Exin PDPF Exam - Topic 8 Question 69 Discussion

Actual exam question for Exin's PDPF exam

Question #: 69
Topic #: 8

A personal data breach has occurred, and the controller is writing a draft notification for the supervisory authority. The following information is already in the notification:

- The nature of the personal data breach and its possible consequences.

- Information regarding the parties that can provide additional information about the data breach.

What other information must the controller provide?

AInformation of local and national authorities that were informed about the data breach.

BName and contact details of the data subjects whose data may have been breached

CSuggested measures to mitigate the adverse consequences of the data breach.

DThe information needed to access the personal data that have been breached.

Show Suggested Answer

Suggested Answer: A

To advise the controller on the mitigation of privacy risks to protect the controller from liability claims for non-compliance. Incorrect. The supervisory authority has the task to monitor compliance and to advise on enhancements, but its purpose is not to protect the controller.

To fulfill the obligation in the GDPR to implement appropriate technical and organizational measures for data protection. Incorrect. The audit is not the implementation of the measures, but an assessment of the effectiveness of them.

To monitor and enforce the application of the GDPR by assessing that processing is performed in compliance with the GDPR. Correct. According to the GDPR this is an important task of a supervisory authority. (Literature: A, Chapter 7; GDPR Article 57 (1)(a))

by Suzan at Sep 06, 2024, 01:30 PM

Limited Time Offer

25%

Off

Get Premium PDPF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Rachael

5 months ago

Agreed, mitigation measures are crucial to prevent further issues!

upvoted 0 times

...

Lera

5 months ago

Wait, why would they need to provide access info for the breached data?

upvoted 0 times

...

Rodolfo

5 months ago

Not sure about sharing data subjects' details, seems risky.

upvoted 0 times

...

Lenna

5 months ago

I think they should also inform local authorities.

upvoted 0 times

...

Rozella

6 months ago

Definitely need to include suggested measures to mitigate the breach!

upvoted 0 times

...

Tawny

6 months ago

I’m confused about the need for accessing information about the breached data. Isn’t that a bit too much detail for the notification?

upvoted 0 times

...

Gianna

6 months ago

I practiced a similar question, and I feel like we should definitely mention the contact details of the data subjects. It makes sense to keep them informed.

upvoted 0 times

...

My

6 months ago

I'm not entirely sure, but I remember something about notifying authorities. Is that what option A is about?

upvoted 0 times

...

Ludivina

6 months ago

I think we need to include suggested measures to mitigate the adverse consequences. That seems important, right?

upvoted 0 times

...

Virgina

6 months ago

I feel pretty confident that the answer is C. The question is specifically asking what other information the controller must provide, and the suggested measures to mitigate the adverse consequences seems like the most relevant and complete answer.

upvoted 0 times

...

Joanna

6 months ago

I'm a bit confused. Shouldn't the controller also need to inform local and national authorities about the data breach? I'm not sure if that's the right answer, but it seems like important information to include.

upvoted 0 times

...

Jillian

6 months ago

Okay, let me think this through. The question is asking what other information the controller must provide, so the answer is likely C - suggested measures to mitigate the adverse consequences.

upvoted 0 times

...

Laquita

6 months ago

Hmm, I'm not sure about this one. Do we need to include the names and contact details of the data subjects whose data may have been breached?

upvoted 0 times

...

Norah

6 months ago

This seems straightforward - the controller needs to provide suggested measures to mitigate the adverse consequences of the data breach.

upvoted 0 times

...

Arthur

7 months ago

This seems straightforward to me. The expired Apple sToken or Push Notification certificate is the most logical explanation for the iOS email failure. I'll double-check those settings first before looking into any other potential causes.

upvoted 0 times

...

Mariann

7 months ago

I'm pretty confident this is the right command. The solution provided looks correct - "kubectl events deployment api" should display the events for the api deployment.

upvoted 0 times

...

Kayleigh

11 months ago

Option D - 'The information needed to access the personal data that have been breached.' Ah, the classic 'give the thieves the keys to the vault' approach. Bold move, let's see how it plays out!

upvoted 0 times

Sabine

11 months ago

C) Suggested measures to mitigate the adverse consequences of the data breach.

upvoted 0 times

...

Pearline

11 months ago

B) Name and contact details of the data subjects whose data may have been breached

upvoted 0 times

...

Phyliss

11 months ago

A) Information of local and national authorities that were informed about the data breach.

upvoted 0 times

...

Trinidad

12 months ago

Option A is tempting, but I think the focus should be on addressing the breach, not just informing the authorities. C is the way to go.

upvoted 0 times

Gregoria

10 months ago

Absolutely, taking action to address the breach is more important than just informing the authorities.

upvoted 0 times

...

Catrice

10 months ago

Yes, that should be the priority to protect the data subjects and prevent further harm.

upvoted 0 times

...

Ryan

10 months ago

I agree, providing suggested measures to mitigate the adverse consequences of the data breach is crucial.

upvoted 0 times

...

Rhea

12 months ago

Hah, option B would be a real privacy nightmare! Imagine having to give out all the data subjects' contact details. That's a hard pass.

upvoted 0 times

Janna

10 months ago

That does sound like a privacy nightmare. I agree, giving out all the data subjects' contact details is a hard pass.

upvoted 0 times

...

Dorothy

10 months ago

B) Name and contact details of the data subjects whose data may have been breached

upvoted 0 times

...

Deja

11 months ago

C) Suggested measures to mitigate the adverse consequences of the data breach.

upvoted 0 times

...

Vicky

11 months ago

A) Information of local and national authorities that were informed about the data breach.

upvoted 0 times

...

Kenda

12 months ago

I'm not sure about option D. Providing the information needed to access the breached data seems like a bad idea - that could lead to further misuse of the data.

upvoted 0 times

...

Marlon

12 months ago

Option C seems like the right choice here. The controller should provide the supervisory authority with suggestions on how to mitigate the impact of the data breach.

upvoted 0 times

...