ISC2 Certified Cloud Security Professional (CCSP) Practice Question

A U.S.-based Software-as-a-Service (SaaS) provider that hosts human-resources data for several European customers detects indicators that attackers have downloaded personnel records containing employee names, national ID numbers, and salary details. The master services agreements name each customer as the data controller and the provider as the data processor under the EU General Data Protection Regulation (GDPR). To meet mandatory regulatory requirements, which communication action must the provider take first?

Notify each affected data controller without undue delay, providing all relevant breach details so they can report to the supervisory authority within 72 hours.
Complete a full forensic investigation within 30 days, then deliver a comprehensive incident report to controllers and regulators.
Issue an immediate public statement to reassure users and defer regulator notification until after remediation is finished.
Report the breach directly to the appropriate EU supervisory authority within 24 hours, bypassing the data controllers.

Report Issue

Answer Description

Under GDPR Article 33, when a personal data breach occurs, the data processor must notify the affected data controller "without undue delay" after becoming aware of the incident and must provide sufficient information to allow the controller to meet its own obligation to notify the competent supervisory authority within 72 hours. The processor has no direct reporting duty to the regulator unless the contract explicitly delegates that task. Therefore, promptly informing each controller-and equipping them with details needed for the regulatory report-fulfills the processor's legal responsibility.

The other actions either bypass the controller (directly contacting the authority), delay notification until a full investigation is complete, or focus on public relations. All would risk non-compliance with GDPR reporting timelines or contractual obligations.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.