# Who is responsible when our SaaS provider is breached?

Usually both of you, for different things. The provider is responsible for securing its service and, under the GDPR, a provider acting as your processor must notify you without undue delay after becoming aware of a personal data breach. You, as the controller of your customers' or employees' data, remain responsible for assessing the risk to the people affected and, where required, notifying the supervisory authority within 72 hours of becoming aware, and informing the people concerned if the risk is high. If your company falls under NIS2, a significant incident caused by a supplier can trigger your own reporting duties, and NIS2 expects you to manage supply-chain security as part of your risk-management measures. Contracts decide much of the practical side: notification times, cooperation, information you will receive and liability. Prepare before it happens: know which suppliers hold which data, keep their security contacts, and include a supplier breach in your incident plan. Your national NIS2 law may add details; check it.

FAQ: [Cloud and SaaS security](https://netsenx.com/en/faq/cloud) · https://netsenx.com/en/faq/who-is-responsible-when-a-saas-provider-is-breached

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/eu-data-residency

## Related questions

- [Does NIS2 make us responsible for our cloud providers' security?](https://netsenx.com/en/faq/does-nis2-make-us-responsible-for-our-cloud-providers)
- [What do we do if a cloud or SaaS account is compromised?](https://netsenx.com/en/faq/what-to-do-if-a-cloud-account-is-compromised)
- [What is the shared responsibility model in the cloud?](https://netsenx.com/en/faq/what-is-the-shared-responsibility-model-in-the-cloud)
- [What is the difference between IaaS, PaaS and SaaS?](https://netsenx.com/en/faq/what-is-the-difference-between-iaas-paas-and-saas)
- [Does moving to the cloud make us safer?](https://netsenx.com/en/faq/does-moving-to-the-cloud-make-us-safer)