CIPT Privacy Incident Response and Breach Management

Question 1

What is the first step an organization should take upon discovering a potential privacy breach?

Accepted Answer

Contain the breach and preserve evidence

Answer

Notify all affected individuals immediately

Answer

Contact law enforcement agencies

Answer

Issue a public press release

Question 2

Under GDPR Article 33, within how many hours must a personal data breach be reported to the supervisory authority?

Accepted Answer

72 hours

Answer

24 hours

Answer

48 hours

Answer

96 hours

Question 3

Which of the following best defines a 'personal data breach' under GDPR Article 4(12)?

Accepted Answer

A security incident resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data

Answer

Any unauthorized access to a computer system

Answer

The loss of any device containing encrypted data

Answer

Any violation of an organization's internal data security policy

Question 4

What is the primary purpose of a privacy incident response plan?

Accepted Answer

To provide a structured approach for detecting, containing, and recovering from privacy incidents

Answer

To avoid regulatory fines by demonstrating documented compliance

Answer

To transfer breach liability to third-party data processors

Answer

To eliminate the need for cyber liability insurance

Question 5

Which factor is most critical when determining whether a breach requires notification to affected individuals?

Accepted Answer

The likelihood and severity of harm to affected individuals

Answer

The size of the organization experiencing the breach

Answer

Whether the media has already reported the incident

Answer

The cost of sending individual breach notifications

Question 6

What does 'containment' mean in the context of privacy incident response?

Accepted Answer

Stopping the breach from spreading and preventing further unauthorized access or exposure

Answer

Notifying all internal and external stakeholders about the breach

Answer

Documenting all categories of data that were compromised

Answer

Encrypting affected data systems after a breach has occurred

Question 7

Which type of data breach typically poses the HIGHEST risk to individuals' rights and freedoms?

Accepted Answer

Unauthorized disclosure of combined medical records and financial information enabling identity theft

Answer

Temporary loss of access to a public-facing website

Answer

Accidental email to a wrong internal address containing non-sensitive scheduling data

Answer

Loss of an encrypted device where no decryption key is known to exist