The organization TechWorld Ltd. used cloud for its business. It operates from an EU country (Poland and Greece). Currently, the organization gathers…

The General Data Protection Regulation (GDPR) is a comprehensive data protection law enacted by the European Union (EU). The scenario describes an organization operating within the EU (Poland, Greece) that processes the data of EU users and suffers a data breach. GDPR applies directly to this situation, mandating strict rules for data processing and security. It holds both data controllers (the organization) and processors (the cloud provider) responsible for non-compliance and imposes significant financial penalties for breaches, especially those involving the loss of critical user data.

B. NIST provides security frameworks and guidelines; it is not a regulatory body that imposes legal penalties for data breaches.
C. ITAR (International Traffic in Arms Regulations) is a US regulation controlling the export of defense-related articles and services, not general user data.
D. HIPAA (Health Insurance Portability and Accountability Act) is a US federal law governing the security and privacy of protected health information.

1. European Commission. (2018). Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation). Official Journal of the European Union, L 119/1. (See Articles 4, 24, 28, and 83 for scope, controller/processor responsibility, and penalties).

2. Voigt, P., & Von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR). Springer. https://doi.org/10.1007/978-3-319-57959-7. (Chapter 1 provides an overview of the scope and applicability).

3. MIT Sloan School of Management. (2018). CISOs and GDPR: A New Era of Accountability. MIT Center for Information Systems Research, Briefing, Vol. XVIII, No. 5B. (Discusses the accountability and penalty aspects of GDPR).