Study guide
3.1 Key Definitions & Material/Territorial Scope
CIPP/E — Certified Information Privacy Professional/Europe Exam
Track your progress as you read
Finished sections get a check mark.
1 CIPP/E Exam Map & Strategy
1.1 Current Exam Facts 1.2 Why CIPP/E & Who Takes It 1.3 The Body of Knowledge Blueprint 1.4 How CIPP/E Items Are Written 1.5 Study Plan & Test Strategy
2 Introduction to European Data Protection
2.1 Origins & Rationale of EU Data Protection 2.2 Human-Rights Framework 2.3 EU Institutions & Legislative Process 2.4 From the 1995 Directive to the GDPR 2.5 Sources of EU Law & Key CJEU Cases
3 GDPR Core Law: Principles, Bases & Rights
3.1 Key Definitions & Material/Territorial Scope 3.2 The Seven Principles (Art. 5) 3.3 The Six Lawful Bases (Art. 6) & Consent (Art. 7) 3.4 Data Subject Rights (Art. 12-22) 3.5 Controller & Processor Obligations + Security
4 Data Processing in Context & International Transfers
4.1 Processing Employee Data 4.2 Surveillance & Direct Marketing 4.3 International Transfer Fundamentals (Ch. V) 4.4 Transfer Mechanisms & Safeguards 4.5 Outsourcing, Cloud & Vendor Management
5 Compliance, Supervision, Enforcement & Final Readiness
5.1 DPO & DPIA 5.2 Personal Data Breach Notification 5.3 Supervisory Authorities, EDPB & One-Stop-Shop 5.4 Enforcement, Remedies & Fines 5.5 Integrated Practice & Final Readiness
3.1 Key Definitions & Material/Territorial Scope
Key Takeaways Explain This Topic AI
Personal data (Art. 4(1)) is any information relating to an identified or identifiable natural person; the GDPR protects living individuals only, not legal persons or the deceased
Special category data (Art. 9) covers racial/ethnic origin, political opinions, religious/philosophical beliefs, trade-union membership, genetic data, biometric data used for identification, health, sex life, and sexual orientation
Pseudonymised data is still personal data and in scope; only truly anonymised data falls outside the GDPR (Recital 26)
Territorial scope (Art. 3) reaches non-EU controllers via the establishment test (Art. 3(1)) and the targeting test (Art. 3(2): offering goods/services to, or monitoring, EU data subjects)
Last updated: June 2026
Why Definitions Decide the Question
Quick Answer: Most CIPP/E questions are won or lost on definitions. Before you can pick a lawful basis or a data subject right, you must establish that the data is personal data , decide whether it is a special category under Article 9, and assign each party a role as controller or processor . The General Data Protection Regulation (GDPR) is Regulation (EU) 2016/679, applicable since 25 May 2018.
The CIPP/E (Certified Information Privacy Professional/Europe) is administered by the International Association of Privacy Professionals (IAPP) . The exam is 90 multiple-choice questions (75 scored, 15 unscored pre-test items), delivered in 2.5 hours , and scored on a scaled range of 100–500 with 300 to pass . A large share of those 75 scored items reduce to a definitional judgement, so Article 4 vocabulary is the highest-leverage material in Module 3.
The definitions in Article 4 are the grammar of the entire regulation. Examiners deliberately write scenarios where the wrong definition leads to a plausible-but-wrong answer, so precision beats rote memorisation.
Personal Data and Identifiability
Personal data (Art. 4(1)) is any information relating to an identified or identifiable natural person (the data subject ). A person is identifiable if they can be singled out directly or indirectly — by name, identification number, location data, an online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.
What the exam tests:
The GDPR protects living natural persons only. It does not cover the deceased (though Member States may legislate, e.g., Italy and Denmark) or legal persons such as companies.
Online identifiers — IP addresses, cookie IDs, advertising IDs, device fingerprints — are personal data when they allow singling out (CJEU Breyer confirmed dynamic IPs can be personal data for a website operator with lawful means to obtain the identity).
Identifiability turns on the means reasonably likely to be used, considering cost, time, and available technology (Recital 26). A purely theoretical re-identification risk does not make data personal.
A worked example: a sandwich shop loyalty number tied to a name is plainly personal data. A salary figure with no link to an individual is not — but the same figure becomes personal data the moment it sits in a row labelled by employee. Context, not the data point alone, decides.
Processing, Controller and Processor
Processing (Art. 4(2)) is any operation performed on personal data: collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, alignment, restriction, erasure — even mere holding. The definition is deliberately exhaustive, so almost any handling counts.
Role assignment is the single most frequent exam trap. Roles are functional, not contractual: a party that calls itself a "processor" is a controller if it actually decides the purposes (why) and essential means (the core how).
Role Definition (Art. 4) Diagnostic question
Controller Determines the purposes and means of processing Who decides why and how?
Processor Processes personal data on behalf of the controller Who acts only on instructions?
Joint controllers (Art. 26) Jointly determine purposes and means Do two parties decide together?
Recipient Any party to whom data is disclosed Who receives the data?
Third party Not the subject, controller, processor, or staff under their authority Who is outside the controller's authority?
A cloud host that only follows client instructions is a processor . A payroll bureau that independently sets retention periods or repurposes data becomes a controller for those decisions. CJEU Fashion ID established that a website embedding a Facebook "Like" button is a joint controller with Facebook for the collection and transmission of visitor data, even though it never sees the data afterwards.