What must be done in case of a data breach?

What must be done in case of a data breach?

• A. Notify the Irish Data Protection Commissioner within 72 hours
• B. Wait for guidance from management
• C. Notify customers first
• D. Ignore unless data is sensitive

Answer: (A)

Prompt handling of data breaches hinges on acting quickly to involve the regulator. In Ireland, if a breach is likely to affect the rights and freedoms of individuals, you must inform the Data Protection Commission within 72 hours of becoming aware of the incident. This timeframe is about enabling authorities to assess risk and provide guidance, and it sets a clear deadline for reporting to the supervisory authority. Choosing to notify the regulator within 72 hours is the best answer because it reflects the formal obligation under GDPR for timely regulatory notification. If the breach creates a high risk to individuals, you also notify those affected without delay; but the duty to alert the regulator within that 72-hour window remains central, and you should not delay or ignore the breach while waiting for management or for customers to be affected. Always document the breach and the steps taken, even if the regulator’s guidance later adjusts next actions.

Prompt handling of data breaches hinges on acting quickly to involve the regulator. In Ireland, if a breach is likely to affect the rights and freedoms of individuals, you must inform the Data Protection Commission within 72 hours of becoming aware of the incident. This timeframe is about enabling authorities to assess risk and provide guidance, and it sets a clear deadline for reporting to the supervisory authority.

Choosing to notify the regulator within 72 hours is the best answer because it reflects the formal obligation under GDPR for timely regulatory notification. If the breach creates a high risk to individuals, you also notify those affected without delay; but the duty to alert the regulator within that 72-hour window remains central, and you should not delay or ignore the breach while waiting for management or for customers to be affected. Always document the breach and the steps taken, even if the regulator’s guidance later adjusts next actions.