CompTIA CySA+ (CS0-003)Reporting and CommunicationMedium
A security analyst is drafting a compliance report for the General Data Protection Regulation (GDPR). The organization recently experienced a data breach involving personal data of EU citizens. According to GDPR, specific information must be included in the notification to the supervisory authority. Which of the following pieces of information is NOT a mandatory element of a GDPR breach notification?
- AThe estimated financial cost of the breach to the organization
- BThe name and contact details of the Data Protection Officer (DPO)
- CA description of the likely consequences of the personal data breach
- DThe categories and approximate number of data subjects concerned
Show answer & explanationAnswer & explanation
Correct answer: A. The estimated financial cost of the breach to the organization
While the financial cost of a breach is important for internal assessment and business impact, GDPR breach notification requirements (Article 33) do not explicitly mandate reporting the estimated financial cost to the supervisory authority. It focuses on the nature of the breach, data subjects affected, consequences, and mitigation measures.
Why the other options are wrong
- B. This is a mandatory element under GDPR Article 33(3)(b).
- C. This is a mandatory element under GDPR Article 33(3)(c).
- D. This is a mandatory element under GDPR Article 33(3)(a).
GDPR Breach Notification Requirements
Specific information that must be provided to the relevant supervisory authority and, in some cases, to affected data subjects, following a personal data breach under the General Data Protection Regulation.
- Notification to supervisory authority within 72 hours (where feasible).
- Includes nature of breach, categories of data, DPO contact, likely consequences, and mitigation measures.
- Does not explicitly require reporting the organization's financial cost of the breach.
Memory trick: GDPR wants 'Who, What, How, and DPO' for a breach, not your 'wallet' size.