Privacy Incident Response and Breach Management Flashcards

What is the first step an organization should take upon discovering a potential privacy breach?

Answer: Contain the breach and preserve evidence

Containment is the first priority to stop further exposure, followed by evidence preservation to support investigation.

Under GDPR Article 33, within how many hours must a personal data breach be reported to the supervisory authority?

Answer: 72 hours

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of the breach, where feasible.

Which of the following best defines a 'personal data breach' under GDPR Article 4(12)?

Answer: A security incident resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data

GDPR Article 4(12) defines a personal data breach as a security incident affecting the confidentiality, integrity, or availability of personal data.

What is the primary purpose of a privacy incident response plan?

Answer: To provide a structured approach for detecting, containing, and recovering from privacy incidents

An incident response plan provides a systematic, pre-defined process to manage breaches efficiently and minimize harm to individuals.

Which factor is most critical when determining whether a breach requires notification to affected individuals?

Answer: The likelihood and severity of harm to affected individuals

Most breach notification laws hinge on whether there is a reasonable risk of harm to individuals, making harm assessment the primary trigger.

What does 'containment' mean in the context of privacy incident response?

Answer: Stopping the breach from spreading and preventing further unauthorized access or exposure

Containment involves isolating affected systems, revoking unauthorized access, and stopping additional data exposure before investigation begins.

Which type of data breach typically poses the HIGHEST risk to individuals' rights and freedoms?

Answer: Unauthorized disclosure of combined medical records and financial information enabling identity theft

Breaches exposing sensitive categories of data that can enable discrimination, identity theft, or financial harm pose the highest risk under GDPR risk-assessment criteria.