An organization uses a cloud provider that experiences a data breach. Under GDPR, which party bears primary responsibility for notifying affected data subjects?
-
A
The cloud provider as data processor
-
B
The organization as data controller
-
C
The national supervisory authority
-
D
The cloud provider's cybersecurity insurer