During a ransomware tabletop exercise, citizen records are encrypted by an attacker. Leadership asks when GDPR personal-data breach notification clocks start for the controller. Which timing rule is correct?
Select an answer to reveal the explanation.
Short Explanation
The stopwatch starts when you know you have a problem—not when the ransom invoice clears. Controllers work from awareness, then decide who must hear about it based on risk. Pretending encrypted-by-attacker equals anonymous is wishful thinking.
Full Explanation
Controller notification duties under Articles 33 and 34 are timed from when the controller becomes aware of the personal-data breach, with risk-based decisions on whom to notify. During a ransomware tabletop encrypting citizen records, leadership should measure the SA clock from awareness—generally without undue delay and, where feasible, within 72 hours unless unlikely to result in a risk—and assess high risk for individual communication. The clock does not start only when ransom is paid. Notice is not due only after a full forensic report is published publicly. Ransomware ciphertext is not automatically anonymous so that clocks never start. Exam caveat: awareness triggers the timeline; risk determines SA versus individual notice. Operational check: in the civic incident runbook, log the awareness timestamp, assign a breach lead, and complete a documented risk assessment for Articles 33 and 34 within the without-undue-delay window. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.