PLC Data Breach Response & Incident Management

Question 1

Under HIPAA, covered entities must notify affected individuals of a breach affecting their protected health information within how many days of discovering the breach?

Accepted Answer

60 days

Answer

30 days

Answer

45 days

Answer

90 days

Question 2

Under the GDPR (applicable to US companies with EU data subjects), a personal data breach must be reported to the supervisory authority within how many hours of becoming aware?

Accepted Answer

72 hours

Answer

24 hours

Answer

48 hours

Answer

96 hours

Question 3

Which US federal law requires financial institutions to notify customers of a security breach involving their personal financial information?

Accepted Answer

Gramm-Leach-Bliley Act (GLBA)

Answer

Sarbanes-Oxley Act

Answer

Fair Credit Reporting Act

Answer

Electronic Communications Privacy Act

Question 4

A company discovers that an employee accidentally emailed a spreadsheet containing 500 customers' Social Security numbers to the wrong recipient. What is the FIRST step in proper incident response?

Accepted Answer

Contain the incident and assess its scope

Answer

Immediately notify all 500 affected customers

Answer

File a police report

Answer

Notify the FTC within 24 hours

Question 5

Which of the following is NOT typically required in a state breach notification letter to affected individuals?

Accepted Answer

The name of the employee responsible for the breach

Answer

Description of what happened

Answer

Types of information involved

Answer

Contact information for further inquiries

Question 6

Under the California Consumer Privacy Act (CCPA), businesses that suffer a data breach exposing consumers' unencrypted personal information may face statutory damages of how much per consumer, per incident?

Accepted Answer

$100 to $750

Answer

$500 to $5,000

Answer

$1,000 to $10,000

Answer

$250 to $2,500