ISC2 CC Practice Question: Business Continuity, Disaster Recovery, and Incident Response
A healthcare organization experiences a data breach involving protected health information (PHI). Under GDPR, within how many hours must the organization notify the relevant supervisory authority?
⚠ Common exam trap
Candidates often confuse GDPR's 72-hour supervisory authority notification with other breach-notification timelines (such as 24 hours under some sectoral rules or 30/60 days under HIPAA), causing candidates to select a shorter or longer window than Article 33 actually specifies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
72 hours
Under GDPR Article 33, a controller must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. PHI constitutes personal data under GDPR, so the 72-hour clock applies. This deadline is a maximum; notification should occur as soon as possible within that window.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
24 hours
Why it's wrong here
GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach. 24 hours is tempting because it mirrors shorter sectoral rules, such as the breach notification deadline under HIPAA, but GDPR itself sets 72 hours.
- ✗
48 hours
Why it's wrong here
GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach, so 48 hours states the wrong figure. It is tempting because it is shorter than the deadline, appearing to describe a stricter, safer obligation.
- ✓
72 hours
Why this is correct
72 hours is the maximum period under GDPR Article 33(1) for notifying a supervisory authority of a personal data breach, counted from awareness. This satisfies the stem's PHI breach scenario, since the regulation sets a single deadline regardless of sector; healthcare organisations must also document the breach internally.
- ✗
7 days
Why it's wrong here
GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach. Seven days exceeds that deadline, so it fails the scenario. The 7-day figure is tempting because some other regimes, such as certain US state laws, permit longer notification windows.
Go deeper
Related to this question
Learn chapter
Risk Management and Security Controls
Key term
GDPR
The General Data Protection Regulation (GDPR) is a European Union law that sets strict rules for how organizations collect, store, process, and protect the personal data of individuals within the EU.
Key term
PHI
PHI stands for Protected Health Information, which is any health data that can identify an individual and is protected by the Health Insurance Portability and Accountability Act (HIPAA).
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.