A cloud provider acting as a GDPR processor discovers that personal data it hosts for one of its customers, the controller, has been exfiltrated by an attacker. What is the provider's primary notification obligation under the GDPR?
Select an answer to reveal the explanation.
Short Explanation
Picture a relay race: the processor's job is to hand the baton to the controller fast, and the controller runs it to the regulator and, if needed, to the people affected. If you're the processor and you sprint off to the regulator on your own, the handoff is broken. That's the trap here.
Full Explanation
The GDPR assigns breach duties by role. A processor that becomes aware of a personal data breach must notify the controller without undue delay, and it must assist the controller in meeting its own obligations by providing the information it has about the nature, scope and likely consequences of the breach. The controller then decides whether the breach must be reported to the supervisory authority, generally without undue delay and where feasible within 72 hours of the controller becoming aware, and whether communication to data subjects is required because of a high risk. Notifying the authority directly instead of the controller misplaces the regulatory obligation, which rests with the controller, and leaves the controller unaware of a breach it is accountable for. Contacting data subjects directly is also the controller's decision and responsibility; a processor acting alone could issue inaccurate or premature messages. Claiming processors have no breach duties ignores the explicit processor obligation and the contractual assistance terms that processor agreements must include. Exam caveat: contracts often specify a shorter internal deadline for processor notification so controllers can meet the 72-hour window. Operational check: confirm the data processing agreement defines the notification timeframe, contact points and required breach details.