Data breach notification is triggered when what occurs to sensitive information?

• A. When data is encrypted
• B. When sensitive personal information is stolen or lost
• C. When data is accessed by internal staff
• D. When data is stored on a secure server

Answer: (B)

Data breach notification is triggered when sensitive personal information is compromised due to a breach. The key idea is exposure or compromise of data, not just its state or location. When sensitive information is stolen or lost, an attacker may gain access to it, meeting the point at which many laws require notify affected individuals and regulators. Encryption matters because if data remains unreadable even after a breach, some regulations may not require notification, but the act of theft or loss of unprotected data is the clear trigger. Simply having data encrypted, internal staff accessing data legitimately, or data stored on a secure server does not by itself constitute a breach requiring notification.