Exam CIPP-E topic 1 question 59 discussion

A. Notify as soon as possible the data protection supervisory authority that a data breach may have taken place: Given the nature of the data involved (names, addresses, and contact details) and the fact that it is unencrypted, there is a significant risk to the rights and freedoms of the data subjects. Therefore, the supervisory authority should be notified without undue delay. GDPR Article Reference: Article 33(1): In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.