Skip to content

ACCA Applied Knowledge · Business and Technology · Regulation and financial crime

Zeta Ltd stores customer records on a laptop. The laptop is stolen while unencrypted, and the records include names, addresses and bank details. Under typical data protection legislation, which response is most appropriate for Zeta?

Zeta should assess the breach and notify the data protection regulator promptly, and also the affected customers where the risk to them is high, as it is with unencrypted bank details. Staying silent, waiting for losses to arise or telling only the insurer would not meet the legal duty.

  1. ATake no action as the loss was caused by a thief, not by Zeta
  2. BAssess the breach and notify the regulator and, where there is high risk to individuals, the affected customers, without undue delayCorrect
  3. CWait until customers report losses before deciding whether to disclose
  4. DNotify only the insurer, since the data was stolen rather than misused by staff

Explanation

Data controllers must assess breaches and notify the supervisory authority promptly (under GDPR within 72 hours where feasible), and inform individuals where there is a high risk to them. Bank details held unencrypted create such a risk. Doing nothing or waiting for losses ignores the duty, and informing only the insurer does not discharge it.

Did you get it right without looking?

One question tells you little. A timed set on Regulation and financial crime shows your real accuracy, how long you take and where you lose marks.

Practise Regulation and financial crimeFree diagnostic mock

More Regulation and financial crime questions