An incident response plan lists technical containment steps but never assigns who assesses high risk to data subjects for notification decisions. Which organisational gap does this reveal?
Select an answer to reveal the explanation.
Short Explanation
Someone has to own the 'how bad is this for people?' call—not just the 'reboot the server' checklist. Breach notification turns on risk to humans; if nobody is assigned that judgment, the plan is half-built. Put a name next to the decision.
Full Explanation
Incident response readiness is organisational as well as technical. A plan that lists containment steps but never assigns who assesses high risk to data subjects leaves Articles 33–34 decision-making without an owner. Organisational readiness therefore requires clear accountability for evaluating risks to individuals and driving breach-notification decisions within legal timeframes, coordinated with security containment.
Technical containment alone does not satisfy notification analysis. GDPR does not forbid naming internal owners; external counsel may advise, but the organisation still needs designated decision roles. Omitting notification topics to avoid creating “discoverable documents” is poor governance, not a lawful strategy, and leaves staff improvising under pressure.
Exam caveat: answer “who decides notification?” before the incident occurs. Operational check: name privacy, legal, security, and communications roles; set escalation clocks aligned to the seventy-two-hour supervisory theme; tabletop the decision path with municipal scenarios. Public bodies should protect residents through timely, owned judgment—not only restored servers—and document why a tech-only runbook was deemed incomplete.