Personal information processor

Any organization or individual that independently determines the purposes and means of processing personal information. Processors bear the primary compliance obligations under the PIPL, including implementing security measures, conducting DPIAs, and fulfilling data subject requests.

Any person or organization who processes personal information on behalf of a personal information controller, acting only on the controller’s documented instructions and subject to contractual and security obligations imposed by the controller.