A retail company handles payroll accounting for its employees through a Software as a Service (SaaS) provider that uses a data center operator as a subcontractor. Who is responsible for the protection

Question

Options

• AThe SaaS provider
• BThe external auditing firm
• CThe retail company
• DThe data center operator

• A
  74% (37)
• B
  4% (2)
• C
  6% (3)
• D
  16% (8)

Explanation

In this scenario, the retail company has outsourced payroll processing to a SaaS provider, making the SaaS provider the data processor with direct contractual and operational responsibility for safeguarding employee personal data. Critically, the SaaS provider also independently engaged the data center operator as a sub-processor, which means the SaaS provider is accountable for ensuring that subcontractor's compliance as well. The retail company (C) holds data controller status and bears ultimate accountability for the lawfulness of processing, but the question asks who is responsible for the protection of the data in this chain-that operational and contractual responsibility sits with the SaaS provider. An external auditing firm (B) has no data custody, and the data center operator (D) is a sub-processor accountable to the SaaS provider, not the retail company.

No community discussion yet for this question.