A DPO relies on EDPB breach guidelines when deciding whether individuals must be informed after a personal-data breach. Which threshold correctly drives data-subject notification?
Select an answer to reveal the explanation.
Short Explanation
Tell people when the mess is likely a high risk to their rights—not for every blip on a log. EDPB thinking tracks that high-risk threshold. Board briefings are fine; they do not replace individual notice when the risk is high.
Full Explanation
Data subjects should be notified when the breach is likely to result in a high risk to their rights and freedoms under Article 34, a threshold EDPB breach guidelines help apply in practice. A DPO should not notify for every log anomaly lacking personal-data impact, nor wait for a criminal conviction, nor confine notice to the board when high risk to individuals exists. Limited exceptions (for example, effective protection rendering data unintelligible to unauthorised persons) may apply, but preference alone is not an exception. Exam caveat: high risk to rights and freedoms is the individual-notice trigger—not every anomaly and not board-only reporting. Operational check: use an EDPB-aligned scoring sheet capturing confidentiality/integrity/availability harms, vulnerability of residents, and mitigation effectiveness before deciding on Article 34 communications. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis.