Question

A SOC analyst at a European e-commerce company confirms that a breach exposed the names, addresses, and payment history of EU residents. The compliance officer asks how quickly the supervisory authority must be notified under the regulation that governs personal data of EU citizens. Which regulation applies, and what is the notification deadline?

Accepted Answer

GDPR, which requires notifying the supervisory authority within 72 hours of becoming aware of the breach

Answer

PCI DSS, which requires notifying the card brands within 24 hours of the breach

Answer

SOX, which requires notifying the SEC within 4 business days of the breach

Answer

HIPAA, which requires notifying affected individuals within 60 days of the breach