Target Audience

The complete form of the CIPP-E is the Certified Information Privacy Professional/Europe. The exam, in particular, is designed for data protection officers who are responsible for keeping tabs on compliance, being in charge of internal data security, training staff for data processing, and auditing. However, such a test is more specific on trans-border data protection officials.

Reference: https://iapp.org/certify/cippe/

Prerequisites for CIPP-E Exam

The main requirement for the CIPP-E exam is that the candidate has a basic knowledge of data protection. It is an added advantage if the candidate has relevant work experience which has already introduced them to the skills and concepts needed in the industry.

Exam Topics

The content of the CIPP/E certification exam revolves around three major subject areas, including the following:

• European Data Protection Law and Regulation

  This objective covers from 42 to 69 exam questions. Here the students should demonstrate that they have a good understanding of data protection principles (personal data as well as sensitive personal data, anonymous & pseudonymous data, controller, processing, processor, data subject); territorial & material GDPR scope (establishment as well as non-establishment in the EU); data processing concepts (purpose limitation, fairness & lawfulness, storage limitation/retention, accuracy, proportionality, integrity & confidentiality); lawful processing criteria (contractual necessity, consent, legitimate interests, vital interests as well as public interest, legal obligation, special categories of processing); information provision obligations (privacy notices, transparency principle, layered notices).

  Additionally, the examinees must prove that they are proficient in data subjects rights (rectification, access, restriction & objection erasure as well as the right to be forgotten, automated decision making, consent (and withdrawal of), etc.); personal data security (relevant organizational & technical measures, vendor management, breach notification, data sharing); accountability requirements (responsibility of processors & controllers, data protection by default as well as by design, data protection influence evaluation, documentation & cooperation with regulators, auditing of privacy programs, compulsory data protection officers).

  Lastly, the subject also requires your understanding of international data transfers (safe jurisdictions, prohibition rationale, Binding Corporate Rules (BCRs), Safe Harbor & Privacy Shield, model contracts, derogations, codes of conduct &certifications); supervision & enforcement (supervisory authorities as well as their powers, role of the European Data Protection Supervisor (EDPS), the European Data Protection Board); consequences for GDPR violations (infringement & fines, data subject compensation, process & procedures).

• Introduction to European Data Protection

  The certification exam can have 4 to 10 questions on this topic. This domain encompasses one’s knowledge of origins and historical context of data protection law (including human rights laws, early laws & regulations, data protection rationale, the Treaty of Lisbon; the need for a harmonized European approach, a modernized framework). The candidates must also be familiar with the European Union institutions, such as the European Court of Human Rights, the Council of Europe, the European Parliament, the European Commission, the European Court of Justice European Council. Moreover, in order to answer the questions in this section, the test takers must know the legal framework. This includes their knowledge of the EU Data Protection Directive (95/46/EC), European data retention regimes, the EU Directive on Privacy and Electronic Communications (2002/58/EC), the General Data Protection Regulation (GDPR), etc.

• Compliance with European Data Protection Law and Regulation

  This area includes 9-18 exam questions. This topic unites the aspects, such as employment relations (storage of personnel records, whistleblowing systems, workplace monitoring & data loss prevention, EU Works councils, Bring Your Own Device (BYOD) programs); surveillance activities (interception of communications, surveillance by public authorities, closed-circuit television (CCTV), facial/biometrics recognition, geolocation); direct marketing (direct marketing, telemarketing, as well as online behavioural targeting); Internet technologies & communications (web cookies, search engine marketing (SEM), Artificial Intelligence (AI), cloud computing, social networking services).