Skip to content

ACCA Applied Knowledge · Business and Technology · Regulation and financial crime

Under the GDPR, a company discovers that a hacker has accessed personal data of its customers, creating a risk to those individuals. What must the company do?

The company must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, because the breach creates a risk to individuals. Waiting for complaints or informing only the auditors would not satisfy the GDPR breach notification rule.

  1. AWait until the investigation is complete, then inform customers only if they complain
  2. BNotify the relevant supervisory authority without undue delay and where feasible within 72 hours of becoming awareCorrect
  3. CNotify only the company's external auditors at the next audit

Explanation

The GDPR requires controllers to notify the supervisory authority of a personal data breach likely to result in risk to individuals, within 72 hours where feasible. Waiting for complaints or telling only the auditors does not meet this requirement.

Did you get it right without looking?

One question tells you little. A timed set on Regulation and financial crime shows your real accuracy, how long you take and where you lose marks.

Practise Regulation and financial crimeFree diagnostic mock

More Regulation and financial crime questions