GDPR GDPR Data Breach Management & Response

Question 1

Under GDPR Article 33, a personal data breach must be reported to the supervisory authority within what timeframe?

Accepted Answer

72 hours of becoming aware of the breach

Answer

Article 33 requires controllers to notify the competent supervisory authority within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in risk.

Question 2

Which GDPR article requires controllers to notify affected data subjects directly when a breach is likely to result in high risk?

Accepted Answer

Article 34

Answer

Article 34 mandates that controllers communicate a high-risk personal data breach to affected data subjects without undue delay.

Question 3

Under Article 34(3), direct notification to data subjects may be waived if:

Accepted Answer

The controller has implemented appropriate technical measures rendering data unintelligible to unauthorized persons

Answer

Article 34(3)(a) allows omitting direct notification if appropriate protection measures, such as encryption, were applied such that the data is unintelligible to unauthorized parties.

Question 4

What minimum information must a supervisory authority notification under Article 33(3) include?

Accepted Answer

The nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and measures taken

Answer

Article 33(3) specifies that the notification must describe the breach's nature, approximate numbers affected, likely consequences, and remedial measures, at minimum.

Question 5

If a controller cannot provide all required breach notification information within 72 hours, what does GDPR permit?

Accepted Answer

The controller may provide information in phases without undue further delay

Answer

Article 33(4) allows phased notification where full information is not yet available, provided additional information is supplied without undue further delay.

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

(GDPR) Certified General Data Protection Regulation Specialist Practice Test

GDPR GDPR Data Breach Management & Response