A company has implemented organisational and technical measures (such as staff training, internal data access controls, and encryption) to protect personal data, and notifies clients of a data breach two weeks after detection. What is the most accurate assessment of its GDPR compliance?

Question

BlackTom AI · Accepted Answer

Under GDPR Article 33, a controller must notify the supervisory authority of a personal data breach “without undue delay and, where feasible, not later than 72 hours” after becoming aware; Article 34 requires notifying data subjects when the breach is likely to result in a high risk to their rights and freedoms. Organisational and technical measures (training, access controls, encryption) are security obligations under Article 32 and reduce risk but do not replace the mandatory breach-reporting timeline.

1) Relevant knowledge points and concepts
- Article 32: controllers/processors must implement appropriate technical and organisational measures (e.g., training, access controls, encryption).
- Article 33(1): supervisory authority notification without undue delay and, where feasible, within 72 hours of awareness.
- Article 34: data subject notification required when breach likely to cause high risk; encryption can mitigate the need to notify data subjects if it makes the data unintelligible.

2) Step-by-step reasoning
- Company implemented measures (meets Article 32 obligations in part).
- Detection-to-notification interval = 14 days = 14 × 24 = 336 hours.
- GDPR target timeline = 72 hours.
- Time exceeded = 336 − 72 = 264 hours (11 days).

3) Intermediate steps shown (calculation above).

4) Why the correct answer is correct
- The organisation did implement technical/organisational safeguards (positive for compliance), but it failed to notify within the GDPR-required timeframe (72 hours). That failure means it did not fully comply with mandatory breach reporting, so overall assessment is partial compliance: good on measures, noncompliant on reporting.

5) Why other options are incorrect
- b (full compliance): incorrect because notification was far beyond 72 hours.
- c (non-compliance due to insufficient measures): incorrect because measures are described as implemented.
- d (partial compliance because notification was within acceptable timeframe despite insufficient measures): incorrect because notification was not within an acceptable timeframe and measures were not described as insufficient.

6) Conclusion
The most accurate assessment is option a: Partial compliance due to failure to meet mandatory breach reporting obligations despite having organisational and technical measures in place. This matches the provided answer.

类似问题

You are viewing a graph that plots the NPVs of a project to various discount rates that could be applied to the project's cash flows. What is the name given to this graph?

Assume the price of a product is $20, and the table below shows total costs for various levels of output. [table] Quantity | 0 | 1 | 2 | 3 | 4 | 5 | 6 Total Costs | $15 | $20 | $22 | $28 | $37 | $58 | $105 [/table] What is the profit when output is 1? (Do not use the dollar sign in your answer)

So far, how many in-class activities have you completed? 16 or more

From the list below, the best definition of the term 'excise tax' is

From the list below, the best definition of the word 'subsidy' is

An increase in a excise tax imposed on wine producers is likely to result in

更多留学生实用工具

智能学习助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单