VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ
IAPP

Certified Information Privacy Professional - China Free Sample Questions

Create a free account to browse all 20 sample questions. The full practice test includes 170 questions. Use the simulator for timed and flashcard mode.

Try Simulator

CIPP-CN Sample Questions

  1. Q1

    A Shanghai-based e-commerce platform processes the personal information of 2 million users. The company plans to migrate its customer database to a cloud server located in Singapore to improve regional latency. According to the Personal Information Protection Law (PIPL) and CAC measures, which compliance mechanism MUST the company adopt for this cross-border transfer?

    Show answer & explanation

    Correct answer: B

    Under PIPL and the Measures for the Security Assessment of Outbound Data Transfers, a mandatory CAC Security Assessment is triggered if a data processor processes the personal information of more than 1 million individuals. Since the company has 2 million users, it exceeds this threshold, making the CAC Security Assessment the only valid mechanism, superseding SCCs or Certification.

    Timed and flashcard mode in the Simulator
  2. Q2

    A multinational pharmaceutical company operates a research center in Beijing. They intend to transfer clinical trial data involving genetic markers of 5,000 Chinese citizens to their headquarters in Switzerland. Which specific regulatory requirement governs the export of this specific category of data?

    Show answer & explanation

    Correct answer: B

    Genetic data falls under the Human Genetic Resources (HGR) regulations in addition to PIPL. The export of HGR requires specific approval or filing with the Human Genetic Resources Administration of China (HGRAC/MOST), regardless of the volume thresholds that might otherwise apply under PIPL alone. This is a dual-compliance scenario.

    Timed and flashcard mode in the Simulator
  3. Q3

    Under the Data Security Law (DSL), data is classified based on its potential impact on national security, public interest, and the legitimate rights of individuals or organizations. Which classification represents data that, if tampered with, destroyed, leaked, or illegally obtained, would directly harm national security, the economy, or major public interests?

    Show answer & explanation

    Correct answer: C

    The DSL establishes a category called 'National Core Data' (State Core Data), which refers to data related to national security, the lifelines of the national economy, important aspects of people's livelihood, and major public interests. This is the highest classification level, requiring the strictest protection measures.

    Timed and flashcard mode in the Simulator
  4. Q4Multiple answers

    A Beijing-based tech startup is developing a mobile application for children aged 10-13. The app collects geolocation data to enable a 'find my friends' feature. Which specific compliance steps are MANDATORY under the Provisions on the Cyber Protection of Children's Personal Information? (Select TWO)

    Show answer & explanation

    Correct answers: A, B

    For children under 14, the law mandates obtaining consent specifically from the guardian/parent. Consent from the child alone is insufficient.

    Network operators processing children's data must establish and publish a specialized personal information protection rule specifically for children, separate or distinct from the general privacy policy.

    Timed and flashcard mode in the Simulator
  5. Q5

    An organization is conducting a Personal Information Protection Impact Assessment (PIA) as required by PIPL. Which of the following elements is NOT strictly required to be included in the PIA report according to PIPL Article 55?

    Show answer & explanation

    Correct answer: C

    PIPL Article 55 requires a PIA to cover: (1) lawfulness/necessity of purpose/method, (2) impact on rights/interests, and (3) effectiveness of protection measures. Financial budgets for monetization are not a required element of a compliance-focused PIA.

    Timed and flashcard mode in the Simulator
  6. Q6

    Case Study: TechFin China

    TechFin China is a financial technology services provider headquartered in Shenzhen. They offer a mobile payment app used by 50 million active users. Recently, TechFin decided to partner with a credit scoring agency in Europe to enhance their fraud detection algorithms. This involves sending user transaction logs and device identifiers to the European partner.

    TechFin has been designated as a Critical Information Infrastructure Operator (CIIO) by the financial regulators due to its market share. They have never transferred data outside China before.

    Based on the scenario, what is the PRIMARY legal constraint TechFin faces regarding the data location before any transfer can occur?

    Show answer & explanation

    Correct answer: A

    As a designated Critical Information Infrastructure Operator (CIIO), TechFin is subject to the strict data localization requirements of the Cybersecurity Law (CSL) and PIPL. CIIOs MUST store personal information and important data collected/generated in China locally. Any export requires a security assessment, but the primary constraint is the default localization requirement.

    Timed and flashcard mode in the Simulator
  7. Q7

    Which government entity is the primary authority responsible for the overall planning and coordination of personal information protection and related supervision in China?

    Show answer & explanation

    Correct answer: B

    The Cyberspace Administration of China (CAC) is the primary department responsible for the overall planning and coordination of personal information protection and related supervision and administration nationwide.

    Timed and flashcard mode in the Simulator
  8. Q8

    True or False: Under PIPL, if a company wishes to install facial recognition cameras in a shopping mall for the sole purpose of security monitoring, they are exempt from obtaining separate consent from each individual shopper, provided they post a prominent notice.

    Show answer & explanation

    Correct answer: A

    According to PIPL Article 26 and the Supreme People's Court interpretation, image capture in public places for the purpose of maintaining public safety is permitted without individual consent, provided prominent alert signage is displayed and the data is not used for other purposes (like marketing analysis).

    Timed and flashcard mode in the Simulator
  9. Q9

    A developer is configuring a generative AI service that will be available to the general public in China. According to the 'Interim Measures for the Management of Generative Artificial Intelligence Services', which action is legally required regarding the training data used for the model?

    Show answer & explanation

    Correct answer: A

    The Interim Measures mandate that providers must lawfully source training data and ensure it does not infringe on intellectual property rights or contain illegal content.

    Timed and flashcard mode in the Simulator
  10. Q10Multiple answers

    You are advising a client on PIPL compliance. They need to understand the concept of 'Separate Consent'. In which of the following scenarios is obtaining Separate Consent explicitly REQUIRED by PIPL? (Select TWO)

    Show answer & explanation

    Correct answers: A, C

    PIPL explicitly requires 'separate consent' (or specific consent) for processing sensitive personal information (Article 29).

    Article 23 of PIPL requires separate consent when providing personal information to another handler (third-party sharing).

    Timed and flashcard mode in the Simulator

Register free to unlock 10 more sample questions

Create a free account to continue with the rest of the CIPP-CN sample set.

Lifetime One

Own this practice test forever.

$79.99
$75.99
one-time
  • Full access to 170 questions
  • Study, Timed & Flashcard Modes
  • All past and future versions i
  • Detailed Explanations
  • Study Tracking & Past Attempts
  • Brainy AI Assistant
  • Lifetime updates

Two

Any 2 exams per month.

$20.00/exam
$39.99
/month
  • 2 active exam slots
  • Study, Timed & Flashcard Modes
  • All past and future versions i
  • Detailed Explanations
  • Study Tracking & Past Attempts
  • 1,000 Brainy AI Credits
  • Cancel anytime
Popular

Pro Four

Any 4 exams per month.

$17.50/exam
$69.99
/month
  • 4 active exam slots
  • Study, Timed & Flashcard Modes
  • All past and future versions i
  • Detailed Explanations
  • Study Tracking & Past Attempts
  • 5,000 Brainy AI Credits
  • Dedicated support

Premium Twelve

Any 12 exams over 3 months.

$15.00/exam
$179.99
/3 months
  • 4 active exam slots
  • Study, Timed & Flashcard Modes
  • All past and future versions i
  • Detailed Explanations
  • Study Tracking & Past Attempts
  • 15,000 Brainy AI Credits
  • Dedicated support
  • Friend seat included — full access

Trusted by professionals at

NvidiaSupabaseGitHubOpenAITursoClerkClaude AIAmazon