Which statement best describes GDPR data subject rights and breach notification requirements?

• A. Rights include data erasure only, and there is no breach notification obligation.
• B. Rights include data access and portability, but breach notification is not required within any timeframe.
• C. Rights include access, erasure, data portability; breach notification to authorities within 72 hours and to affected individuals if risk exists.
• D. GDPR requires firms to store all data forever and never notify individuals of breaches.

Answer: (C)