Skip to content

ACCA Strategic Professional · Strategic Business Leader · Big data and data analytics

Verity Logistics suffers a breach exposing the personal data of 40,000 customers held in its cloud analytics platform. The platform is run by a third-party provider under contract. The CEO says responsibility lies wholly with the provider. Which response is MOST consistent with good governance?

Verity remains accountable as data controller. Outsourcing processing to a cloud provider does not transfer responsibility, so the board must oversee the provider, assess the breach and meet notification duties. Data risk is a governance matter, not solely an IT or supplier issue.

  1. AVerity, as data controller, retains accountability for protecting the data and must oversee the provider, assess the breach and notify as requiredCorrect
  2. BResponsibility transfers entirely to the provider once data is outsourced
  3. COnly the IT manager is accountable, as the board has no role in data risk
  4. DNo action is needed unless customers complain

Explanation

Outsourcing processing does not transfer accountability; the controller must perform due diligence, monitor the processor, and handle breach assessment and notification. Governance places data risk oversight with the board, not only IT.

Did you get it right without looking?

One question tells you little. A timed set on Big data and data analytics shows your real accuracy, how long you take and where you lose marks.

Practise Big data and data analyticsFree diagnostic mock

More Big data and data analytics questions