CIPP/E common mistakes
CIPP/E · Understand the traps and how to avoid them.
Reaching for consent as the default Article 6 basis in every scenario, then bolting on a banner to justify it, rather than selecting the basis that actually fits the facts.
Consent is the most visible basis in consumer products and the most written about, so it becomes a reflex. Exam items are frequently set in employment, public-sector or contract-performance contexts where consent cannot be validly given or is simply unnecessary.
What to do instead
Before committing to an answer, run a short ladder: is there a legal obligation or a contract whose performance genuinely requires the processing? If consent is the candidate, test whether it can be freely given in this relationship (employment, public authority, bundled or conditional service). Learn the standard invalid-consent fact patterns and be able to state the Article 6(1) wording for whichever basis you choose.
Assigning controller/processor status from the label in the commercial contract (or from who holds the data), and overlooking that the parties may be joint controllers.
Contracts routinely name a vendor 'processor' regardless of how decisions are actually made, and candidates tend to treat the categories as mutually exclusive roles with no shared obligations.
What to do instead
Apply the factual test: who determines the purposes and the essential means? Where purposes and means are jointly determined, analyse Article 26 joint controllership instead of forcing a processor label. Then attach the correct obligations: Article 28 written terms, prior authorisation for sub-processors, assistance with rights and DPIAs, deletion or return, audit rights - and Article 82(2)-(3) liability allocation.
Answering questions about European data protection as though the GDPR were the only instrument in existence, ignoring the Convention 108/108+, the ePrivacy rules, the Law Enforcement Directive, the Charter and ECtHR case law, and national implementing law.
Most preparation time goes into the GDPR articles, while the first domain tests the layered legal landscape and the sector-specific instruments that displace or supplement the GDPR.
What to do instead
For each scenario, ask first which instrument governs this actor or sector: EU institutions and bodies (Regulation 2018/1725, supervised by the EDPS), police and criminal justice (Directive 2016/680), electronic communications traffic data and cookies (ePrivacy), Council of Europe states (Convention 108, modernised as 108+). Also be able to place the milestones - Convention 108 (1981), Directive 95/46, the Charter, the GDPR applying from 25 May 2018 - and to say why a regulation differs from a directive.
Collapsing the three breach notification duties into one - treating the 72 hours as running from the date of the incident, notifying data subjects in every case, or assuming the processor notifies the supervisory authority.
The 72-hour figure is the memorable part, while the trigger (awareness), the two different risk thresholds and the processor's separate duty are easily blurred under time pressure.
What to do instead
Keep the three duties deliberately separate: processor to controller without undue delay; controller to supervisory authority within 72 hours of becoming aware, unless unlikely to result in a risk; controller to data subjects without undue delay where the breach is likely to result in high risk, subject to the Article 34(3) exceptions. Add that all breaches must be documented internally regardless of notifiability.
Describing the DPO as a compliance decision-maker who can be given instructions, or asserting that a DPO is mandatory whenever an organisation processes personal data at any scale.
Many organisations appoint a DPO voluntarily or to satisfy customer expectations, and candidates map that practice onto the legal test; the independence and conflict-of-interest provisions are less intuitive than the triggers.
What to do instead
Memorise the three mandatory triggers with their qualifiers (public authority; core activities requiring regular and systematic large-scale monitoring; large-scale special category or criminal data as a core activity). Then state the role accurately: may be external or combined with another role only where no conflict arises, reports to the highest management level, must not be instructed on the exercise of the tasks, must be given resources, and must be involved properly and in time.
Treating standard contractual clauses or binding corporate rules as a self-executing permission to transfer, without assessing the third country's law and adding supplementary measures where needed.
Older shorthand equated 'SCCs signed' with 'transfer lawful', and the post-Schrems step of documenting a transfer impact assessment is procedural and easy to skip in a multiple-choice answer.
What to do instead
Answer transfers in a fixed chain and show each link: is there a transfer at all; is there an adequacy decision; if not, an Article 46 safeguard plus an assessment of the destination law and any supplementary measures; and only then, if none of the above fits, an Article 49 derogation. Note the exporter's accountability and documentation burden, and that BCRs need supervisory authority approval.
Using Article 49 derogations as the everyday transfer mechanism - for example asserting that employee consent or a group intra-company contract covers all routine transfers to a parent company outside the EEA.
Derogations are short, easy to memorise and easy to reach for when the transfer question looks hard, and their exceptional character is the part most often dropped.
What to do instead
Remember that derogations are exceptional and construed restrictively, and are not designed for repetitive, structural, large-volume transfers within a group. Explicit consent requires the individual to be informed of the risks and remains withdrawable; the contract-necessity derogation is narrow and occasional. If an answer relies on Article 49 for routine operations, that is a signal the answer is wrong.
Determining Article 3 territorial scope from where the servers are located or from whether a website is reachable from the EU, rather than from the establishment and targeting/monitoring tests.
The tests are fact-specific and exam items are deliberately written with a non-EU company, an EU-located server or a merely accessible website to bait each error.
What to do instead
Use a two-question sequence. First: is the processing carried out in the context of the activities of an EU establishment, regardless of where the processing occurs? Second, if there is no EU establishment: does the organisation offer goods or services to people in the Union (EU currency, language, delivery, references to EU customers) or monitor their behaviour (tracking, profiling, behavioural advertising)? Then recall the Article 27 representative duty and that an Article 3(2) controller does not get the one-stop-shop.
Assuming a DPIA is needed for all processing, or treating a completed DPIA as the end of the analysis when high residual risk remains.
The DPIA is the flagship accountability tool, so it is over-applied; the link forward to prior consultation is studied far less than the threshold itself.
What to do instead
Tie your answer to the actual threshold - processing likely to result in high risk - and be able to cite the listed triggers (systematic and extensive automated evaluation, large-scale special category or criminal data, systematic large-scale monitoring of a publicly accessible area) plus supervisory authority lists. Then state the sequencing: seek the DPO's advice, carry out the assessment before processing, review it when risk changes, and consult the supervisory authority under Article 36 if residual risk stays high.
Answering data subject rights questions with a single blanket rule - always one month, always free, everything must be erased - instead of the specific scope and exceptions for each right.
Rights are learned one at a time, so the deadlines, fee rules and exceptions blur together and the deviations are exactly what is tested.
What to do instead
Build a deviations table you can reproduce: one month, extendable by two further months with notice given within the first month; free of charge unless manifestly unfounded or excessive; access means confirmation, a copy and the Article 15 information; erasure is subject to the Article 17(3) exceptions; portability is limited to consent or contract bases, automated processing and data provided by the individual. Refusals must be reasoned and state the route to complaint and judicial remedy within one month.