Exam CIPP-E topic 1 question 48 discussion

D. Maintaining evidence that the processor was the best possible market choice available. Under the GDPR, while it is important for a data controller to document due diligence, conduct risk assessments, and ensure the processor is contractually obligated to notify the data controller of any breaches, simply proving that the processor was the best choice in the market does not absolve the data controller of responsibility. The data controller must ensure that the processor meets GDPR requirements and has appropriate security measures in place.

C. Requiring that the processor directly notifies the appropriate supervisory authority. Under the GDPR, it is the responsibility of the data controller to notify the supervisory authority in the event of a data breach, not the processor. The processor's responsibility is to notify the controller without undue delay after becoming aware of a breach.

Also agree that it should be C. the responsibility of notifying the Supervisory authority should be the controller, not the processor.

Also agree that it should be C. the responsibility of notifying the Supervisory authority should be the controller, not the processor.

i think it is C