A company is negotiating with a SaaS vendor that will process its customers' personal data. The company must meet its own regulatory breach-reporting deadlines. What should the contract specify regarding incident communication?
Select an answer to reveal the explanation.
Short Explanation
Your regulatory clock may start ticking when your vendor finds out, not when you finally hear about it. So you write the vendor's notification deadline, contacts and required details into the contract. The trap is handing your obligation to the vendor or leaving it to goodwill.
Full Explanation
When a vendor processes data on the company's behalf, the company usually remains responsible for meeting regulatory notification obligations, such as notifying a supervisory authority under GDPR without undue delay and, where feasible, within 72 hours of becoming aware of a breach. The company can meet such deadlines only if the vendor informs it promptly. The contract should therefore define what counts as a reportable incident, the maximum time for the vendor to notify the company, the named contacts and channels on both sides, the information the notification must contain, and the duty to cooperate. Having the vendor notify regulators and customers on the company's behalf misplaces the obligation; the controller generally decides what to report and remains accountable, and uncoordinated vendor messages can conflict with the company's own. A status page summary published on the vendor's normal schedule is a general communication to all customers, often too late and too vague to support regulatory reporting. Informal notification at an account manager's discretion provides no enforceable timeline or content, so the company cannot rely on it. Exam caveat: the outline frames this as communication with vendors, so focus on contractual timelines and contacts. Operational check: confirm the signed agreement states the notification timeframe and contacts, and test them during a joint tabletop exercise.