EUGDPRBreach NotificationEASYFree question
When must a controller communicate a personal data breach to data subjects under Article 34?
- A.For every breach, regardless of risk
- B.Only if the media has reported on the breach
- C.Only if the data subjects request it
- D.When the breach is likely to result in a high risk to the rights and freedoms of natural persons
Why D is correct
Article 34(1) requires communication to data subjects when the breach is likely to result in a high risk to their rights and freedoms, a higher threshold than the notification to the supervisory authority which requires only a 'risk'.
Know someone studying for GDPR? Send them this one.