Free FIP sample questions

Correct answer: The processing is necessary for the performance of a contract, or is authorized by Union/Member state law, or is based on explicit consent.

GDPR Article 22 prohibits automated decision-making (ADM) that produces legal or similarly significant effects unless one of three exceptions applies: it is necessary for entering into or performance of a contract, authorized by law, or based on the data subject's explicit consent. For a marketing loyalty program, explicit consent is the most likely valid basis.

Correct answer: Reduction in the percentage of applications deployed without a completed Privacy Impact Assessment (PIA) compared to the previous quarter.

This is an outcome-based metric (Key Risk Indicator or KRI) that measures the effectiveness of the 'Privacy by Design' process. It directly correlates to the reduction of compliance risk (unassessed apps entering production). The other options are activity metrics (completion rates) or operational efficiency metrics (time to close), rather than risk outcome metrics.

Correct answer: A lower epsilon value results in more noise being added, providing stronger privacy guarantees but reduced data utility.

In differential privacy, 'epsilon' (ε) quantifies the privacy loss. A smaller epsilon means stricter privacy (less information leakage), which is achieved by adding more random noise to the data. This increased noise reduces the utility (accuracy) of the dataset for the researchers. Conversely, a higher epsilon adds less noise (better utility) but offers weaker privacy guarantees.

Correct answer: Unacceptable Risk (Prohibited, with narrow exceptions)

Under the EU AI Act, 'real-time' remote biometric identification in publicly accessible spaces for law enforcement purposes is classified as an Unacceptable Risk and is prohibited in principle (Article 5). There are very narrow exceptions (e.g., searching for missing children, preventing imminent terrorist threats) which require judicial authorization, but the baseline classification is prohibited/unacceptable.

Correct answer: Conduct a data inventory and mapping exercise to identify data types, locations, and legal obligations before defining a retention schedule.

As a leader, you cannot make arbitrary decisions (like deleting data older than 2 years) without understanding the data. The first step in post-acquisition integration is to understand what you have acquired. A data inventory/mapping exercise is necessary to determine what data exists, why it is held, and what legal or business requirements dictate its retention. Only then can a compliant retention schedule be enforced.

Correct answer: It must be classified as 'Sharing' for cross-context behavioral advertising, requiring a 'Do Not Sell or Share My Personal Information' link.

The CPRA expanded the CCPA's opt-out rights to explicitly include 'sharing' of personal information for cross-context behavioral advertising, regardless of whether monetary consideration is exchanged. The required link on the homepage must now read 'Do Not Sell or Share My Personal Information' (or the company must honor valid opt-out preference signals like GPC).