Which statement best describes GDPR data subject rights and breach notification requirements?

Which statement best describes GDPR data subject rights and breach notification requirements?

• A. Rights include data erasure only, and there is no breach notification obligation.
• B. Rights include data access and portability, but breach notification is not required within any timeframe.
• C. Rights include access, erasure, data portability; breach notification to authorities within 72 hours and to affected individuals if risk exists.
• D. GDPR requires firms to store all data forever and never notify individuals of breaches.

Answer: (C)

The question tests understanding of GDPR rights for individuals and when breaches must be reported. Under GDPR, data subjects have several rights beyond erasure, including access to their data and data portability (the ability to obtain a copy of their data in a structured, commonly used format and to have it transmitted to another controller). On breach notification, the rule is that a data controller must report a personal data breach to the supervisory authority within 72 hours of becoming aware of it if there’s a risk to rights and freedoms. If there is a high risk to individuals, those affected must be informed without undue delay. The statement that combines these rights (access, erasure, data portability) with the 72-hour notice to authorities and to individuals when there’s risk accurately reflects GDPR obligations. The other options misstate the scope of rights or the notification rules—for example, suggesting rights are limited to erasure and that there’s no notification timeframe, or implying data can be stored forever with no breach notices.

The question tests understanding of GDPR rights for individuals and when breaches must be reported. Under GDPR, data subjects have several rights beyond erasure, including access to their data and data portability (the ability to obtain a copy of their data in a structured, commonly used format and to have it transmitted to another controller). On breach notification, the rule is that a data controller must report a personal data breach to the supervisory authority within 72 hours of becoming aware of it if there’s a risk to rights and freedoms. If there is a high risk to individuals, those affected must be informed without undue delay. The statement that combines these rights (access, erasure, data portability) with the 72-hour notice to authorities and to individuals when there’s risk accurately reflects GDPR obligations. The other options misstate the scope of rights or the notification rules—for example, suggesting rights are limited to erasure and that there’s no notification timeframe, or implying data can be stored forever with no breach notices.