I. The U.S. privacy environment
A processor discovers a breach affecting personal data it handles for a controller. What is the processor's obligation under the GDPR?
- Notify affected data subjects directly
- Notify the controller without undue delay
- Take no action unless the controller asks
- Notify the DPA within 72 hours directly
Show the answer and explanation
Notify the controller without undue delay
Processors must notify the controller without undue delay after discovering a breach. The 72-hour DPA deadline and the duty to notify subjects fall on the controller, not the processor.