On this interpretation, a Controller would never have to notify of a data breach affecting its Processor if the Processor does not itself notify the Controller. The DPC rejected this interpretation.

The European Data Protection Board (EDPB) published two sets of new guidelines on 2 September 2020, on the concepts of controller and processor (Guidelines 07/2020, the Guidelines) and on the ...

Data controller vs data processor. A data controller determines the purpose and means of processing personal data, whereas a data processor is responsible for processing data on behalf of the ...