EUGDPRBreach NotificationEASYFree question
Must all personal data breaches be reported to the supervisory authority?
- A.Yes, every breach must be reported
- B.Only breaches involving more than 100 individuals
- C.No, only breaches that are likely to result in a risk to the rights and freedoms of natural persons
- D.Only breaches involving financial data
Why C is correct
Article 33(1) requires notification only where the breach is likely to result in a risk to the rights and freedoms of natural persons. If the breach is unlikely to result in such a risk, notification is not required but the breach must still be documented.
Know someone studying for GDPR? Send them this one.