Question

A cloud payroll provider that processes employee personal data on behalf of your organization notifies you that one of its subcontractors experienced a data breach affecting your employees' records. As the privacy solutions engineer coordinating your organization's incident management process, what should be your FIRST priority upon receiving this notification?

Accepted Answer

Confirm the scope and nature of the affected personal data and validate the provider's obligations under your data processing agreement

Answer

Terminate the contract with the payroll provider for failing to prevent the breach at its subcontractor

Answer

Immediately notify all affected employees and the supervisory authority to avoid exceeding statutory timelines

Answer

Instruct the provider's subcontractor to preserve forensic evidence and lead the technical investigation directly