A SaaS vendor processing municipal customer data suffers a personal-data breach. The city asks who notifies the supervisory authority under the GDPR. Which allocation of duties is correct?
Select an answer to reveal the explanation.
Short Explanation
The vendor rings the city first—fast. The city, as controller, then decides about the regulator and the people. Hosting the boxes does not automatically make the processor the public notifier.
Full Explanation
When a SaaS vendor processing municipal customer data suffers a personal-data breach, the processor informs the controller without undue delay; the controller assesses and, where required, notifies the supervisory authority and affected individuals. Article 33(2) places the first notice duty on the processor toward the controller, preserving the controller’s primary external notification role. Only the processor does not notify the SA merely because it hosts systems. Neither party may skip notice because a marketing page mentions encryption. Data subjects are not solely responsible for notifying the SA. Exam caveat: processor → controller → (SA/individuals as required) is the allocation pattern. Operational check: put processor without-undue-delay breach notice into the DPA with contact channels and content minimums, and rehearse the city’s SA notification playbook separately. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis.