GDPR GDPR Data Breach Management & Response

Question 1

Under GDPR Article 33, a personal data breach must be reported to the supervisory authority within what timeframe?

Accepted Answer

72 hours of becoming aware of the breach

Answer

24 hours of discovery

Answer

7 days of discovery

Answer

Immediately upon detection

Question 2

Which GDPR article requires controllers to notify affected data subjects directly when a breach is likely to result in high risk?

Accepted Answer

Article 34

Answer

Article 33

Answer

Article 35

Answer

Article 32

Question 3

Under Article 34(3), direct notification to data subjects may be waived if:

Accepted Answer

The controller has implemented appropriate technical measures rendering data unintelligible to unauthorized persons

Answer

The breach involves fewer than 100 individuals

Answer

The breach has already been covered in the news

Answer

The DPO has certified the breach is low priority

Question 4

What minimum information must a supervisory authority notification under Article 33(3) include?

Accepted Answer

The nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and measures taken

Answer

Only the controller's name and contact details

Answer

A full forensic report

Answer

A copy of all affected data records

Question 5

If a controller cannot provide all required breach notification information within 72 hours, what does GDPR permit?

Accepted Answer

The controller may provide information in phases without undue further delay

Answer

The notification is invalid and must be re-submitted after full investigation

Answer

The controller may delay notification entirely until the investigation is complete

Answer

Only the DPO may decide to withhold notification

Question 6

Under GDPR, what internal record must controllers maintain for ALL personal data breaches, including those not reported to the DPA?

Accepted Answer

An internal breach register documenting facts, effects, and remedial action under Article 33(5)

Answer

A public breach register on their website

Answer

A breach log submitted to the EDPB annually

Answer

A breach summary forwarded to each affected data subject