Question

A European retailer (the data controller) uses a SaaS marketing platform (the data processor) to store customer contact details subject to GDPR. The processor detects unauthorized access to a database containing this personal data. Under GDPR, what is the processor's primary legal obligation regarding this incident?

Accepted Answer

Notify the controller without undue delay after becoming aware of the personal data breach

Answer

Notify the relevant supervisory authority within 72 hours of discovering the breach

Answer

Notify each affected data subject directly within 72 hours

Answer

Conduct a data protection impact assessment before disclosing the breach to anyone