In short
Breach notification laws require organizations to notify affected individuals, and often regulators, when personal data has been accessed or disclosed without authorization.
Key takeaways
- Under the European Union's data protection rules, the regulator must generally be told within 72 hours.
- Health data breaches in the United States must be reported to individuals within 60 days.
- Each US state has its own law, with different triggers and deadlines.
Where it's tested
ISC: Privacy & Regulatory Frameworks — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
Under the General Data Protection Regulation, when must a controller generally notify the supervisory authority of a personal data breach that poses a risk to individuals?