Under the rules of the National Privacy Commission, a personal information controller must notify the Commission and the affected data subjects of a personal data breach within how many hours after knowledge of it?

The correct answer is C. 72 hours

NPC rules require notification within seventy-two hours upon knowledge of, or reasonable belief that, a personal data breach requiring notification has occurred. Prompt notice lets people protect themselves from misuse of their data.