Who is responsible when our SaaS provider is breached?

Usually both of you, for different things. The provider is responsible for securing its service and, under the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., a provider acting as your processor must notify you without undue delay after becoming aware of a personal data breach. You, as the controller of your customers' or employees' data, remain responsible for assessing the risk to the people affected and, where required, notifying the supervisory authority within 72 hours of becoming aware, and informing the people concerned if the risk is high. If your company falls under NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies., a significant incident caused by a supplier can trigger your own reporting duties, and NIS2 expects you to manage supply-chain security as part of your risk-management measures. Contracts decide much of the practical side: notification times, cooperation, information you will receive and liability. Prepare before it happens: know which suppliers hold which data, keep their security contacts, and include a supplier breach in your incident plan. Your national NIS2 law may add details; check it.

← All 25 questions on Cloud and SaaS securityAll topics