IAPP Certified Data Protection Officer — France (CDPO/FR)

Which French law first established the CNIL and created the foundational framework for personal data protection in France?

• ALoi n°78-17 du 6 janvier 1978 (Loi Informatique et Libertés)
• BLoi n°2004-801 relative à la protection des personnes physiques
• COrdonnance n°2018-1125 transposing the Law Enforcement Directive
• DLoi n°2016-1321 pour une République numérique

Under the GDPR, which of the following is NOT listed in Article 6(1) as a valid lawful basis for processing personal data?

• AThe data subject has given consent
• BProcessing is necessary for the legitimate interests of the controller
• CProcessing is in the national security interest of a Member State
• DProcessing is necessary for compliance with a legal obligation

What is the CNIL's maximum sanctioning power for a serious GDPR violation by a large organisation?

• A€20 million or 4% of global annual turnover, whichever is higher
• B€10 million or 2% of global annual turnover, whichever is higher
• C€50 million or 10% of global annual turnover, whichever is higher
• D€100 million flat fine with no turnover component

Under GDPR Article 37, which of the following organisations is MANDATORILY required to designate a Data Protection Officer (DPO)?

• AA hospital processing patient health records on a large scale
• BA small e-commerce retailer that processes customer purchase history
• CA law firm representing clients in data protection disputes
• DA consulting firm with 49 employees providing general business advice

Within what timeframe must a controller notify the CNIL of a personal data breach under GDPR Article 33?

• A72 hours of becoming aware of the breach, where feasible
• B24 hours of becoming aware of the breach
• C7 calendar days of becoming aware of the breach
• D30 days of the breach occurring

Under GDPR Article 9, which of the following is classified as 'special category' personal data?

• AFinancial account numbers and salary information
• BHome addresses and telephone numbers
• CBiometric data processed to uniquely identify a natural person
• DProfessional employment history and job titles

A French company processing employee biometric data for access control purposes wishes to rely on consent as the lawful basis. Under CNIL guidance, what is the primary concern with this approach?

• AConsent in the employment context is rarely freely given due to the power imbalance betwe…
• BBiometric data for access control is entirely prohibited under French law and no basis is…
• CBiometric data may only be processed under the legitimate interests basis in France
• DEmployment-related processing always requires an explicit decision by the Conseil d'État

What does GDPR Article 30 require controllers and processors to maintain?

• ARecords of processing activities (RoPA) containing specified information about each proce…
• BA public register of all processing operations published on their website
• CAnnual data protection reports filed with the CNIL
• DMandatory audit trails of every individual access to personal data systems

Under GDPR Article 17, a data subject exercises the right to erasure ('right to be forgotten'). In which scenario would the controller be justified in refusing?

• AThe data is necessary for establishing, exercising or defending legal claims
• BThe data subject previously gave explicit consent to processing
• CThe data was collected directly from the data subject rather than from a third party
• DThe controller is located in France and the data subject is located in another EU Member…

When is a Data Protection Impact Assessment (DPIA) mandatory under GDPR Article 35?

• AFor every new processing operation regardless of the risk level
• BOnly when processing genetic data in a research context
• CWhen processing is likely to result in a high risk to the rights and freedoms of natural…
• DOnly when the organisation has more than 250 employees

Under GDPR Article 28, when a controller engages a processor to process personal data, what is required?

• AA written data processing agreement (DPA) covering all GDPR Article 28(3) mandatory claus…
• BA verbal agreement confirming the processor has adequate data protection practices
• CRegistration of the processing relationship with the CNIL before processing begins
• DA DPIA must be completed before any processor can be engaged

Under GDPR Article 20, to which type of data does the right to data portability apply?

• APersonal data provided by the data subject and processed by automated means under consent…
• BAll personal data held by the controller, including inferred data and controller-generate…
• CPersonal data processed under a legal obligation or public task basis
• DAny personal data regardless of the lawful basis or whether it was provided by the data s…

The CNIL's sanctioning procedure was enhanced by French law n°2024-449 adopted in May 2024. Which new power did this law grant the CNIL?

• APower to seize documents and record declarations during dawn raids (inspections inopinées)
• BAuthority to impose criminal penalties including imprisonment for serious violations
• CExclusive jurisdiction over all GDPR enforcement in France, overriding EU cooperation mec…
• DAuthority to block French internet users from accessing non-compliant foreign websites

Under GDPR Article 38, which of the following BEST describes the required position of the DPO within an organisation?

• AThe DPO must report directly to the highest management level and must not receive instruc…
• BThe DPO must report to the head of the IT department to ensure technical oversight
• CThe DPO must be a member of the Board of Directors with shareholder accountability
• DThe DPO must be jointly employed by both the controller and the lead supervisory authority

What is the correct term in French law for the Data Protection Officer required under GDPR?

• ADirecteur de la Conformité (DC)
• BResponsable du Traitement (RT)
• CDélégué à la Protection des Données (DPD)
• DCorrespondant Informatique et Libertés (CIL)

Under GDPR Article 6(1)(f), a controller invokes legitimate interests as the lawful basis for processing. Which three-part test must be applied?

• APurpose test, necessity test, and balancing test
• BProportionality test, necessity test, and subsidiarity test
• CLegitimacy test, compatibility test, and transparency test
• DLegality test, fairness test, and accuracy test

A data subject requests access to their personal data held by a French controller. Under GDPR Article 15, what is the default deadline for the controller to respond?

• AOne month from receipt of the request, extendable by a further two months for complex req…
• B15 calendar days from receipt of the request
• C72 hours from receipt of the request
• DThree months from the date of the request with no extension available

Under GDPR Article 49, which of the following is NOT a derogation that may be used to justify an international transfer in the absence of an adequacy decision or Article 46 safeguards?

• AThe transfer is necessary for important reasons of public interest
• BThe data subject has given explicit consent to the proposed transfer after being informed…
• CThe transfer is necessary for the performance of a contract between the data subject and…
• DThe receiving country has implemented a data localisation law requiring data to be stored…

The French health data hosting regime requires a specific certification for entities hosting personal health data. What is this certification called?

• AHébergeur de Données de Santé (HDS)
• BISO 27001 Healthcare Edition (ISO-HE)
• CCertification Nationale Santé Numérique (CNSN)
• DAgrément Système d'Information de Santé (ASIS)

Under GDPR Article 5, which principle requires that personal data be 'adequate, relevant and limited to what is necessary' for the specified purposes?

• AData minimisation
• BPurpose limitation
• CStorage limitation
• DIntegrity and confidentiality

Under the GDPR and French Loi Informatique et Libertés, the processing of data relating to criminal convictions and offences requires which specific condition?

• AProcessing must be carried out only under the control of official authority or when autho…
• BA legitimate interest assessment approved by the CNIL
• CAn adequacy decision from the European Commission for all related processing
• DExplicit consent from the data subject must always be obtained regardless of other legal…

What is the CNIL's primary mechanism for providing guidance on high-risk processing operations before they are implemented?

• APrior consultation under GDPR Article 36 where a DPIA reveals high residual risk
• BBinding administrative circulars issued to all French controllers annually
• CMandatory pre-authorisation filings for all new data processing systems
• DPublic consultations held annually where organisations submit processing descriptions

Under GDPR Article 7, which of the following is required for consent to be 'valid' as a lawful basis?

• AConsent must be freely given, specific, informed, and unambiguous indication of the data…
• BConsent must be obtained through a signed paper form
• CConsent must be witnessed by a third party to be enforceable
• DConsent can be bundled with acceptance of general terms and conditions for efficiency

Which GDPR article establishes the 'accountability' principle obliging controllers to demonstrate compliance with GDPR principles?

• AArticle 5(2)
• BArticle 25
• CArticle 32
• DArticle 37

A French DPO discovers that a sub-processor engaged by the company's cloud provider is processing EU personal data in Brazil without a valid transfer mechanism. What is the MOST appropriate immediate action?

• AAdvise management that the processing chain must be suspended or remediated and document…
• BReport the sub-processor directly to the CNIL without informing the controller's manageme…
• CIssue a press release disclosing the transfer violation to the affected data subjects
• DApprove the transfer retroactively by documenting it in the records of processing activit…

Under GDPR Article 46, which mechanism allows personal data to be transferred to a third country that lacks an adequacy decision?

• AStandard Contractual Clauses (SCCs) adopted by the European Commission, supplemented by a…
• BA Transfer Impact Assessment (TIA) alone is sufficient without any additional safeguard
• CA Mutual Recognition Agreement between France and the receiving country
• DA self-certification declaration filed with both CNIL and the European Commission

What tasks does GDPR Article 39 assign to the designated DPO?

• AInforming and advising the controller, monitoring GDPR compliance, advising on DPIAs, coo…
• BSetting data retention periods and approving all processing agreements on behalf of the c…
• CApproving every data processing operation before it begins and issuing binding compliance…
• DReplacing the controller's legal representative and taking on personal liability for GDPR…

The CNIL has issued specific 'Référentiels' (sectoral frameworks) that controllers may use to simplify DPIA requirements. What is the legal effect of processing that fully complies with a CNIL Référentiel?

• AThe controller may take the position that there is no high residual risk and no mandatory…
• BThe CNIL issues an automatic adequacy certificate eliminating all future compliance oblig…
• CThe Référentiel replaces the need for a DPO designation entirely
• DProcessing under a Référentiel is exempt from all GDPR documentation requirements

Under GDPR Article 34, when must a controller communicate a personal data breach directly to affected data subjects?

• AIn all cases, within 24 hours of becoming aware of the breach
• BOnly if the breach affects more than 1,000 individuals
• CWhen the breach is likely to result in a high risk to the rights and freedoms of natural…
• DOnly when the CNIL specifically instructs the controller to notify affected data subjects

What is the concept of 'data protection by design and by default' under GDPR Article 25?

• AEncrypting all personal data as the only acceptable technical safeguard for GDPR complian…
• BCreating a separate legal entity to be responsible for data protection within each busine…
• CIntegrating data protection principles into processing systems and operations from design…
• DEmploying a minimum quota of data protection professionals for every 50 employees

A controller in France uses solely automated decision-making to reject loan applications. Under GDPR Article 22, which data subject right applies?

• ARight to erasure of the data used in the automated decision
• BRight to data portability of the algorithmic model used to make the decision
• CRight not to be subject to solely automated decisions producing significant effects, and…
• DRight to lodge a complaint with the European Commission rather than the CNIL

Under the GDPR and French implementation, what must happen when the DPO identifies a conflict of interest in their other roles within the same organisation?

• AThe conflict is automatically resolved by the DPO assuming priority over all competing ro…
• BThe DPO must be replaced by an external consultant hired specifically for each conflicted…
• CThe conflicted role must be addressed since a DPO cannot hold positions that cause them t…
• DThe controller must disclose the conflict only if specifically asked by the CNIL

The French Loi Informatique et Libertés provides a specific national derogation regarding the processing of biometric data in the employment context. What does this derogation allow?

• AUnrestricted employer use of biometric data once HR policies are updated
• BAutomatic lawful processing of biometric data by employers with more than 250 employees
• CProcessing of employee biometric data for access control where a collective agreement or…
• DProcessing of biometric data based solely on the employer's legitimate interest assessment

Under GDPR Article 13, when personal data is collected directly from the data subject, which information must be provided AT THE TIME of collection?

• AOnly the controller's name and contact details are required at collection time
• BThe information may be provided any time within 30 days of data collection
• CIdentity and contact details of the controller, DPO contact, processing purposes and lega…
• DOnly the processing purposes need to be stated; other details may be provided on request

Under GDPR Article 32, what standard must controllers and processors meet when implementing technical and organisational security measures?

• AImplementation of ISO 27001 certification is mandatory for all GDPR-regulated organisatio…
• BAll personal data must be encrypted using AES-256 and stored on EU-based servers only
• CMeasures appropriate to the risk, considering state of the art, implementation costs, nat…
• DSecurity measures must meet the minimum standards published annually by the ENISA

Under GDPR, the 'one-stop-shop' mechanism determines which supervisory authority leads cross-border investigations. For a controller with its EU main establishment in France, which authority is the lead supervisory authority?

• AThe EDPB, which takes over all enforcement for cross-border cases
• BThe supervisory authority where the majority of data subjects are located
• CThe CNIL, as the supervisory authority of the Member State where the controller's EU main…
• DThe supervisory authority of the country where the alleged violation occurred

For a DPIA to be valid under GDPR Article 35(7), which elements must it contain?

• AOnly a description of the processing operation and its intended duration
• BAn independent legal opinion and a cost-benefit analysis of processing alternatives
• CA systematic description of processing, assessment of necessity and proportionality, asse…
• DCertification from the CNIL that the DPIA methodology meets European standards

Under GDPR Article 9(2), which condition allows processing of special category data for employment-related purposes without explicit individual consent?

• AArticle 9(2)(a): explicit consent of the data subject
• BArticle 9(2)(e): data manifestly made public by the data subject
• CArticle 9(2)(b): necessary for carrying out obligations in employment law, subject to Uni…
• DArticle 9(2)(j): necessary for archiving in the public interest

A DPIA identifies that the residual risk of processing personal data remains high after all proposed mitigation measures. What action must the controller take under GDPR?

• AProceed with the processing but document the decision to accept the residual risk
• BObtain explicit consent from all affected data subjects before proceeding
• CConsult the supervisory authority (CNIL) under Article 36 before starting the processing
• DAppoint a DPO if one is not already in place and then proceed with processing

Under GDPR, which supervisory authority power under Article 58 allows the CNIL to temporarily or permanently ban processing?

• AInvestigative powers under Article 58(1)
• BAdvisory powers under Article 58(3)
• CCorrective powers under Article 58(2)(f)
• DAuthorisation powers under Article 58(3)(a)

Under the GDPR's accountability framework, a controller demonstrates compliance through which combination of measures?

• AAnnual self-assessment surveys submitted to the CNIL
• BCompliance certification issued by an accredited industry body every three years
• CData protection policies, staff training, RoPA, DPIAs, DPO designation where required, pr…
• DPublishing an annual data protection transparency report on the company website

Under GDPR Article 18, in which situation does a data subject have the right to restriction of processing?

• AWhenever the data subject disagrees with how their data is being used, without other cond…
• BOnly when the data subject has filed a complaint with the CNIL
• CWhere the accuracy of the data is contested, processing is unlawful but erasure is refuse…
• DOnly for processing based on consent, where the data subject has withdrawn consent

The CNIL is composed of how many members according to the current Loi Informatique et Libertés as amended?

• A7 members appointed by the Prime Minister
• B5 commissioners appointed by the European Commission
• C18 members drawn from elected assemblies, courts, and recognised experts
• D25 members, one per French region

Under GDPR Article 21, the right to object to processing based on legitimate interests must result in what controller action?

• AImmediate suspension of all processing until the data subject's objection is investigated
• BAutomatic erasure of all personal data related to the objecting data subject
• CContinuation of processing if the controller has compelling legitimate grounds overriding…
• DTransfer of processing responsibility to a third-party neutral processor

A French company's DPIA for a new employee monitoring system identifies a high residual risk to data subjects. The DPO must advise on next steps. Which sequence is CORRECT?

• ABegin processing immediately and notify the CNIL within 30 days of launch
• BObtain employee consent through the works council, then begin processing without CNIL con…
• CConsult the CNIL before starting processing, wait for CNIL opinion (up to 8 weeks), then…
• DImplement processing and document the high risk in the RoPA to satisfy GDPR accountability

Under the GDPR, what is the primary distinction between a 'controller' and a 'processor'?

• AA controller holds data on its own servers, while a processor holds data on cloud infrast…
• BA controller is always a large company; a processor is always a small vendor
• CA controller determines the purposes and means of processing; a processor processes data…
• DA controller manages consent; a processor manages data security

GDPR Article 14 requires information to be provided when data was not collected directly from the data subject. What is the standard time limit for providing this information?

• AAt the time of collection (same as Article 13)
• BWithin 7 days of the data being first used for the stated purpose
• CWithin a reasonable period not exceeding one month, or when first communicating with the…
• DThere is no time limit; information must be provided only if the data subject requests it