What are data breach notification obligations, and what steps should a practitioner take if a data breach occurs?

• A. Notify affected individuals and authorities per laws; document incident, contain breach, implement remediation, and review security controls.
• B. Delete logs and pretend nothing happened.
• C. Notify only clients with direct harm.
• D. Do nothing.

Answer: (A)

Data breach notification obligations require acting quickly and in line with applicable laws to inform those affected and the relevant authorities, while also documenting what happened and strengthening defenses. In practice, a practitioner should follow a structured incident response: confirm the breach, contain it to stop further exposure, preserve evidence, and assess the scope and risk (which data were exposed, who is affected, and how severe the harm could be). Identify the applicable laws and any required timelines, then notify the affected individuals and the appropriate authorities within those windows, providing clear information about what happened, what data were involved, potential risks, and steps the recipients can take. Implement remediation to close the gaps—patch vulnerabilities, strengthen access controls and encryption, require MFA, improve monitoring, and update security measures. Afterward, conduct a post-incident review to identify root causes, update policies and procedures, train staff, and document the incident and responses for future audits. This approach aligns with legal duties and best practices for risk management, offering accountability and a path to reducing the chance of recurrence. The other options miss or silence legal obligations, fail to inform affected parties or authorities, or neglect remediation and improvements.