Certified Ethical Hacker (CEH) Practice Question

The General Data Protection Regulation (GDPR) is the EU-wide privacy law that governs the processing of personal data of EU residents. Article 33 mandates that a data controller must notify the competent supervisory authority of a personal data breach within 72 hours of becoming aware of it. Article 83 authorizes administrative fines of up to 20 million EUR or 4 percent of the organization's total worldwide annual turnover, whichever is higher. PCI DSS is an industry security standard, not a law, and it does not impose a statutory breach-notification window or percentage-of-turnover fines. HIPAA applies only to protected health information in the United States, and the Gramm-Leach-Bliley Act focuses on U.S. financial institutions; neither matches the described 72-hour requirement or fine structure. Therefore, GDPR is the only option that fulfills both conditions in the scenario.