GDPR GDPR Data Breach Management & Response 2

Question 1

How does GDPR define a 'personal data breach' under Article 4(12)?

Accepted Answer

A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data

Answer

Article 4(12) defines a personal data breach broadly as a security incident that compromises the confidentiality, integrity, or availability of personal data.

Question 2

A laptop containing unencrypted patient records is stolen. Which category of personal data breach has occurred?

Accepted Answer

Confidentiality breach

Answer

Theft of an unencrypted device results in unauthorized access to data, making it a confidentiality breach where data is exposed to persons not authorized to see it.

Question 3

When a processor becomes aware of a personal data breach, what is their primary obligation toward the controller under Article 33(2)?

Accepted Answer

Notify the controller without undue delay

Answer

Article 33(2) requires processors to notify the controller without undue delay after becoming aware of a breach, enabling the controller to meet its own 72-hour DPA reporting window.

Question 4

Which factor is most critical in determining whether a data breach must be reported to the supervisory authority?

Accepted Answer

Whether the breach is likely to result in a risk to the rights and freedoms of natural persons

Answer

Article 33(1) ties the DPA notification obligation to the likelihood of risk to individuals' rights and freedoms, not to breach size or intent.

Question 5

A ransomware attack encrypts personal data but the controller has clean backups and restores data within hours with no evidence of exfiltration. Must the controller notify the DPA?

Accepted Answer

No, because data was restored and there was no disclosure to third parties

Answer

If data was not exfiltrated and was fully restored with minimal downtime, the breach may be unlikely to result in risk to individuals, potentially removing the DPA notification requirement, though internal documentation is still mandatory.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR GDPR Data Breach Management & Response 2