A SaaS vendor argues it is 'only hosting' and therefore need not help the controller with data-subject requests or security incidents. Under GDPR processor duties, what is the better view?
Select an answer to reveal the explanation.
Short Explanation
Being the landlord of the data warehouse doesn't mean you shrug when the tenant needs help with a broken lock or a customer knocking. Processors still have to pitch in on rights, security, and breach work as the contract and GDPR require.
Full Explanation
Processors must process only on documented instructions and must assist the controller in ensuring compliance with obligations such as responding to data-subject rights, implementing security, and handling personal-data breaches, taking into account the nature of processing. A 'hosting only' slogan does not erase those assistance duties. Full exemption after signature is not how GDPR allocates processor accountability.