CIPT Privacy Incident Response and Breach Management

Question 1

What is the first step an organization should take upon discovering a potential privacy breach?

Accepted Answer

Contain the breach and preserve evidence

Answer

Containment is the first priority to stop further exposure, followed by evidence preservation to support investigation.

Question 2

Under GDPR Article 33, within how many hours must a personal data breach be reported to the supervisory authority?

Accepted Answer

72 hours

Answer

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of the breach, where feasible.

Question 3

Which of the following best defines a 'personal data breach' under GDPR Article 4(12)?

Accepted Answer

A security incident resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data

Answer

GDPR Article 4(12) defines a personal data breach as a security incident affecting the confidentiality, integrity, or availability of personal data.

Question 4

What is the primary purpose of a privacy incident response plan?

Accepted Answer

To provide a structured approach for detecting, containing, and recovering from privacy incidents

Answer

An incident response plan provides a systematic, pre-defined process to manage breaches efficiently and minimize harm to individuals.

Question 5

Which factor is most critical when determining whether a breach requires notification to affected individuals?

Accepted Answer

The likelihood and severity of harm to affected individuals

Answer

Most breach notification laws hinge on whether there is a reasonable risk of harm to individuals, making harm assessment the primary trigger.

CIPT - Certified Information Privacy Technologist Practice Test