTION NO: 13
Under which law is the protection of minors' personal information specifically addressed?
Response:

A. Cybersecurity Law B. Consumer Protection Law C. Minor Protection Law D. Civil Code

Correct Answer: C

IAPP Certified Information Privacy Professional/China - CIPP-CN Exam Questions