EUGDPRBreach NotificationEASYFree question
A ransomware attack that encrypts personal data and the organization has no backup constitutes:
- A.A breach only if ransom is paid, citing Article 4(12)'s definition of personal data breach, which requires proof that data was actually misused, not merely accessed
- B.An availability breach (and potentially a confidentiality breach if data was also exfiltrated)
- C.Only an IT security incident, not a GDPR breach
- D.Only a criminal matter
Why B is correct
Ransomware causing loss of data availability is a personal data breach. If data was also exfiltrated, it's also a confidentiality breach.
Know someone studying for GDPR? Send them this one.