CS0-003 Reporting and Communication Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  7 days

  Why it's wrong here

  A seven-day window significantly exceeds the strict timeline mandated by the General Data Protection Regulation (GDPR) for reporting data breaches. While some national frameworks or non-EU regulations allow for longer reporting periods, relying on a one-week threshold would place an organization in direct non-compliance with European standards, potentially resulting in severe administrative fines.

• ✗

  24 hours

  Why it's wrong here

  Although a 24-hour reporting window is enforced by certain sector-specific regulations, such as those governing critical infrastructure or specific telecommunications providers, it is not the standard baseline for GDPR compliance. Attempting to meet this ultra-short deadline globally may lead to incomplete forensic investigations and inaccurate initial reports to supervisory authorities.

• ✗

  48 hours

  Why it's wrong here

  A 48-hour notification period is incorrect because it does not align with the standard regulatory timeline established by the European Union. While some internal corporate incident response plans target a 48-hour window to allow for internal review before the official regulatory deadline, it is not the legally mandated timeframe under GDPR Article 33.

• ✓

  72 hours

  Why this is correct

  Under Article 33 of the GDPR, organizations must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. If the notification is delayed beyond this window, the controller must provide a reasoned justification for the delay.

Go deeper

Related to this question