An investigation confirms that personal data of customers in several countries was accessed without authorization. The organization is unsure which notification obligations apply. What should the security manager do?
Select an answer to reveal the explanation.
Short Explanation
Breach notification is like a tax filing in several countries at once. You don't guess, you don't skip it and you don't file everywhere just in case; you get the experts to tell you exactly what's due and when. Waiting for the whole investigation to finish can blow your deadline.
Full Explanation
Notification obligations depend on the jurisdictions involved, the type of data, the likely harm to individuals and the organization's contracts, and many regimes set time limits that start running when the organization becomes aware of a breach. Legal counsel is best placed to interpret those requirements, so the security manager provides the facts about what data was affected, how and when, and counsel determines who must be notified, what must be said and by when. Notifications are then made through the plan's approved channels. Waiting until the investigation is fully complete risks missing statutory deadlines; obligations are typically assessed on the facts known at the time and updated as the investigation continues. Notifying every regulator regardless of requirement may create confusion, disclose information unnecessarily and is not a substitute for knowing the actual obligations. Delegating the decision to public relations places a legal compliance decision with a team whose role is communication rather than legal interpretation, although it will help shape the message. Exam caveat: the incident response plan should already identify regulatory notification requirements and the counsel who advises on them, so this step is fast. Operational check: confirm the time awareness was established, the obligations identified by counsel and the date each notification was made.