CIPP-US - Introduction to the U.S. Privacy Environment (24% of the exam) - Section 1.3

Apply information management principles including data inventory, classification, flow mapping, and retention to support US privacy compliance.

Apply data inventory and data classification practices to identify what personal information an organisation holds, where it flows, and how long it is retained across the information lifecycle. Use data flow mapping to expose transfers to third parties and support accurate privacy notices and compliance gap analysis.

Data inventoryData classificationInformation lifecycleData flow mapping

Practice question for this objective

Free sampleIntroduction to the U.S. Privacy Environmentmedium

A privacy team has built a data flow map that traces customer personal information from a web sign-up form, through an internal database and an analytics warehouse, and out to a third-party email vendor. Leadership asks what this flow map, specifically, contributes to the information management programme that the team's other artefacts do not. Which TWO purposes does the data flow map most directly serve? (Select TWO.)

AIt assigns each category of personal information to a sensitivity tier so that handling controls scale with the data's risk.
BIt records a disposal trigger and retention period for each category so records are deleted once they are no longer needed.
CIt shows how and where personal data moves between systems and out to third parties, exposing undocumented or unexpected transfers. Correct
DIt serves as the authoritative catalogue of every category of personal information the business holds and names the owner accountable for each.
EIt locates the points where data crosses to other processors or jurisdictions, helping the team assess onward and cross-border transfer risk. Correct

A data flow map traces how personal data moves across systems and to third parties, exposing undocumented transfers and the transfer points where risk must be assessed. A flow map's distinctive value is depicting movement: it follows personal data through systems and out to external recipients, which is what surfaces undocumented exports and pinpoints onward and cross-border hand-offs for risk assessment. Sensitivity tiering belongs to classification, disposal triggers to the retention schedule, and the authoritative catalogue of categories and owners to the data inventory.

Why A is wrong: Assigning sensitivity tiers is the job of a data classification scheme, not a flow map, so this purpose belongs to a different artefact.

Why B is wrong: Tying categories to disposal triggers and retention periods is the function of a records retention schedule, which a flow map does not perform.

Why C is correct: Tracing movement between systems and to external recipients is the core purpose of a flow map and is exactly how hidden transfers surface.

Why D is wrong: Cataloguing what categories exist and assigning ownership is the role of the data inventory, so this describes the inventory rather than the flow map.

Why E is correct: By plotting each hand-off along the data's journey, the flow map highlights onward and cross-border transfer points where risk must be assessed.

See more CIPP-US practice questions, answers explained.

Exam traps in Introduction to the U.S. Privacy Environment

Answers that look right on this material and are not. Each one is a distractor from a different question in the CIPP-US bank for this domain.

A breach notification playbook that specifies the timing and content of consumer and regulator notices after a security incident
Why it is wrong: A breach playbook is a genuine programme component and may feel foundational because breach risk drives many decisions, but it presumes you already know what data exists; it does not catalogue holdings, so it cannot be the first anchoring deliverable.
It proves the company has minimised its data, because mapping the flows automatically reduces the number of systems that hold the records.
Why it is wrong: Tempting because mapping and minimisation are both good practice, but drawing a flow map does not delete or consolidate anything; it documents flows, so it cannot by itself prove minimisation, and the undocumented export shows data has in fact spread further.
It encrypts each personal data element automatically as the data moves between the systems shown on the map
Why it is wrong: A flow map is documentation, not a control that performs encryption; candidates may conflate mapping with safeguarding, but the map describes movement and does not itself secure the data in transit.

Examworthy is not affiliated with or endorsed by IAPP. Original, blueprint-aligned practice material only.