CIPT (Certified Information Privacy Technologist) Practice

What does the GDPR require in the event of a data breach?

1. Organizations must notify affected individuals within 30 days

2. Organizations must notify the relevant authorities within 72 hours

3. Organizations may choose to notify at their discretion

4. Organizations must wait for 14 days before notifying anyone

The correct answer is: Organizations must notify the relevant authorities within 72 hours

The General Data Protection Regulation (GDPR) establishes clear protocols that organizations must follow in the event of a data breach. One of the key requirements is that organizations must notify the relevant supervisory authority within 72 hours of becoming aware of a breach. This swift reporting is designed to ensure that authorities can take necessary action to mitigate any potential harm to affected individuals and to help maintain public confidence in data protection practices. The 72-hour timeframe emphasizes the importance of timely communication in managing breaches effectively. This requirement also reflects the GDPR's commitment to transparency and accountability in the handling of personal data. Organizations are expected to have processes in place to detect breaches and to assess their severity promptly to comply with this regulation. The other options do not accurately represent the requirements set forth by the GDPR, as they either propose incorrect timeframes for notifying individuals or authorities or suggest that notification is optional, which undermines the fundamental principles of the regulation.