Has a data breach occurred in the past two years that had to be reported?

Yes/no about a data breach is rarely substantiated in one go

This question does not ask whether anything has ever gone wrong, but whether there has been a data breach that had to be reported — that is an intermediate step. A breach that was noticed internally and handled without a reporting obligation is different from a breach that was reported to the supervisory authority and possibly to those affected. The answer "no" can therefore only be given if you are certain that there has been no reportable incident, not merely that you have no recollection of it. The answer "yes" calls for a follow-up question to be answered: when, what was reported and to whom.

In practice, this is one of the questions where the answer can change from one completion round to the next, because the period "past two years" moves forward. A breach from two years and one month ago no longer falls within it this year, whereas it still counted last year. This is therefore not an answer you record once and then leave unchanged: the file must check each round whether a period is falling away or being added. Those who fill in this subject more often also recognise the related question about an internal reporting channel for whistleblowers": both questions test not only whether something exists, but whether the process was actually used.

Where this comes from: no fixed article, but a recurring checkpoint

This question does not come from a specific article provided to Supplia; it belongs to the broader category of questions about data processing, alongside questions such as whether the undertaking maintains a record of processing activities. The source for this answer therefore does not lie in external legislation, but in the undertaking's own incident register: the recording of what happened, when, and whether a notification was sent. Without that internal document there is no basis to confirm "no", and with a partially completed register there is also no basis to fully substantiate "yes".