CISSP Security and Risk Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  72 hours

  Why this is correct

  Article 33(1) of the GDPR requires data controllers to notify the competent supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware of it." This timeframe applies specifically when the personal data breach is likely to result in a risk to the rights and freedoms of natural persons, ensuring prompt action to mitigate potential harm and facilitate regulatory oversight.

• ✗

  7 days

  Why it's wrong here

  A notification period of 7 days (168 hours) significantly exceeds the strict 72-hour deadline stipulated by Article 33(1) of the GDPR for reporting personal data breaches to the relevant supervisory authority. Such a prolonged delay would almost certainly be considered "undue delay" and could lead to severe non-compliance penalties, as prompt notification is crucial for mitigating potential harm to data subjects and demonstrating accountability.

• ✗

  24 hours

  Why it's wrong here

  While some sector-specific regulations or national laws, particularly in critical infrastructure or financial services, may impose a more stringent 24-hour breach notification requirement, the General Data Protection Regulation (GDPR) specifically sets the standard timeframe at 72 hours. Adhering to a 24-hour window for GDPR purposes would exceed the regulatory minimum but is not the mandated period, making it an incorrect answer for this specific regulation.

• ✗

  48 hours

  Why it's wrong here

  A 48-hour notification period, while seemingly prompt, does not align with the explicit requirements of the General Data Protection Regulation (GDPR) regarding personal data breach reporting. Article 33(1) clearly specifies a maximum of 72 hours for notifying the supervisory authority, making 48 hours an arbitrary and incorrect duration in this specific regulatory context and potentially leading to non-compliance if relied upon as the definitive timeframe.

Go deeper

Related to this question