EUGDPRBreach NotificationEASYFree question
What must a controller do with all personal data breaches regardless of whether they are reported to the supervisory authority?
- A.Document the breach, including the facts, effects, and remedial actions taken under Article 33(5)
- B.Nothing if they are not reported
- C.Only inform the DPO verbally
- D.Post the breach details on the company website
Why A is correct
Article 33(5) requires the controller to document any personal data breaches, including the facts, effects, and remedial action taken, regardless of whether the breach meets the notification threshold. This documentation enables the supervisory authority to verify compliance.
Know someone studying for GDPR? Send them this one.