100+ Free CDPO/BR Practice Questions
Pass your IAPP Certified Data Protection Officer — Brazil (CDPO/BR) exam on the first try — instant access, no signup required.
The LGPD requires security measures to be 'compatible with the nature of the information processed and the risks.' This reflects which security standard approach?
Explore More IAPP Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
More From This Family
Videos and articles for deeper review.
Key Facts: CDPO/BR Exam
60 questions / 2 hours
Exam Format
IAPP
75% (45/60)
Passing Score
IAPP
10 legal bases
LGPD Processing Bases
LGPD Article 7
9 rights
Data Subject Rights (Article 18)
LGPD Article 18
R$50M / 2% Brazilian revenue
Max Fine per Infraction
LGPD Article 52
3 working days
Breach Notification Deadline
CD/ANPD 15/2024
The CDPO/BR LGPD exam consists of 60 multiple-choice questions in 2 hours, requires 75% (45/60) to pass, and is delivered entirely in Brazilian Portuguese. Candidates must also hold or pass the CIPM examination. The exam covers Brazil's LGPD from foundations through enforcement, with particular emphasis on how it differs from the GDPR.
Sample CDPO/BR Practice Questions
Try these sample questions to test your CDPO/BR exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.
1Brazil's Lei Geral de Proteção de Dados (LGPD) was originally enacted as which federal law?
2Which of the following activities is explicitly EXCLUDED from the LGPD's scope of application?
3Under the LGPD, how many legal bases exist for the lawful processing of personal data?
4A company needs to process personal data to fulfill a purchase contract entered into by a data subject. Which LGPD legal basis applies?
5Under the LGPD, consent as a legal basis for processing personal data must meet which standard?
6The LGPD recognises a legal basis called 'legitimate interest.' Which constraint applies specifically to this basis?
7Which category of data qualifies as 'sensitive personal data' under the LGPD?
8Under the LGPD, which legal bases may be used to process sensitive personal data? (Select the BEST answer.)
9A data subject submits a request to access all personal data held about them by a company. What does the LGPD require the controller to do?
10Which of the following is a data subject right recognized under LGPD Article 18?
About the CDPO/BR Exam
The IAPP CDPO/BR (Certified Data Protection Officer — Brazil) is the leading credential for privacy professionals working under Brazil's LGPD. The LGPD exam component tests knowledge of Brazil's Lei Geral de Proteção de Dados, including its ten legal bases, nine data subject rights, the encarregado role, ANPD enforcement powers, and international transfer mechanisms.
Questions
60 scored questions
Time Limit
2 hours
Passing Score
45/60 (75%)
Exam Fee
Included in CDPO/BR package (contact IAPP for pricing) (IAPP)
CDPO/BR Exam Content Outline
LGPD Foundations and Scope
Enactment history, territorial scope, personal and sensitive data definitions, ten processing principles, exclusions
Legal Bases for Processing
Ten Article 7 bases, Article 11 sensitive data bases, consent standards, credit protection, health tutelage, legitimate interest
Data Subject Rights under LGPD
Nine rights in Article 18, 15-day response timeline, automated decision review, portability, deletion exceptions
Roles: Controller, Operator, and Encarregado
Definitions, operator liability for deviations, encarregado duties and public disclosure obligations
ANPD Authority and Enforcement
ANPD creation and functions, Article 52 sanctions, fine dosimetry, graduated enforcement hierarchy
International Data Transfers
Adequacy decisions, ANPD SCCs, BCRs, specific contractual clauses, current adequacy status
Security and Incident Reporting
Article 46 security obligations, CD/ANPD 15/2024 notification framework, 3-working-day deadline, preliminary reports
How to Pass the CDPO/BR Exam
What You Need to Know
- Passing score: 45/60 (75%)
- Exam length: 60 questions
- Time limit: 2 hours
- Exam fee: Included in CDPO/BR package (contact IAPP for pricing)
Keys to Passing
- Complete 500+ practice questions
- Score 80%+ consistently before scheduling
- Focus on highest-weighted sections
- Use our AI tutor for tough concepts
CDPO/BR Study Tips from Top Performers
Frequently Asked Questions
What is the IAPP CDPO/BR exam format?
The CDPO/BR LGPD exam consists of 60 multiple-choice questions with a 2-hour time limit. Candidates must answer at least 45 of the 60 questions correctly (75%) to pass. All materials and questions are delivered in Brazilian Portuguese. Candidates must also hold or concurrently pass the CIPM examination.
What is the LGPD and why does it matter for the CDPO/BR?
The LGPD (Lei Geral de Proteção de Dados, Lei 13.709/2018) is Brazil's comprehensive personal data protection law, inspired by the GDPR. It provides ten legal bases for processing, nine data subject rights, requires controllers to appoint an encarregado (DPO), and is enforced by the ANPD. The CDPO/BR exam tests deep knowledge of the LGPD's structure, obligations, and enforcement mechanisms.
How does the LGPD differ from the GDPR?
The LGPD has ten legal bases for processing versus the GDPR's six, including unique bases for credit protection and health tutelage. The LGPD fines are based on Brazilian revenue (2%, capped at R$50 million) rather than global revenue (GDPR: 4% global). The LGPD lacks a direct equivalent to the GDPR's right to object. Breach notification uses a 3-working-day risk-based threshold rather than the GDPR's 72-hour rule.
What is the encarregado and what are their duties?
The encarregado is the Brazilian equivalent of the GDPR's Data Protection Officer (DPO), required by Article 41. Their duties include acting as the contact point for data subjects and the ANPD, receiving and handling privacy complaints, implementing ANPD communications, and guiding employees on data protection practices. The encarregado's contact information must be publicly disclosed.
What sanctions can the ANPD impose for LGPD violations?
Article 52 of the LGPD allows the ANPD to impose: warnings with corrective deadlines, simple fines up to 2% of Brazilian annual revenue (max R$50 million per infraction), daily fines, public disclosure of the infraction, blocking or deletion of the personal data involved, and partial or total suspension of database operations. More severe sanctions (suspension, prohibition) can only follow a prior lesser sanction in the same case.
How do LGPD international data transfers work?
Personal data may be transferred internationally through: ANPD adequacy decisions (no country has yet received one), ANPD-issued Standard Contractual Clauses (adopted without modification), Binding Corporate Rules for intra-group transfers, or specific contractual clauses approved by the ANPD. When none of these apply, controllers may rely on derogations such as explicit consent or contract necessity.