When assessing the level of risk created by a data breach, which of the following would NOT have to be taken into consideration?

According to the E-Commerce Directive 2000/31/EC, where is the place of "establishment" for a company providing services via an Internet website confirmed by the GDPR?

Read the following steps:
Discover which employees are accessing cloud services and from which devices and apps Lock down the data in those apps and devices Monitor and analyze the apps and devices for compliance Manage application life cycles Monitor data sharing An organization should perform these steps to do which of the following?

Which institution has the power to adopt findings that confirm the adequacy of the data protection level in a non-EU country?

In addition to the European Commission, who can adopt standard contractual clauses, assuming that all required conditions are met?