QuestionQ249
Compliance with European Data Protection Law and RegulationAccording to the European Data Protection Board, when a controller is not established in the EU but is nevertheless subject to the GDPR and becomes aware of a personal data breach, which supervisory authority or authorities must it notify?
- A Only the supervisory authority of the EU member state in which the controller's EU representative (pursuant to Article 27) is established.
- B Only one lead supervisory authority, as a controller benefits from the one-stop shop mechanism under the GDPR’s enforcement regime.
- C Every supervisory authority of the EU member states where the controller is offering goods or services.
- D Every supervisory authority for which affected data subjects reside in their EU member state.
Community Discussion