The city moves citizen service requests into a SaaS help-desk product. Who remains accountable for how that citizen data is classified and shared?
Select an answer to reveal the explanation.
Short Explanation
Handing the help-desk app to SaaS is like hiring a warehouse—you still own what is in the boxes. The city keeps accountability for classifying and sharing citizen data; the vendor hosts, it does not become the records owner.
Full Explanation
Moving citizen service requests into a SaaS help-desk product does not transfer accountability for classification and sharing decisions away from the city. Under shared responsibility and public-sector governance, the municipality remains accountable for how citizen data is classified, who may access it, and how it is shared—even when the SaaS vendor hosts the application. Vendors provide controls; the city must use them appropriately.
Assigning accountability only to the SaaS vendor because the city no longer operates servers misunderstands shared responsibility. The ISP that routes API calls is not the records controller for classification. Claiming SaaS removes all compliance duties is false and dangerous for civic privacy.
Exam caveat: shared responsibility models vary by IaaS/PaaS/SaaS, but customer accountability for data classification, access decisions, and acceptable use typically remains. Contracts and DPAs allocate some duties but do not erase public-sector obligations.
Operational check: publish a data classification for help-desk tickets, configure SaaS roles/sharing to match, restrict export integrations, train staff, and review sharing reports quarterly. Keep the accountability statement in the city’s privacy program documentation.