Free CIPP/E Mock Exam
CIPP/E (also written CIPP E or CIPPE)
This free CIPP/E mock exam has 190 original practice questions on GDPR and European data protection, with no sign-up. The real IAPP CIPP/E exam has 90 multiple-choice questions in 2.5 hours, with a 15-minute break, scored from 100 to 500 with 300 needed to pass.
Start the mock
Exam-format mock
90 questions drawn at random from the bank, 150-minute timer — the length of the real IAPP exam.
Whole question bank
All 190 questions in order (Set-A: Questions 1 to 190 (Comprehensive Mode)), 150-minute timer — the original app's setting.
- Context scenarios appear above the questions they apply to.
- You can flag questions for review.
- Finish the test at any time to see the analysis.
- The timer starts when you press Start. Answers stay in this browser tab only; leaving or refreshing ends the attempt.
Key facts
| Real IAPP exam | This mock | |
|---|---|---|
| Questions | 90 | 190 in the bank; exam-format mode draws 90 |
| Time | 2.5 hours (150 min), 15-minute break | 150 min (exam format) or 150 min (whole bank) |
| Scoring | Scored 100–500; 300 passes (IAPP stresses this is not 60%) | Percentage correct; unanswered counts as not correct |
| Explanations | — | Yes, in the answer review |
| Cost / sign-up | Paid | Free, no sign-up |
Exam facts verified against IAPP on 4 October 2026.
Sample questions
1. Which factor most strongly establishes that the US headquarters' processing is subject to the GDPR?
- A. The fact that the data subjects are EU residents.
- B. The processing is carried out in the context of the activities of the Paris subsidiary.
- C. The company uses an EU-based cloud provider for its backup services.
- D. Delaware law requires compliance with international privacy standards.
Answer: B. The processing is carried out in the context of the activities of the Paris subsidiary.
Explanation: Article 3(1).
2. CloudSaaS moves its server from Germany to the UK. Post-Brexit, what must it ensure?
- A. Nothing, the UK is an "adequate" country currently.
- B. It must implement SCCs immediately.
- C. It must ask for permission from the DPO of every client.
- D. It must move the servers back to the EU.
Answer: A. Nothing, the UK is an "adequate" country currently.
Explanation: UK Adequacy Decision.
3. "Binding Corporate Rules" (BCRs) are used for:
- A. Local marketing campaigns.
- B. Intragroup international data transfers.
- C. Hiring new employees.
- D. Paying taxes.
Answer: B. Intragroup international data transfers.
Explanation: Intragroup transfers.
4. What is the classification of this data flow under Chapter V?
- A. Internal processing, not requiring a transfer mechanism.
- B. A transfer to a third country, requiring "appropriate safeguards."
- C. An "adequate" transfer, because Thailand is an EU trading partner.
- D. A "household" activity of the parent company.
Answer: B. A transfer to a third country, requiring "appropriate safeguards."
Explanation: Transfer to third country.
5. In the context of the European Convention on Human Rights (ECHR), why is Article 8 considered a "qualified" right rather than an absolute one?
- A. Because it only applies to citizens of the original six founding Member States.
- B. Because public authorities can interfere with this right if the action is in accordance with the law and necessary in a democratic society for specific interests like national security or public safety.
- C. Because it only protects "private life" and excludes "family life."
- D. Because it is a non-binding guideline that national courts can ignore.
Answer: B. Because public authorities can interfere with this right if the action is in accordance with the law and necessary in a democratic society for specific interests like national security or public safety.
Explanation: Article 8 ECHR qualified rights.
Study with PrivacyLawHub
Frequently asked questions
- How many questions are on the real CIPP/E exam, and how long is it?
- 90 multiple-choice questions in 2.5 hours (150 minutes), plus a 15-minute break.
- What is the passing score?
- IAPP exams are scored from 100 to 500, and 300 passes. IAPP stresses that 300 is not the same as 60%.
- Are these real exam questions?
- No. They are original practice questions written by the author, not IAPP exam or IAPP practice-exam questions.
- Is this affiliated with the IAPP?
- No. PrivacyLawHub is independent and is not affiliated with or endorsed by the IAPP.
- Is it free, and do I need to sign up?
- It is free and needs no account. Your attempt runs in your browser tab and is not saved.
- How does this differ from IAPP's official practice exam?
- IAPP sells its own official practice exam. This mock is an independent bank of original questions; its percentage score is not an IAPP scaled score.
Questions written and reviewed by Shubhank Suman, CIPP/E, CIPM, AIGP.
CIPP/E, CIPM and AIGP are registered trademarks of the IAPP. PrivacyLawHub is not affiliated with or endorsed by the IAPP.
Related: CIPM Mock Exam · AIGP Mock Exam · DPDPA Exam