How do you distinguish between a security incident and a privacy (breach) incident in regulatory terms?

• A. A security incident concerns unauthorized access or modification of systems; a privacy breach involves exposure of personal data and triggers regulatory reporting requirements.
• B. A privacy breach focuses on the confidentiality of personal data and triggers reporting requirements.
• C. A security incident is only about physical security.
• D. A privacy breach has no regulatory impact.

Answer: (A)

The main idea here is understanding how regulators distinguish incidents based on what is affected: systems and controls versus personal data. A security incident centers on unauthorized access to or modification of IT systems and the controls that protect them. A privacy breach centers on the exposure of personal data and the regulatory reporting that follows when individuals’ information is exposed or at risk.

This distinction matters because privacy laws and data breach notifications kick in specifically when personal data is exposed, often requiring timely reporting to authorities and affected individuals. Security incidents, while they may involve breaches of confidentiality, integrity, or availability, are assessed for regulatory impact partly on whether personal data is involved. The best answer captures both elements: unauthorized access or modification of systems constitutes a security incident, and exposure of personal data constitutes a privacy breach with reporting obligations.

The other statements are incomplete or incorrect: focusing only on privacy as a matter of confidentiality misses the broader security incident landscape and its regulatory implications; saying security is only about physical security ignores digital threats; and claiming privacy breaches have no regulatory impact contradicts data breach laws that mandate notifications.