Information security: legal duties
What the law requires on security: appropriate measures, breach notification, NIS 2, DORA, the ANSSI, sector regimes, the complaint for the insurer and management liability.
- 28 cards
- 6 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- On the timeline
- The numbers
- Scenarios
A few cards from the deck
Personal data breach: what is it?
Show the answer
A security breach leading to the destruction, loss, alteration or unauthorised disclosure of personal data, or unauthorised access to it, whether accidental or unlawful.
It is not always a hack: a lost computer, an email sent to the wrong recipient or an outage that destroys data are breaches too.
What does article 32 of the GDPR ask of the controller and its processor?
- Measures proportionate to the risk and the state of the art
- The most expensive security measures on the market
- The measures on a single list published by the CNIL
- Encryption of all data, with no other requirement
Show the answer
Measures proportionate to the risk and the state of the art
The text sets no list: it requires proportion between risk and measures, with for instance encryption, pseudonymisation, restoring data and regular testing.
Notification to the CNIL must be made without undue delay and, where feasible, within … hours at most of becoming … of it.
Show the answer
Notification to the CNIL must be made without undue delay and, where feasible, within 72 hours at most of becoming aware of it.
The deadline runs from awareness of the breach, not its occurrence, and it counts continuous hours: weekends and holidays count.
Breach notification: what is it?
Show the answer
The information a controller must give to the data protection authority, and sometimes to the individuals, after a breach.
It is due to the authority within 72 hours, unless the breach is unlikely to result in a risk. Every breach, notified or not, must be entered in the internal register.