An investigation confirms that an attacker accessed a database containing customers' personal data, and the access has now been contained. Which action is MOST important to take promptly?
Select an answer to reveal the explanation.
Short Explanation
Once personal data's involved, the clock on legal obligations may already be ticking. You bring in legal and privacy so they can decide who must be told and when. Blasting every customer before you know the scope is the trap; it can cause more harm and confusion than it prevents.
Full Explanation
Incidents involving personal data can trigger legal and regulatory obligations to notify supervisory authorities, affected individuals or both, often within defined time frames and subject to assessment of the risk of harm. Legal and privacy functions are responsible for interpreting those obligations across the jurisdictions involved and deciding on notification, so involving them promptly once personal data is confirmed is the most important next step after containment. Notifying all customers immediately before the scope is known risks inaccurate messages, unnecessary alarm and inconsistency with regulatory notifications, and the decision should be made by those accountable for it, not by the response team alone. Deleting the affected data destroys evidence needed for the investigation and for notification decisions, and may itself breach retention obligations while doing nothing to reverse the exposure that has already occurred. Waiting until the investigation is complete before involving anyone else risks missing notification deadlines and leaves decisions about obligations unmade. Exam caveat: the incident response plan should define personal data involvement as a trigger for legal and privacy engagement, so this does not depend on an individual's judgement. Operational check: confirm the incident record shows when legal and privacy were engaged and the notification assessment they documented.