A university based in the United States operates an online portal for international exchange programs, collecting personal identification details and financial records from European Union residents. Following a confirmed security incident involving unauthorized access to the application database, the compliance officer is determining legal breach notification duties. Which of the following obligations MUST the institution fulfill to satisfy regulatory compliance mandates? (Select TWO.)
- Notify the relevant supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach if it poses a risk to individuals.Answer
- Communicate the personal data breach to affected data subjects without undue delay when the incident is likely to result in a high risk to their rights and freedoms.Answer
- CEnforce an immediate technical lockout of all database service accounts for a mandatory 30-day statutory forensic cooling period.
- DReclassify all stored student financial records as Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA).
Answer
The organization must notify the competent supervisory authority within 72 hours of awareness if a risk exists, and communicate the breach to affected individuals without undue delay if a high risk to rights and freedoms is present.
Under international privacy frameworks like GDPR, organizations processing personal data of EU residents must fulfill dual notification obligations upon experiencing a qualifying breach. Data controllers must notify the supervisory authority within 72 hours if a risk to individuals exists, and directly inform affected data subjects without undue delay if the incident poses a high risk to their rights and freedoms.
Step-by-Step Solution
Key Concept
GDPR Breach Notification Rules and Timelines
Estimated Time:1m 30s