Responsibilities and GDPR reporting in case of hacked email marketing platforms

Question

Company A allows subscription to its newlsletter via email, and their email list and newsletter is taken care of by company X. So A is hosting the page where one can subscribe, X handles list and list building, subscription (double opt-in) and unsubscription and sending out emails, while A creates the content of these emails.

A and X are both based in the EU. A has the following statement in their privacy declaration:

(3) The personal data collected when registering for the newsletter will only be used to send our newsletter. Furthermore, subscribers to the newsletter could be informed by e-mail if this is necessary for the operation of the newsletter service or a relevant registration, as this could be the case in the case of changes to the newsletter offer or changes in the technical conditions. The personal data collected as part of the newsletter service will not be passed on to third parties, with the exception of the e-mail service provider (company X - address, France). An order processing contract has been concluded with the provider.

Now my question:

In case X would be hacked (or some other undesirable event occurs) and the email lists related to A show up in the Internet, then to my understanding X has to report to the data protection authority and has to deal with the issue.

Is A also involved in this reporting? Or not at all?

Answer 1

It seems that A is the data controller and X is a data processor who processes personal data on behalf of A, and will only use the data as instructed by A. This will be formalized by a contract/data processing agreement per Art 28 GDPR, which is probably meant here by a “order processing contract”.

The Art 33 GDPR responsibility to notify the supervisory authority in the event of a data breach lies solely with the data controller A, not the processor X. However, the processor X is required to notify the controller A “without undue delay”.