Question

A multinational retailer headquartered in the United States discovers that a database containing personal data of customers residing in several European Union countries has been breached. The Chief Privacy Officer is determining the organization's legal notification obligations. Which factor most directly determines which breach notification laws the retailer must comply with for the affected EU customers?

Accepted Answer

The residency of the data subjects whose personal data was affected

Answer

The physical location of the company's headquarters and primary incorporation

Answer

The country where the breached database server was physically hosted

Answer

The nationality of the executive who signs the notification letters