AIGP IAPP Artificial Intelligence Governance Professional Free Practice Exam Questions (2026 Updated)

Genetic and health information are special categories of personal data under Article 9 of the GDPR, for which processing is generally prohibited unless a valid Article 9 exception applies. Among the available answers, explicit consent provides the clearest applicable condition: Article 9(2)(a) permits processing where the data subject has explicitly consented to processing for specified purposes. Importantly, explicit consent is not the only possible legal condition under the GDPR; scientific research and healthcare processing may sometimes rely on other Article 9 conditions where applicable law and safeguards permit. However, A merely describing a preventive-medicine purpose does not itself establish the necessary legal condition. D is irrelevant because EU establishment and non-cloud processing do not establish lawfulness. B would materially change the analysis only if the data were genuinely anonymized so that they were no longer personal data.

================

Under the EU AI Act, organizations that develop and deploy high-risk AI systems are required to provide several key disclosures to ensure transparency and accountability. These include the human oversight measures employed, how individuals can contest decisions made by the AI system, and informing individuals that an AI system is being used. However, there is no specific requirement to disclose the exact locations where data is stored. The focus of the Act is on the transparency of the AI system ' s operation and its impact on individuals, rather than on the technical details of data storage locations.

The correct answer isD. Personalized content and advertisements, as long as properly disclosed and non-deceptive, arenot generally a consumer protection issueunder current legal regimes.

From the AI Governance in Practice Report 2025 (Consumer Protection Section):

“Standard practices like targeted advertising and recommendations are widely accepted provided they comply with transparency and consent requirements.”

Meanwhile, credit decision-making and misleading AI performance claims (Answers A and B) havealready led to regulatory enforcement.

The AIGP ILT Guide highlights:

“Deceptive claims, biased financial decisions, and unauthorized data use may violate consumer protection and privacy laws. Advertising personalization is routine but must be disclosed appropriately.”