CIPP-A practice questions — 10 free

A Singapore employer can do all of the following without obtaining an employee's consent EXCEPT?

• AShare an employee's personal data with a company that provides financial planning.
• BDisclose personal health data to a public agency during a health crisis.Disclosing health data to a public agency during a health crisis falls within the PDPA consent exceptions for public interest or legal requirements, so separate consent is not required and this is not the EXCEPT.
• CUse computer monitoring software on an employee's computers.Using computer monitoring software for workplace management generally falls within a reasonable exception related to employment management under the PDPA, so separate consent is not required.
• DUse closed-circuit television surveillance in the workplace.Workplace CCTV surveillance, with appropriate notice, is a reasonable exception recognized in PDPC guidance for employer safety management, so separate consent is not required.

How are the scope of Singapore's Personal Data Protection Act and the scope of India's IT Rules similar?

• AThey apply to controllers and processors alike.
• BThey allow exemptions for military personnel.Neither law provides a general exemption for military personnel, so that is not a shared feature of the two regimes.
• CThey impose obligations on individuals acting in a domestic capacity.The regulated parties under these laws are not limited to individuals acting in a purely personal or domestic capacity, so this does not accurately describe their scope.
• DThey only apply to the private sector.Neither the PDPA nor the IT Rules 2011 applies only to the private sector. The PDPA includes exceptions for certain public-sector activities, so this is not a common feature.

In enforcement cases, what is Singapore's Personal Data Protection Commission (PDPC) obligated to do?

• AProvide the complainant with a way to appeal a decision.
• BPublish the decisions it makes regarding complaints.The PDPC may selectively publish enforcement decisions that have precedential or educational value, but it is not required to publish every decision on complaints.
• CPublish the name of an organization named in a complaint.The PDPC is not under a statutory duty to disclose the name of the organization in every complaint case; publication depends on the circumstances.
• DIntervene in civil actions to provide assistance to complainants.As an administrative regulator, the PDPC is not legally required to intervene in civil actions or assist complainants in bringing them.

Section 43A of India's IT Rules 2011 requires which of the following for a privacy policy?

• AIt should be available and produced on request.
• BIt should be published on the website of the body corporate.Although the Rules do require a privacy policy to be published on the body corporate’s website, that statement is incomplete because it omits the separate obligation to make it available on request.
• CIt should be emailed or faxed to data providers by the body corporate.The IT Rules 2011 do not require the body corporate to proactively email or fax the privacy policy to every data provider. That option invents a form of obligation that the Rules do not impose.
• DIt should be shown to the data provider at the time of data collection.The Rules do not require the full privacy policy to be shown to the data provider at the moment of collection. They require the policy to be available and produced on request, so this option overstates the timing requirement.

What personal information is considered sensitive in almost all countries with privacy laws?

• AMarital status.Marital status is usually treated as general personal data and is not, in most privacy regimes, classified as a sensitive category requiring special protection.
• BHealth information.
• CEmployment history.Employment history generally falls within ordinary personal data and is not commonly recognized across jurisdictions as a sensitive category.
• DCriminal convictions.Criminal conviction data receives special treatment in some jurisdictions, such as under GDPR Article 10, but it is not uniformly classified as sensitive personal information in almost all countries with privacy laws. Health information is far more consistently treated as sensitive.

Which of the following is NOT a way that the Singapore government can monitor its citizens?

• AThrough the national identity card system.The NRIC system covers biometric data and is widely used for identity verification, making it a real monitoring channel closely linked to an individual's identity.
• BThrough the electronic road pricing system.The electronic road pricing system records when and where vehicles pass, creating traceable travel data. It is an actual means of monitoring.
• CThrough a personal computer registration system.
• DThrough an online service that holds an individual’s medical records.An electronic health information service that holds an individual's medical records enables relevant bodies to access that person's health history, making it a real channel for retaining personal data traces.

Which of the following is TRUE of a Significant Data Fiduciary under the Digital Personal Data Protection Act 2023?

• AThe Central Government designates it on factors including volume and sensitivity of data and risk, and additional obligations then attach
• BThe designation replaces the Data Fiduciary’s contact-publication and grievance-redressal obligationsDesignation adds section 10 obligations; it does not replace the section 8(10) business-contact publication duty or the section 13 effective grievance-redressal mechanism. The Act does not require every Data Fiduciary to appoint a role uniformly titled grievance officer.
• CAn entity becomes one automatically once it processes data about more than a fixed number of individualsThe law does not set an automatic numerical threshold for designation. Data volume is only one factor the government may consider; it is not a self-executing trigger.
• DAn entity self-assesses against published criteria and registers with the Data Protection BoardThe DPDPA does not create a self-assessment and registration regime. This option imports a compliance model from elsewhere.

Which set of additional obligations attaches to a Significant Data Fiduciary under the Digital Personal Data Protection Act 2023?

• AMaintain a copy of all personal data within India at all timesThe DPDPA does not impose a general data localization storage requirement; that imports rules from other jurisdictions.
• BPublish an annual transparency report listing all Data Principals servedThere is no obligation to publish a list of Data Principals served; doing so would itself create a disclosure risk.
• CAppoint a Data Protection Officer based in India, conduct periodic data protection impact assessments, and undergo independent audits
• DObtain government approval before each cross-border transferCross-border transfers are governed by a restriction list, not case-by-case approval.

Which statement about the Data Protection Board of India is correct?

• AIt supervises credit information companiesCredit information companies are regulated by the Reserve Bank of India under separate legislation.
• BIt adjudicates contraventions and imposes penalties, while rule-making sits with the ministry
• CIt makes the rules under the DPDP Act and adjudicates contraventionsRule-making power sits with the ministry; the Board does not also serve as the rule-maker.
• DIt approves cross-border transfers case by caseCross-border transfers are not subject to transaction-by-transaction approval; only countries restricted by government notification are off limits.

Which guidance instrument specifically governs the collection and use of identity card numbers in Hong Kong?

• AThe New Guidance on Direct MarketingThe New Guidance on Direct Marketing addresses direct marketing.
• BThe Code of Practice on Identity Card Number and Other Personal Identifiers
• CThe Internet Data GuidanceThe Internet Data Guidance concerns the online collection of personal data.
• DThe Guidance on Personal Data Erasure and AnonymisationThe Guidance on Personal Data Erasure and Anonymisation explains when data falls outside the Ordinance after erasure or anonymisation.