A SaaS vendor argues it is 'only hosting' and therefore need not help the controller with data-subject requests or security incidents. Under GDPR processor duties, what is the better view?

A SaaS vendor that claims it is ‘only hosting’ and therefore need not help with data-subject requests or security incidents misunderstands processor duties: processors must assist the controller, as appropriate, with rights fulfilment, security, and personal-data breach obligations. Hosting citizen or customer data is still processing; the civic expectation is that the infrastructure partner helps the controller honour rights and contain incidents rather than hiding behind a hosting slogan. Saying processors may ignore data-subject rights until a court names them as controllers fails by inventing a court-order precondition that GDPR processor assistance duties do not require. Claiming hosting-only processors are exempt from all GDPR articles once the contract is signed fails: signature creates, rather than erases, Article 28-style obligations. Asserting that only the European Commission can require processor breach assistance fails by misplacing enforcement and assistance sources—duties arise from the Regulation and the controller–processor contract, not Commission case-by-case mandates. Exam caveat: assistance is calibrated to the nature of processing and information available to the processor; it is not an unbounded duty to become the public face of every request, but refusal to assist at all is wrong. Operational check: ensure the DPA/Art. 28 clauses require timely DSR, security, and breach cooperation; define escalation SLAs; run a tabletop on a rights request and a suspected breach; and reject ‘hosting only’ carve-outs that gut assistance.