Company X has entrusted the processing of their payroll data to Provider Y. Provider Y stores this encrypted data on its server. The IT department of Provider Y finds out that someone managed to hack into the system and take a copy of the data from its server. In this scenario, whom does Provider Y have the obligation to notify?

Question

Quizplus · Accepted Answer

Provider Y has an obligation to notify Company X, as they are the data controller and have entrusted Provider Y with processing their data.

Company X Has Entrusted the Processing of Their Payroll Data