CISSP Security and Risk Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Notify the supervisory authority within 72 hours

  Why this is correct

  GDPR Article 33 mandates that in the event of a personal data breach, the data controller must notify the relevant supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it. This notification is required unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. The notification must include details such as the nature of the breach, categories of data subjects and records concerned, and the likely consequences.

• ✗

  Conduct a privacy impact assessment within 30 days

  Why it's wrong here

  A Data Protection Impact Assessment (DPIA), often referred to as a Privacy Impact Assessment (PIA), is a proactive requirement under GDPR Article 35. It must be conducted prior to processing operations that are likely to result in a high risk to the rights and freedoms of natural persons, such as large-scale processing of special categories of data or systematic monitoring. A DPIA is not a post-breach remediation step, nor is there a specific 30-day timeframe for its completion after a breach.

• ✗

  Report the breach to law enforcement immediately

  Why it's wrong here

  GDPR primarily mandates notification to the relevant supervisory authority, not directly to law enforcement, following a data breach. While organizations have a general obligation to report criminal activity, GDPR Article 33 does not explicitly require immediate notification to law enforcement unless the breach itself involves suspected criminal activity that falls under their jurisdiction, such as cybercrime. The focus is on regulatory compliance and protecting data subjects' rights, not criminal investigation by default.

• ✗

  Notify affected individuals within 24 hours

  Why it's wrong here

  Under GDPR Article 34, notification to affected individuals is only required if the personal data breach is likely to result in a high risk to their rights and freedoms. This notification must be communicated without undue delay, but there is no specific 24-hour deadline. Furthermore, this is distinct from the 72-hour deadline for notifying the supervisory authority, and the threshold for individual notification is higher than for the supervisory authority.

Go deeper

Related to this question