A personal data breach has occurred, and the controller is writing a draft notification for the supervisory authority. The following information is already in the notification: - The nature of the…

Question

Options

• AInformation of local and national authorities that were informed about the data breach.
• BName and contact details of the data subjects whose data may have been breached
• CSuggested measures to mitigate the adverse consequences of the data breach.
• DThe information needed to access the personal data that have been breached.

• B
  3% (1)
• C
  94% (33)
• D
  3% (1)

Explanation

Information of local and national authorities that were informed about the data breach. Incorrect. The supervisory authority must be made aware of reports to supervisory authorities in other EEA countries. Reports to local authorities, for instance the police, do not need to be reported. Name and contact details of the data subjects whose data may have been breached. Incorrect. The supervisory authority requires an estimate of the number of data subjects involved, not their Suggested measures to mitigate the adverse consequences of the data breach. Correct. The controller should add suggested measures to mitigate the adverse consequences of the data breach. (Literature: A, Chapter 7; GDPR Article 33(q)) The information needed to access the personal data that have been breached. Incorrect. The supervisory authority needs to know the type of personal data involved, but does not need access to the data themselves.

No community discussion yet for this question.