Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by IAPP
Exam Format
Registration
Skills this practice test covers
- Compare the OECD Guidelines, the APEC privacy principles and Fair Information Practices.
- Apply Singapore's PDPA, from consent and its exceptions to data breach notification.
- Work through Hong Kong's six Data Protection Principles and the PDPO's major exemptions.
- Explain the rights India's DPDPA gives individuals and the duties it places on data fiduciaries.
- Compare how the three laws treat children's data, national identity systems and data export.
- Identify the regulator for each law and the penalties and sanctions it can apply.
Explore related topics
CIPP-A exam content
5 domains · 14 topics · 241 questions
Privacy Fundamentals
This domain sets the base for the three national laws. It covers the OECD Guidelines, the APEC privacy principles and Fair Information Practices, how EU adequacy decisions shape data transfers, and how each jurisdiction defines personal information.
Skills tested
- Compare the OECD Guidelines with the APEC privacy principles.
- Explain which countries the EU deems adequate and what that means for transfers.
- Separate personal data, personally identifiable information and sensitive personal data as each jurisdiction defines them.
- Explain pseudonymisation, de-identification and anonymisation.
Official topics
- Modern Privacy Principles
- Adequacy and the Rest of the World
- Elements of Personal Information
Singapore Privacy Laws and Practices
This domain covers Singapore's legal system and the Personal Data Protection Act 2012 in depth. Candidates apply the PDPA's definitions, obligations and exemptions, including the Do Not Call Registry, and explain enforcement by the Personal Data Protection Commission and the Monetary Authority of Singapore.
Skills tested
- Apply PDPA definitions such as business contact information and data intermediary.
- Decide when consent is needed and which exceptions to consent apply.
- Explain the data breach notification obligation and the rules for transfers out of Singapore.
- Describe PDPC enforcement, from complaint-based and audit-based action to penalties.
Official topics
- Legislative History and Origins
- Personal Data Protection Act 2012 (PDPA)
- Enforcement
Hong Kong Privacy Laws and Practices
This domain centers on Hong Kong's Personal Data (Privacy) Ordinance. Candidates apply its six Data Protection Principles, its major exemptions and the direct marketing rules of the 2012 amendment, and explain how the Privacy Commissioner enforces the law.
Skills tested
- Apply DPP1 to DPP6 to collection, accuracy and retention, use, security, openness and access.
- Identify the PDPO's major exemptions, such as crime, legal proceedings and news media.
- Explain the direct marketing rules of the 2012 amendment.
- Describe the Commissioner's powers, including the enforcement notice.
Official topics
- Legislative History and Origins
- Personal Data (Privacy) Ordinance (PDPO)
- Enforcement
India Privacy Law and Practices
This domain covers India's privacy foundations, from Article 21 of the Constitution and the Puttaswamy judgment to the Information Technology Act 2000. It then turns to the Digital Personal Data Protection Act 2023, its rules and its enforcement by the Data Protection Board.
Skills tested
- Explain the rights the DPDPA gives individuals, such as correction, erasure and grievance redressal.
- Apply the DPDPA Rules on notice, consent, breach notification and children's data.
- Describe the DPDPA exemptions for publicly available data, research and state agencies.
- Identify the penalties in DPDPA Chapter VIII and the role of grievance officers.
Official topics
- Legislative History and Origins
- Digital Personal Data Protection Act 2023 (DPDPA)
- Enforcement
Common Themes Among Principle Frameworks
The last domain compares the three laws side by side. Candidates contrast their treatment of sensitive and children's data, breach notification, public registers, surveillance, national identity systems and data export, and how far each jurisdiction's exemptions reach.
Skills tested
- Compare national identity systems such as SingPass, HKID and India's UIDAI.
- Contrast breach notification and children's data rules across the three jurisdictions.
- Explain the breadth of public-sector and domestic-use exemptions in each law.
Official topics
- Comparing Protections and Principles
- Rights of the Data Subject
Requirements
- No formal prerequisites: anyone can book the exam.
- Recommended: at least two years of experience in privacy or data protection.
- Recommended: familiarity with the OECD and APEC frameworks and with cross-border data transfers in Asia-Pacific.
About the CIPP-A exam
The CIPP-A exam is IAPP's test of privacy law in Singapore, Hong Kong and India, written for staff who handle personal data in those jurisdictions. For each country it covers the legal system and history, the main law, and how regulators enforce it. A final domain compares the three on topics such as breach notification and children's data. Passing earns the Certified Information Privacy Professional/Asia (CIPP/A) certification.
Singapore, Hong Kong and India each get a similar share of the PlanetCert practice test, and the fundamentals and common themes domains make up the rest. The explanations tie each answer to the law and provision behind it, such as Hong Kong's DPP6 on data access or the DPDPA Rules on breach notification. Flashcard mode suits the many defined terms, from data intermediary to data fiduciary. Brainy AI Assistant can compare how the PDPA, the PDPO and the DPDPA handle the same case.
How to earn the certification
- Earns
- Certified Information Privacy Professional/Asia (CIPP/A)Professional
CIPP/A is valid for two years.
- After
- FIP Fellow of Information Privacy (FIP)
IAPP's senior designation, a next step for CIPP/A holders.
- FIP Fellow of Information Privacy (FIP)
How to prepare for CIPP-A
- 1
Build a three-country comparison table
Give Singapore, Hong Kong and India one row each, with columns for legal system, main law, key definitions, regulator and penalties. The final domain draws on this comparison.
- 2
Learn the PDPA obligations by name
List the PDPA's obligations, from consent and purpose to transfer out and breach notification, and its exemptions. Singapore is one of the three largest domains.
- 3
Pair each DPP with a case
Match each of Hong Kong's Data Protection Principles to a short case, such as an access request under DPP6 or a security failure under DPP4.
- 4
Read the DPDPA with its rules
Study the DPDPA's rights, children's data rules and exemptions, then the DPDPA Rules on notice, consent, breach notification, data retention and the Data Protection Board.
- 5
Mix the jurisdictions under time
Use the CIPP-A practice test in Study Mode one domain at a time, then take a timed run with all five domains mixed. Ask Brainy AI Assistant how the three laws differ on any question that mixed them up.
Start a timed CIPP-Arun
Who CIPP-A is for
- Data protection officers and privacy managers whose organizations operate in Singapore, Hong Kong or India.
- Lawyers and consultants who advise on privacy law across Asia.
- Compliance and IT staff who manage personal data that moves between Asian jurisdictions.
Typical job titles: Data protection officer · Privacy counsel · Privacy analyst · Compliance officer · Privacy consultant
CIPP-A glossary
17 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- Aadhaar
- India's national identity system, which gives each resident a unique number linked to biometric and demographic data.
- Adequacy decisions
- EU rulings that a country protects personal data well enough for EU data to flow there without extra safeguards.
- Anonymisation
- Changing data so that no person can be identified from it, even when it is combined with other data.
- APEC Privacy Framework
- The Asia-Pacific Economic Cooperation's set of privacy principles for its member economies.
- Business contact information
- Work details such as a name, job title and office phone number, which the PDPA largely leaves outside its rules.
- Cross-Border Privacy Rules (CBPR)
- An APEC certification system through which companies show that their cross-border data handling meets APEC privacy principles.
- Data fiduciary
- Under India's DPDPA, the person or organization that decides why and how personal data is processed.
- Data intermediary
- Under the PDPA, an organization that processes personal data on behalf of another organization.
- Data Protection Board
- The body set up under the DPDPA to look into breaches of the Act and impose penalties.
- Do Not Call Registry
- Singapore's register that lets people opt out of marketing calls and messages to their phone numbers.
- Fair Information Practices (FIPs)
- Long-standing principles for handling personal data fairly, such as notice, choice, access and security.
- Grievance officers
- Staff that an organization names to receive and resolve complaints about how it handles personal data.
- HKID
- The Hong Kong identity card number. A code of practice from the Privacy Commissioner controls how it is collected and used.
- Personal Data Protection Commission (PDPC)
- The Singapore authority that administers and enforces the PDPA.
- Prescribed consent
- Under the PDPO, express consent that a person gives voluntarily and has not withdrawn in writing.
- Puttaswamy judgment
- The 2017 ruling of India's Supreme Court that privacy is a fundamental right.
- Six Data Protection Principles (DPPs)
- The core rules of Hong Kong's PDPO, covering collection, accuracy and retention, use, security, openness, and access and correction.