[jacquesm]

Article 28 makes it a requirement that the processor and the controller arrange for this notification requirement to be arranged between them. A failure to do so by the processor would likely make them liable. The processor is only able to discharge itself from this liability if they notify the controller promptly.

For more reading on this:

https://ico.org.uk/for-organisations/guide-to-data-protectio...