When should a supervisor be contacted about a suspected data privacy breach?

• A. Immediately per policy; isolate the affected information, begin incident report, and notify information security and privacy officer.
• B. Notify the privacy officer only
• C. Ignore and wait
• D. Delete the data

Answer: (A)

Immediate escalation and following the incident response protocol is essential when you suspect a data privacy breach. The moment you detect a potential breach, involve your supervisor right away to trigger containment and reporting steps. The best course is to isolate the affected information to prevent further exposure, begin an incident report to document what happened, and alert information security and the privacy officer so experts can assess, contain, and notify as required. Acting quickly helps limit damage, preserve evidence, and ensure compliance with policies and any applicable laws.

Other approaches fall short because notifying only the privacy officer alone can delay rapid containment; ignoring and waiting lets the breach grow; and deleting the data can destroy evidence and violate policy and regulatory requirements.