hard20 pts · first answer countscomplianceincident-response

GDPR breach notification deadline

An EU customer database containing personal data was exfiltrated. Under GDPR Article 33, when must the controller notify the supervisory authority?

A.Only after the investigation is fully finishedB.Within 30 days of the breach happeningC.Without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to cause risk to peopleD.Never, if the data was encrypted in transit

← Detecting timestomping rundll32 with no arguments →