GDPR Data Breach Management & Response Flashcards
6 cards from real GDPR practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 GDPR Data Breach Management & Response flashcards as text
Under GDPR Article 33, a personal data breach must be reported to the supervisory authority within what timeframe?
Answer: 72 hours of becoming aware of the breach
Article 33 requires controllers to notify the competent supervisory authority within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in risk.
Which GDPR article requires controllers to notify affected data subjects directly when a breach is likely to result in high risk?
Answer: Article 34
Article 34 mandates that controllers communicate a high-risk personal data breach to affected data subjects without undue delay.
Under Article 34(3), direct notification to data subjects may be waived if:
Answer: The controller has implemented appropriate technical measures rendering data unintelligible to unauthorized persons
Article 34(3)(a) allows omitting direct notification if appropriate protection measures, such as encryption, were applied such that the data is unintelligible to unauthorized parties.
What minimum information must a supervisory authority notification under Article 33(3) include?
Answer: The nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and measures taken
Article 33(3) specifies that the notification must describe the breach's nature, approximate numbers affected, likely consequences, and remedial measures, at minimum.
If a controller cannot provide all required breach notification information within 72 hours, what does GDPR permit?
Answer: The controller may provide information in phases without undue further delay
Article 33(4) allows phased notification where full information is not yet available, provided additional information is supplied without undue further delay.
Under GDPR, what internal record must controllers maintain for ALL personal data breaches, including those not reported to the DPA?
Answer: An internal breach register documenting facts, effects, and remedial action under Article 33(5)
Article 33(5) requires controllers to document all breaches internally, enabling supervisory authorities to verify compliance even for low-risk breaches not escalated to the DPA.