Scenario: An organization has been using a storage transfer service to import market-sensitive data, including email addresses and contact details…

Under Article 30 of GDPR, controllers and processors must maintain a record of processing activities

(ROPA). Whenever changes occur in the way personal data is processed (such as a transfer to cloud

storage), the DPO must ensure these changes are recorded in the processing register.

Option B is correct because the DPO must ensure the data processing register is updated to reflect

the new storage method.

Option A is incorrect because storage changes do not require new consent unless the purpose of

processing has changed.

Option C is incorrect because while assessing security measures is important, it is not the primary

duty related to the data processing register.

Option D is incorrect because not all processing changes require notifying the supervisory authority

unless they introduce high risks without proper safeguards.

Reference:

GDPR Article 30(1)(g) (Controllers must maintain updated processing records)

Recital 82 (Controllers should document changes in processing activities)