Which regulatory framework commonly features data breach notification requirements?

• A. HIPAA
• B. SOX
• C. PCI-DSS
• D. GDPR

Answer: (D)

Data breach notification requirements are a prominent feature of modern data protection regimes, and the General Data Protection Regulation stands out for making them explicit and enforceable across a wide range of organizations. Under GDPR, data controllers must act quickly when a personal data breach occurs, assessing the risk to individuals. If there is a risk, they must notify the relevant supervisory authority within 72 hours; if the risk to individuals is high, those individuals must be informed without undue delay. This combination of timely reporting to authorities and direct notices to affected people is a defining element of GDPR’s approach to accountability and transparency.

HIPAA does have breach notification rules, but these apply specifically to protected health information in the U.S. and are tied to healthcare contexts. PCI-DSS deals with security controls for payment card data and requires incident response and certain notifications, but it is a standards-based framework rather than a broad data-protection regulation. SOX focuses on financial reporting and internal controls rather than data breach notifications.