Centralised, local and hybrid are three answers to one question about where authority sits. What the business facts decide, what Article 37(2) and the DPO accessibility rule constrain, and why the rigorous-sounding answer is often the wrong one in a scenario.

Confidentiality, integrity and availability describe a system that resists attack. They say nothing about one that works exactly as designed and still exposes people. NIST wrote three further objectives for that gap, and knowing which capability is missing is how scenario questions get answered.

Where a model runs and how far it is adapted are governance decisions before they are technical ones. Cloud, on-premise and edge against as-is use, fine-tuning, retrieval and agentic designs, plus the point in the AI Act where adapting a system makes you its provider.

An organisation with no office, subsidiary or staff in Europe can still be fully bound by the GDPR. Article 3 settles that with two independent tests, and the representative obligation follows from only one of them. Where establishment ends and targeting begins, with the EDPB guidance that decides both.

The IAPP has announced no Body of Knowledge update for autumn 2026. The current versions for CIPP/E, CIPP/US, CIPM and CIPT, what changed in each, what the 90-day notice rule guarantees, and how to check which version you are holding.

A question can have four options that are all things a real organisation would do, for four different actors. Finding the right role before you read the options removes the near-misses that usually survive to the final two. Here is the habit, and a drill to build it.

Rules only attach once you have classified the object. This is the definition question hiding inside IAPP scenarios, how to spot it before you read the options, and a five-minute drill that retrains the habit on questions you have already answered.

The exam sometimes asks you to find the wrong option, not the right one. These negative questions punish autopilot. Here is how to spot the flip word, score each option true or false and tell an odd-one-out question from a ranking one.

Certification distractors are usually true statements about the wrong moment. This method separates knowledge errors from stage errors, and turns each domain into a timeline you can read under exam pressure.