IAPP Certified Information Privacy Professional/Asia (CIPP/A) Exam Questions

IAPP Certified Information Privacy Professional/Asia Exam Objectives

1. 1

   1.0 Privacy Fundamentals

   • 1.1Modern Privacy Principles
   • 1.2The Organisation of Economic Cooperation and Development (OECD) Guidelines Governing the Protection of Privacy and Trans-border Data Flows of Personal Data.” (1980)
   • 1.3The Asia Pacific Economic Cooperation (APEC) privacy principles
   • 1.4Fair Information Practices (FIPs)
   • 1.5Universal Declaration of Human Rights (1948)
   • 1.6Adequacy and the Rest of the World
   • 1.7Europe and the General Data Protection Regulation (GDPR)
   • 1.8Deemed adequate: New Zealand, Canada, Israel, Argentina, Uruguay
   • 1.9United States and the EU-U.S. Privacy Shield
   • 1.10Deemed not adequate: Australia, Mexico, Korea, Taiwan
   • 1.11Elements of personal information
   • 1.12Personal data (EU) (HK) (SG)
   • 1.13Personally identifiable information (U.S.)
   • 1.14Sensitive personal data information (IND)
2. 2

   2.0 Singapore Privacy Laws and Practices

   • 2.1Legislative history and origins
   • 2.2Singapore government and legal system
   • 2.3Political structure
   • 2.4Social attitudes toward privacy and data protection
   • 2.5Surveillance and identification
   • 2.6Constitutional protections
   • 2.7Common law protections
   • 2.8Sector-specific protections
   • 2.9Personal Data Protection Act 2012 (PDPA)
   • 2.10Application and scope
   • 2.11PDPA predecessor: National Internet Advisory Committee
   • 2.12(NIAC) 2002 Report, Report on a Model Data Protection Code
   • 2.13for the Private Sector.
   • 2.14Extraterritorial reach
   • 2.15PDPA definitions
   • 2.16Personal data
   • 2.17‘Business contact information’
   • 2.18‘Data intermediary’
   • 2.19Publicly available
   • 2.20Survivorship
   • 2.21Do Not Call Registry
   • 2.22‘Specified message’
   • 2.23PDPA in an employment setting
   • 2.24Exemptions
   • 2.25Public-sector
   • 2.26Response to emergency
   • 2.27National interest
   • 2.28Investigations in legal proceedings
   • 2.29Evaluative purposes
   • 2.30Journalism and media
   • 2.31Key concepts and practices
   • 2.32Data protection officer
   • 2.33Staff training
   • 2.34Consent and exceptions to consent
   • 2.35Use
   • 2.36Disclosure
   • 2.37Safeguarding/Security
   • 2.38Accountability and openness
   • 2.39Access and correction
   • 2.40Retention and deletion
   • 2.41Transfer out (e.g. APEC, CBPR and PRP)
   • 2.42Data breach notification obligation
   • 2.43Enforcement
   • 2.44Monetary Authority of Singapore
   • 2.45Regulations and guidances
   • 2.46‘Notices on Prevention of Money Laundering and Countering the
   • 2.47Financing of Terrorism’
   • 2.48Individual’s access and rights
   • 2.49Protection of customer data
   • 2.50Outsourcing
   • 2.51Personal Data Protection Commission (PDPC)
   • 2.52Decision in appealed commissioner rulings, complaints
   • 2.53Complaint-based vs. audit-based
   • 2.54Commissioner guidance and published positions
   • 2.55Managing consent opt-out mechanisms: their use and limitations, consent
   • 2.56to new purposes and documentation
   • 2.57Penalties and sanctions
   • 2.58Policy development and implementation
   • 2.59Freedom of information legislation
   • 2.60Data transfers: doctrine of privity of contract for thirdparties
3. 3

   3.0 Hong Kong Privacy Laws and Practices

   • 3.1Legislative history and origins
   • 3.2Hong Kong government and legal system
   • 3.3Social attitudes toward privacy and data protection
   • 3.4Surveillance and identification
   • 3.5Constitutional protections
   • 3.6Common law protections
   • 3.7Personal Data (Privacy) Ordinance (PDPO):
   • 3.8Application and scope
   • 3.9Meaning under PDPO
   • 3.10Personal data
   • 3.11Publicly available data
   • 3.12Sensitive personal data
   • 3.13‘Prescribed consent’
   • 3.14Rights of data subject
   • 3.15Personal Data (Privacy) (Amendment) Ordinance 2012
   • 3.16‘The New Guidance on Direct Marketing’
   • 3.17Major Exemptions
   • 3.18Staff planning and Employment related (including
   • 3.19Personal References)
   • 3.20Relevant process (Evaluation)
   • 3.21Crime, etc.
   • 3.22Legal proceedings, etc.
   • 3.23Legal professional Privilege and Self-incrimination
   • 3.24Health and Emergency
   • 3.25Statistics and Research
   • 3.26Journalism and news media
   • 3.27Key concepts and practices
   • 3.28Six Data Protection Principles (DPPs) and the Internet Data
   • 3.29Guidance
   • 3.30DPP1: Data Collections
   • 3.31DPP2: Accuracy and retention
   • 3.32DDP3: Data Use
   • 3.33DPP4: Data security
   • 3.34DPP5: Openness
   • 3.35DPP6: Data access and correction
   • 3.36Due diligence exemption and exercise
   • 3.37Guidance on Personal Data Erasure and Anonymisation
   • 3.38Guidance on employment matters
   • 3.39Data Transfer/Export, Ordinance Section 33
   • 3.40Data processors
   • 3.41Model contracts
   • 3.42Enforcement
   • 3.43The Office of the Privacy Commissioner for Personal Data
   • 3.44Commissioner rules
   • 3.45Commissioner guidance and published positions
   • 3.46Octopus Rewards Ltd.
   • 3.47Decisions in appealed commissioner rulings, complaints
   • 3.48Personal Data (Privacy) Advisory Committee
   • 3.49Managing consent opt-out mechanisms: their use and limitations, consent
   • 3.50to new purposes and documentation
   • 3.51Enforcement notice
   • 3.52Policy development and implementation
   • 3.53Law reform proposals for third-party benefit exception
   • 3.54Privacy incidents: trends in commissioner expectations
4. 4

   4.0 India Privacy Law and Practices

   • 4.1Legislative history and origins
   • 4.2Indian government and legal system
   • 4.3Political structure
   • 4.4Social attitudes toward privacy and data protection
   • 4.5Surveillance and identification
   • 4.6Credit Information Companies (Regulation) Act 2005
   • 4.7Constitutional protections
   • 4.8Article 21
   • 4.9The Right to Information Act 2005
   • 4.10The Protection of Human Rights Act 1993
   • 4.11Common law protections (e.g. 2017 Supreme Court judgment on the Right to
   • 4.12privacy - Puttaswamy judgment)
   • 4.13Information Technology Act 2000 (IT Act) and Information Technology
   • 4.14Amendment Act 2008 (ITAA)
   • 4.15Digital Personal Data Protection Act 2023 (DPDPA)
   • 4.16Application and scope: replaces section 43A from the Information
   • 4.17Technology Act 2000
   • 4.18Right to access information about personal data
   • 4.19Right to correction and erasure of personal data
   • 4.20Right of grievance redressal
   • 4.21Right to nominate other individuals to act on their behalf
   • 4.22Right to withdraw consent
   • 4.23Children’s data
   • 4.24Exemptions
   • 4.25Processing of publicly available personal data
   • 4.26Processing of personal data for research/statistical
   • 4.27purpose (i.e., training AI)
   • 4.28Research, archiving and statistical purposes
   • 4.29Judicial, investigation, mergers & acquisitions purposes
   • 4.30Non-digital data
   • 4.31DPDPA Rules
   • 4.32Privacy notices and consent: Rules 3-4
   • 4.33Exemptions for state agencies to process personal data: Rule 5
   • 4.34Security safeguards and notification procedures for data breaches:
   • 4.35Rules 6-7
   • 4.36Retention period and erasure of personal data: Rule 8
   • 4.37Contact info for Data Protection Officer: Rule 9
   • 4.38Parent/guardian consent, consent exemptions for children: Rules
   • 4.3911
   • 4.40Annual data protection impact assessments, audits: Rule 12
   • 4.41Right to access, correct, delete personal data: Rule 13
   • 4.42Regulating cross-border transfer of personal data: Rule 14
   • 4.43Exemptions for research purposes: Rule 15
   • 4.44Data Protection Board setup, Board appeal process: Rules 16-21
   • 4.45Allows government to request information from Data Fiduciaries
   • 4.46for purposes in the Seventh Schedule: Rule 22
   • 4.47Information Technology (Intermediary Guidelines and Digital
   • 4.48Media Ethics Code) Rules 2021
   • 4.49Enforcement
   • 4.50The Ministry of Communication and Information Technology
   • 4.51The Department of Electronics and Information (DeitY)
   • 4.52The Telecom Regulatory Authority of India (TRAI) and Do Not Call
   • 4.53Registry
   • 4.54Banning Free Basics and Net Neutrality
   • 4.55Data Protection Board
   • 4.56Commissioner rulings, appeals and complaints
   • 4.57Penalties and sanctions
   • 4.58DPDPA Chapter VIII
   • 4.59Commissioner guidance and published positions
   • 4.60Grievance officers
   • 4.61Managing consent opt-out mechanisms: their use and limitations, consent
   • 4.62to new purposes and documentation
   • 4.63Policy development and implementation
   • 4.64Data transfers: doctrine of privity of contract for third-parties
   • 4.65Public-sector exemption
5. 5

   5.0 Common themes among principle frameworks

   • 5.1Comparing protections and principles
   • 5.2Sensitive data protections
   • 5.3Children’s data protections
   • 5.4Natural persons vs. legal persons
   • 5.5Data breach notification
   • 5.6Public Registers
   • 5.7Surveillance
   • 5.8National identity systems
   • 5.9SingPass
   • 5.10HKID
   • 5.11India’s UIDAI
   • 5.12Legislation
   • 5.13Hong Kong: PCPD Code of Practice on Identity Card
   • 5.14Number and Other Personal Identifiers, 1997
   • 5.15Data processing and export
   • 5.16Intermediaries
   • 5.17Extraterritorial operations
   • 5.18Rights of the data subject
   • 5.19‘Domestic’ use
   • 5.20Breadth of exemption
   • 5.21Hong Kong
   • 5.22Chinese central government organisations
   • 5.23Media
   • 5.24Singapore
   • 5.25Public-sector
   • 5.26Public authorities
   • 5.27Publicly available information
   • 5.28‘Public agency’
   • 5.29Business contracted by Singapore
   • 5.30government
   • 5.31India
   • 5.32Public sector
   • 5.33Public authorities
   • 5.34Publicly available information
   • 5.35Section 17(3): Specific businesses especially
   • 5.36exempted by government, such as ‘startups