When a privacy breach occurs, how should it be reported and what notifications are required?

• A. Do not report unless a court orders.
• B. Only report to management; never notify individuals.
• C. Report to the privacy officer and relevant authorities; notify affected individuals when required; document the breach.
• D. Report to law enforcement only; no documentation.

Answer: (C)

When a privacy breach happens, use a structured incident response that includes reporting, notification, and documentation. The privacy officer should be promptly involved to assess the breach, determine the proper escalation, and coordinate the response with any required authorities or regulators under applicable laws. If the rules or policy require it, affected individuals must be notified so they can take protective steps and understand the potential impact on their privacy. At the same time, you should thoroughly document every aspect of the breach and the response—what happened, what data were involved, how the breach was detected and contained, who was informed, what authorities were notified, and what remediation steps were taken—so there is a clear, auditable record for compliance and learning.

This approach ensures governance and accountability, not just internal awareness or external enforcement. Reporting only to management misses external regulatory obligations, while notifying individuals without regulatory or documented oversight can fail to meet legal requirements and hinder future prevention.