Company A allows subscription to its newlsletter via email, and their email list and newsletter is taken care of by company X. So A is hosting the page where one can subscribe, X handles list and list building, subscription (double opt-in) and unsubscription and sending out emails, while A creates the content of these emails.
A and X are both based in the EU. A has the following statement in their privacy declaration:
(3) The personal data collected when registering for the newsletter will only be used to send our newsletter. Furthermore, subscribers to the newsletter could be informed by e-mail if this is necessary for the operation of the newsletter service or a relevant registration, as this could be the case in the case of changes to the newsletter offer or changes in the technical conditions. The personal data collected as part of the newsletter service will not be passed on to third parties, with the exception of the e-mail service provider (company X - address, France). An order processing contract has been concluded with the provider.
Now my question:
In case X would be hacked (or some other undesirable event occurs) and the email lists related to A show up in the Internet, then to my understanding X has to report to the data protection authority and has to deal with the issue.
Is A also involved in this reporting? Or not at all?