CompTIA Data+ DA0-002 (V2) Practice Question

Regulators typically need to know the nature and scope of the breach before anything else. Article 33(3)(a) of the GDPR, as well as comparable U.S. state breach-notification statutes and FTC guidance, explicitly require that a breach report describe the categories of personal data involved and the approximate number of records or individuals affected. Without this information, the DPO cannot assess the level of risk or determine whether external notification is legally required.

• The correct option provides the mandated information (type of data and record count).
• The other options may be useful later in an investigation (root-cause analysis, cost estimates, marketing details) but are not prerequisites for determining regulatory reporting obligations at the initial stage.