If you suspect a privacy or data security breach involving protected information, which action is appropriate?

• A. Ignore it to avoid causing a scare.
• B. Post a notice on social media to warn others.
• C. Wait for a routine quarterly review before taking action.
• D. Report the suspected breach to the appropriate authority and log details.

Answer: (D)

When you suspect a privacy or data security breach involving protected information, you should report the suspected breach to the appropriate authority and log the details. This sets the incident in motion for your organization's response plan, enabling rapid containment, investigation, and remediation. It also creates an clear, auditable record of what happened, who found it, when it was found, which systems and data were involved, and what actions were taken. Logging and reporting help meet legal and regulatory requirements for breach notification, which often require timely communication to regulators and, in some cases, affected individuals. Ignoring the issue leaves the exposure unchecked; posting on social media can violate privacy and spread misinformation; waiting for a routine quarterly review delays action and can breach policy or law.