GDPR for Employees Course (EU): Personal data breaches

1. Question 1 of 18

   Which of these is a personal data breach?

   • AA customer's details are emailed to the wrong person
   • BA colleague forgets their own password and asks for a reset
   • CA hacker's attack is blocked before it reaches any data
   • DA planned software update is installed on time as expected
   Show answer

   Answer: A. A customer's details are emailed to the wrong person

   A personal data breach includes unauthorised disclosure of personal data, even by accident (Article 4(12) GDPR).

2. Question 2 of 18

   Ransomware encrypts customer records so staff can no longer open them. What type of breach is this?

   • AAvailability breach
   • BConfidentiality breach
   • CIntegrity breach
   • DAccuracy breach
   Show answer

   Answer: A. Availability breach

   An availability breach is the accidental or unauthorised loss of access to, or destruction of, personal data.

3. Question 3 of 18

   Someone without permission changes the bank details in several employee records. What type of breach is this?

   • AAvailability breach
   • BConfidentiality breach
   • CPortability breach
   • DIntegrity breach
   Show answer

   Answer: D. Integrity breach

   An integrity breach is the unauthorised or accidental alteration of personal data.

4. Question 4 of 18

   You think you may have caused a data breach at work. What should you do first?

   • AContact the affected customers yourself
   • BFix it quietly so nobody needs to know
   • CReport it internally straight away, following your procedure
   • DWait a few days until you are sure
   Show answer

   Answer: C. Report it internally straight away, following your procedure

   The controller has strict deadlines, so possible breaches must be reported internally at once to the right contact, following your procedure.

5. Question 5 of 18

   Where feasible, within how many hours of becoming aware must the controller notify the authority of a breach?

   • A72 hours
   • B168 hours (7 days)
   • C24 hours
   • D48 hours
   Show answer

   Answer: A. 72 hours

   Article 33(1) GDPR: without undue delay and, where feasible, not later than 72 hours after becoming aware of it.

6. Question 6 of 18

   Who does the controller notify about a personal data breach under Article 33?

   • AThe organisation's own bank and insurer
   • BThe European Commission in Brussels
   • CThe local police station, in every case
   • DThe data protection authority
   Show answer

   Answer: D. The data protection authority

   Article 33 GDPR requires notification to the competent supervisory authority, which is the national data protection authority.

7. Question 7 of 18

   In which case may a controller decide not to notify the authority of a breach?

   • AWhen fewer than ten people's data were affected
   • BWhen it happened during a weekend or public holiday
   • CWhen it is unlikely to result in a risk to people
   • DWhen it was caused by a mistake made by an employee
   Show answer

   Answer: C. When it is unlikely to result in a risk to people

   Article 33(1) GDPR: notification is not needed if the breach is unlikely to result in a risk to people's rights and freedoms. It must still be documented.

8. Question 8 of 18

   When must the affected people themselves be told about a breach?

   • AWhen it is likely to result in a high risk to them
   • BOnly if they contact the organisation and ask about it
   • CIn every case, even when there is no risk to them at all
   • DOnly after the authority has fined the organisation
   Show answer

   Answer: A. When it is likely to result in a high risk to them

   Article 34(1) GDPR: people must be told without undue delay when the breach is likely to result in a high risk to their rights and freedoms.

9. Question 9 of 18

   Which breaches must the controller document?

   • AOnly those caused by cyber attacks
   • BOnly those affecting 100 or more people
   • COnly those notified to the authority
   • DAll of them, even those not notified
   Show answer

   Answer: D. All of them, even those not notified

   Article 33(5) GDPR requires the controller to document every personal data breach, its effects and the action taken, even if it is not notified.

10. Question 10 of 18

    A processor discovers a breach of data it handles for a controller. What must it do?

    • AWait until the controller asks about it
    • BTell the people affected before anyone else
    • CTell the controller without undue delay
    • DFix it and tell nobody if it was only small
    Show answer

    Answer: C. Tell the controller without undue delay

    Article 33(2) GDPR: the processor notifies the controller without undue delay after becoming aware of a breach.

11. Question 11 of 18

    An encrypted tablet is stolen. The key was not stolen and there is a backup. What does the EDPB say?

    • ADocument it; people generally need not be told
    • BNothing at all needs to be done or recorded
    • CReport it to the police and to the national press
    • DWrite to every customer at once to tell them
    Show answer

    Answer: A. Document it; people generally need not be told

    If strong encryption keeps the data unintelligible, telling people is generally not required, but every breach must be documented.

12. Question 12 of 18

    An unencrypted laptop with no password, holding the names, addresses and dates of birth of over 100,000 customers, is stolen. What does the EDPB say should happen?

    • AOnly tell customers if they complain about fraud later
    • BNotify the authority and tell the customers
    • COnly write it down in the internal breach log
    • DOnly buy a new laptop for the employee concerned
    Show answer

    Answer: B. Notify the authority and tell the customers

    Without encryption or a password the data is easy to access, and customers could suffer identity fraud. The risk is high, so the authority must be notified and the customers told.

13. Question 13 of 18

    The controller does not yet have all the facts about a breach when the 72 hours run out. What should it do?

    • ADecide not to notify, because facts are still missing
    • BWait until every fact is known before notifying
    • CNotify anyway and add details in phases
    • DAsk the authority for a 30-day extension first
    Show answer

    Answer: C. Notify anyway and add details in phases

    The EDPB says information may be given in phases if it is not all available within 72 hours.

14. Question 14 of 18

    A controller becomes aware of a breach on Tuesday at 10:00. Where feasible, what is the latest time to notify the authority?

    • AThursday 10:00
    • BFriday 10:00
    • CFriday 18:00
    • DSaturday 10:00
    Show answer

    Answer: B. Friday 10:00

    72 hours after Tuesday 10:00 is Friday 10:00 (3 days x 24 hours).

15. Question 15 of 18

    A company's worldwide annual turnover is €900 million. What is the highest fine in the top band (€20 million or 4%, whichever is higher)?

    • A€9 million
    • B€20 million
    • C€36 million
    • D€18 million
    Show answer

    Answer: C. €36 million

    4% of €900 million is €36 million, which is higher than €20 million, so €36 million is the maximum.

16. Question 16 of 18

    Read the description. What type of breach is this?

    Marek works at the reception of Linden Physiotherapy. On Monday at 11:20 he meant to send a supplier an order form. By mistake he attached a list of 120 patients with their names, phone numbers and treatment notes, and sent it to orders@supplyhouse.example.com. He noticed the mistake at 11:35.

    • AAvailability breach
    • BNo breach, because it was an accident
    • CConfidentiality breach
    • DIntegrity breach
    Show answer

    Answer: C. Confidentiality breach

    Personal data was disclosed to someone not authorised to see it. That is a confidentiality breach, even if accidental.

17. Question 17 of 18

    Read the description. What should Marek do now?

    Marek works at the reception of Linden Physiotherapy. On Monday at 11:20 he meant to send a supplier an order form. By mistake he attached a list of 120 patients with their names, phone numbers and treatment notes, and sent it to orders@supplyhouse.example.com. He noticed the mistake at 11:35.

    • ATell his manager or data protection contact at once
    • BDelete the email from his Sent folder to hide it
    • CPhone each of the 120 patients himself to apologise
    • DWait to see whether the supplier replies about it
    Show answer

    Answer: A. Tell his manager or data protection contact at once

    Staff should report a possible breach internally straight away so the controller can assess it and meet the 72-hour deadline.

18. Question 18 of 18

    Read the description. Why is this breach likely to be treated as more serious?

    Marek works at the reception of Linden Physiotherapy. On Monday at 11:20 he meant to send a supplier an order form. By mistake he attached a list of 120 patients with their names, phone numbers and treatment notes, and sent it to orders@supplyhouse.example.com. He noticed the mistake at 11:35.

    • AMarek noticed it within an hour
    • BThe email was sent before lunchtime
    • CThe treatment notes are health data, a special category
    • DThe supplier's address ends in .com
    Show answer

    Answer: C. The treatment notes are health data, a special category

    Treatment notes are data concerning health, a special category, so the risk to patients is higher.

Keyboard: 1–4 to answer, Enter for the next question.