ACCA Applied Knowledge · Business and Technology · Regulation and financial crime
Lumen Ltd discovers that an employee's unencrypted memory stick containing customer personal data has been lost, and the data could cause risk to individuals' rights. Under GDPR-style rules, what is the controller's most appropriate action?
Lumen should notify the supervisory authority without undue delay, where feasible within 72 hours of becoming aware of the breach, and consider informing affected individuals if the risk to them is high. Waiting for proof of misuse or deferring reporting would breach GDPR-style breach notification rules.
- ANotify the supervisory authority without undue delay, and where feasible within 72 hours of becoming aware, and assess whether to inform affected individualsCorrect
- BWait until there is evidence that the data has actually been misused before reporting
- CNotify only the affected individuals, as the regulator need not be told of lost devices
- DRecord the loss internally and report only at the next annual review
Explanation
GDPR-style rules require a controller to notify the supervisory authority of a personal data breach likely to result in risk to individuals, where feasible within 72 hours of becoming aware. Individuals must also be told where the risk is high. Waiting for evidence of misuse or delaying to an annual review breaches the requirement.
Did you get it right without looking?
One question tells you little. A timed set on Regulation and financial crime shows your real accuracy, how long you take and where you lose marks.
More Regulation and financial crime questions
- Which of the following lists the three recognised stages of money laundering in the correct order?
- Having placed illicit funds in a bank, a launderer wires them through several shell companies in different countries and makes repeated tran…
- A firm's MLRO files a suspicious activity report about a client. Later the audit partner, wanting to be open, mentions to the client's finan…
- An accountant, Priya, files an internal suspicion report about a client's unusual transactions. Later, she tells the client that the report …
- The MLRO of a firm receives an internal report from a junior member of staff about a client's unusual transactions. After review, the MLRO c…
- Which control is most likely to prevent a payroll clerk from creating a fictitious employee and diverting the salary to their own bank accou…