Exam CIPP-A topic 1 question 80 discussion

correction - D. When it processes data contrary to the provisions established in the contract.

Obligations of data intermediaries The PDPA provides that a data intermediary that processes personal data on behalf of and for the purposes of another organisation pursuant to a contract which is evidenced or made in writing will only be subject to the Data Protection Provisions relating to (a) protection of personal data (later referred to as the “Protection Obligation”); (b) retention of personal data (later referred to as the “Retention Limitation Obligation”); and (c) notifying the organisation of data breaches as part of notification of data breaches (later referred to as the “Data Breach Notification Obligation”), and not any of the other Data Protection Provisions. Where a data breach is discovered by a data intermediary , the data intermediary is required to notify the organisation without undue delay from the time it has credible grounds to believe that the data breach has occurred.