Information Security: Accountability
Organisations are being reminded that accountability for personal data cannot be outsourced. Even when a third-party supplier is involved in a security incident, the Data Controller remains responsible for assessing risks, managing notifications, and meeting regulatory obligations.