CIPP/A common mistakes
CIPP/A · Understand the traps and how to avoid them.
Answers every 'what is the lawful basis' item with consent, rejecting scenarios where the organisation relies on a statutory alternative.
Candidates study GDPR first and carry over the reflex that consent is the default and safest basis, then fail to recognise named alternatives in Asian statutes.
What to do instead
Build a one-page lawful-basis matrix. Singapore PDPA: consent, deemed consent (contractual necessity, notification), legitimate interests, business improvement, research. Japan APPI: consent, opt-out notification for third-party provision, statutory exceptions. Hong Kong DPPO: consent is not the gatekeeper - DPP1 purpose and notice plus DPP3 use limitation govern. India DPDP Act 2023: consent plus enumerated legitimate uses.
Uses GDPR vocabulary ('controller', 'processor', 'data subject', 'supervisory authority') to interpret questions written in the local statutory terms.
The exam deliberately uses each jurisdiction's own terminology, and a candidate who maps words loosely misreads who owes which duty.
What to do instead
Memorise the term map: Hong Kong - data user, data subject, PCPD; Singapore - organisation, individual, PDPC, DPO; India - data fiduciary, data principal, Data Protection Board, consent manager; Japan - personal information handling business operator, retained personal data, PPC. Answer using the term the question used.
Describes APEC CBPR as a binding treaty, or as an adequacy finding that by itself makes an export lawful.
Candidates analogise to GDPR adequacy decisions and to legally binding instruments, missing that CBPR is voluntary, company-level certification.
What to do instead
State it precisely: CBPR is a voluntary accountability-based certification administered by accountability agents in participating APEC economies; PRP covers processors; obligations are made enforceable through contract, law or both. Certification supports a transfer but each domestic law still governs. Note the separate Global CBPR Forum launched in 2022.
Cannot reproduce the nine APEC Privacy Framework principles and substitutes OECD or GDPR principles such as 'lawful basis' or 'storage limitation'.
The framework is often skimmed once, and the nine principles have no single headline that makes them easy to recall under time pressure.
What to do instead
Memorise the nine verbatim: Preventing Harm, Notice, Collection Limitation, Uses of Personal Information, Choice, Integrity of Personal Information, Security Safeguards, Access and Correction, Accountability. Note that 'Preventing Harm' and 'Integrity' are the two most often forgotten and that Accountability is the principle CBPR operationalises.
Applies a consent requirement to every outbound transfer of personal data from Singapore.
Reflex from GDPR Chapter V and from PDPA consent rules; the PDPA's transfer provision is a separate obligation with its own standard.
What to do instead
Cite section 26 PDPA: an organisation must take reasonable steps to ensure the overseas recipient is bound by legally enforceable obligations to protect the data to a standard comparable to the PDPA. Consent is one route; contracts, binding corporate rules, APEC CBPR certification and comparable-protection certifications are others.
Gives the Singapore breach notification deadline as 72 hours to the PDPC.
The GDPR 72-hour figure is overlearned and the PDPA uses a different trigger and unit of time.
What to do instead
Recalibrate: notify the PDPC as soon as practicable and no later than three calendar days after the organisation determines the breach is notifiable; notify affected individuals without undue delay where the breach is likely to result in significant harm. Learn the notifiable tests - significant harm, or significant scale (500 or more individuals) - and the DPO/assessment-record duties.
Analyses a Hong Kong cross-border transfer as though section 33 of the PDPO restricts it.
Section 33 sits in the Ordinance and looks like a GDPR transfer chapter, so candidates assume it is operative and invent a consent or whitelist requirement.
What to do instead
Remember section 33 has never been brought into force. Hong Kong imposes no general cross-border restriction; the PCPD's recommended model data transfer clauses are voluntary. The real constraints are DPP1(3) notice of transfer purposes and classes of transferees, plus DPP3 use limitation and any sectoral rules.
Asserts a general right to erasure or 'right to be forgotten' under the PDPO, or gives a 30-day window for a data access request.
Importing GDPR data subject rights wholesale, and confusing the PDPO's access and correction regime with an erasure right.
What to do instead
Two corrections: the PDPO grants access and correction under DPP6 with a 40-day response period (subject to refusal grounds), not a standalone erasure right; erasure arises only under DPP2(2) once the purpose is fulfilled and no legal or contractual retention need remains. Cite the Privacy Commissioner's guidance on refusal grounds.
Treats the SPDI Rules 2011 as the operative Indian regime, or attributes a fixed 72-hour breach deadline to the DPDP Act 2023.
Sources are mixed across both instruments, the DPDP Act's rules are being phased in, and the GDPR number is an easy default.
What to do instead
Separate the layers: the IT Act 2000 and SPDI Rules 2011 remain relevant for legacy and sectoral issues (plus RBI, IRDAI, SEBI directions); the DPDP Act 2023 governs with consent, legitimate uses, notice, consent managers, significant data fiduciaries and cross-border transfer allowed unless the government restricts it by notification. Breach notice goes to the Data Protection Board and affected data principals 'without delay' - no fixed hours.
Uses 'anonymously processed information' and 'pseudonymised processed information' interchangeably under APPI, or treats both as fully outside the statute.
The 2020 amendments introduced both categories with near-identical names, and candidates remember only that one of them escapes most obligations.
What to do instead
Split them. Pseudonymised processed information stays personal information: internal-use purpose limitation and relaxed third-party rules apply, but security, supervision of employees and contractors, and breach handling still apply, and re-identification is prohibited. Anonymously processed information must meet PPC standards so that no individual can be identified and re-identification is impossible; only then do most obligations fall away.