Question

A multinational retailer's SOC confirms that attackers exfiltrated a database containing EU residents' personal data and U.S. customers' payment card information. The CISO convenes a response meeting to determine notification obligations. Legal confirms the breach involves both personal data protected under GDPR and cardholder data governed by PCI DSS agreements with the acquiring bank. Which action correctly reflects the organization's regulatory and contractual notification obligations?

Accepted Answer

Notify the relevant EU supervisory authority within 72 hours of becoming aware of the breach, and notify the acquiring bank/card brands per the payment card agreement timelines, treating each obligation independently

Answer

Wait until the forensic investigation is fully complete before making any notification, to ensure all reported facts are verified and avoid regulatory penalties for inaccurate reporting

Answer

Issue a single consolidated notification to the EU supervisory authority within 30 days that also satisfies the PCI DSS card brand reporting requirement

Answer

Notify only affected data subjects directly and skip regulator notification, since individual notice is the higher-priority obligation under both GDPR and PCI DSS