CDPSE Incident Response 2 — Questions and Answers
Question 1: Under the GDPR, what is the maximum time allowed to notify the supervisory authority after becoming aware of a personal data breach?
- 24 hours
- 48 hours
- 72 hours (Correct answer)
- 7 days
Correct answer: 72 hours
GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.
Question 2: Which element is MOST critical to include in an initial breach notification to affected individuals?
- The financial cost of the breach to the organization
- The name of the employee who caused the breach
- Steps individuals can take to protect themselves (Correct answer)
- A complete technical root-cause analysis
Correct answer: Steps individuals can take to protect themselves
Notifications to individuals must include actionable steps they can take to mitigate potential harm to themselves.
Question 3: A company discovers that encrypted backup tapes containing personal data were lost during shipping. Under most privacy frameworks, what is the FIRST factor to assess?
- The replacement cost of the tapes
- Whether the encryption renders the data unintelligible to unauthorized parties (Correct answer)
- The number of years the data was retained
- Whether the data was classified as public
Correct answer: Whether the encryption renders the data unintelligible to unauthorized parties
Strong encryption that renders data unintelligible to unauthorized parties may eliminate or reduce the notification obligation under many frameworks.
Question 4: Which of the following best describes 'containment' in the context of a privacy incident response?
- Identifying the root cause of the data breach
- Limiting further unauthorized access or spread of exposed personal data (Correct answer)
- Notifying regulatory authorities of the breach
- Restoring affected systems to normal operation
Correct answer: Limiting further unauthorized access or spread of exposed personal data
Containment focuses on stopping the incident from worsening by limiting further exposure or unauthorized access to personal data.
Question 5: A privacy engineer is reviewing an incident response plan. Which phase should include updating privacy impact assessments and patching vulnerabilities?
- Detection
- Containment
- Eradication
- Post-incident recovery and lessons learned (Correct answer)
Correct answer: Post-incident recovery and lessons learned
The post-incident phase involves remediation activities such as updating PIAs, patching vulnerabilities, and improving controls based on lessons learned.
Question 6: An organization's incident response team discovers that a third-party vendor exposed customer records. Who bears the primary regulatory notification obligation under GDPR?
- The data processor (vendor)
- The data controller (organization) (Correct answer)
- The data subject
- The supervisory authority
Correct answer: The data controller (organization)
Under GDPR, the data controller bears the primary obligation to notify the supervisory authority and data subjects, even when the breach occurred at a processor.
Question 7: Which metric is MOST useful for evaluating incident response effectiveness from a privacy perspective?
- Number of firewall rules updated post-incident
- Mean time to detect and contain a privacy breach (Correct answer)
- Total number of data subjects in the organization's database
- Average encryption key length used
Correct answer: Mean time to detect and contain a privacy breach
Mean time to detect and contain directly measures the speed and efficiency of the incident response process, minimizing harm to data subjects.
CDPSE Incident Response 2
Under the GDPR, what is the maximum time allowed to notify the supervisory authority after becoming aware of a personal data breach?