The organization TechWorld Ltd. used cloud for its business. It operates from an EU country (Poland and Greece). Currently, the organization gathers…

GDPR: The General Data Protection Regulation (GDPR) is the primary law regulating how companies

protect EU citizens’ personal data1.

Applicability: GDPR applies to all organizations operating within the EU, as well as organizations

outside of the EU that offer goods or services to customers or businesses in the EU1.

Data Breaches: In the event of a data breach, organizations are required to notify the appropriate

data protection authority within 72 hours, if feasible, after becoming aware of the breach2.

Penalties: Organizations that do not comply with GDPR can face hefty fines. For serious

infringements, GDPR states that companies can be fined up to 4% of their annual global turnover or

€20 million (whichever is greater)1.

Responsibility: Both the data controller and the processor will be held responsible for not adhering to

the GDPR rules, which includes security breaches resulting in the loss of user data1.

Reference:

GDPR Info on fines and penalties1.

EDPB Guidelines on personal data breach notification under GDPR2.