ISC2 CC Practice Question: Business Continuity, Disaster Recovery, and Incident Response
During a data breach incident, the incident response team discovers that personally identifiable information (PII) of European Union residents was compromised. According to GDPR, what is the maximum time frame for notifying the supervisory authority?
⚠ Common exam trap
The trap is the recurring '48 hours' distractor — candidates who confuse GDPR's 72-hour rule with other regimes (or with the 24/48-hour options) pick the wrong value.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
72 hours
GDPR Article 33 mandates that a controller notify the competent supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to natural persons' rights and freedoms. This is the maximum allowable window under the regulation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
72 hours
Why this is correct
GDPR Article 33 requires notification of a personal data breach to the supervisory authority within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to rights and freedoms. This fixed deadline satisfies the stem's EU-resident PII constraint.
- ✗
48 hours
Why it's wrong here
GDPR sets a 72-hour notification window, so 48 hours misstates the deadline. It is tempting because it sits close to the real figure, and other frameworks use 48-hour or similar windows, making the number feel plausible without matching Article 33.
- ✗
7 days
Why it's wrong here
GDPR mandates notification within 72 hours, so 7 days exceeds the permitted window. It is tempting because weekly reporting cycles are common in internal incident handling, but supervisory authority notification is bound by the stricter 72-hour limit.
- ✗
24 hours
Why it's wrong here
GDPR requires notification within 72 hours of becoming aware of the breach, so 24 hours is shorter than the regulation permits. It is tempting because tighter deadlines appear in other regimes, such as the 24-hour notification some US state laws impose.
Go deeper
Related to this question
Learn chapter
Incident Response and Management
Key term
Personally identifiable information
Personally identifiable information (PII) is any data that can be used to identify, contact, or locate a specific individual, either alone or when combined with other information.
Key term
GDPR
The General Data Protection Regulation (GDPR) is a European Union law that sets strict rules for how organizations collect, store, process, and protect the personal data of individuals within the EU.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.