A school discovers that an unencrypted USB stick with pupil personal data was lost three weeks earlier; staff only now become aware of the loss. How should breach-handling duties be timed?
Select an answer to reveal the explanation.
Short Explanation
Late discovery does not mean ‘too late to care.’ The GDPR clock for controllers runs from awareness—when you find out—not from the day the stick vanished into a sofa. Delayed notice of the loss still triggers handling steps.
Full Explanation
Breach-handling and notification duties run from when the controller becomes aware of the incident, even if discovery is delayed. A school that learns three weeks later that an unencrypted USB with pupil personal data was lost still faces Articles 33/34 clocks measured from awareness, not from the unknown loss date alone. Duties do not expire permanently because three weeks passed before discovery. Removable media are not outside the GDPR. Notification clocks do not start only when a parent files a formal complaint. Exam caveat: delayed discovery shifts the awareness timestamp—it does not erase duties. Operational check: record the discovery/awareness time in the incident log, assess risk promptly, notify the SA within the without-undue-delay/72-hour framework if required, and improve media-control TOMs to prevent recurrence. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis.