Compliance

Personal information processor

Entity determining purposes and means of personal data processing.

How the laws define this

Both instruments agree that a personal information processor is a person, individual, or organization that handles personal information and must uphold security duties. However, they fundamentally diverge on the role's decision-making autonomy and legal standing. Under the Personal Information Protection Law of the People's Republic of China (PIPL), a processor independently determines the purposes and means of processing personal information, serving as the main responsible entity that bears primary compliance obligations such as implementing security measures, conducting DPIAs, and fulfilling data subject requests. Conversely, under the Data Privacy Act of 2012 (Republic Act No. 10173), a personal information processor possesses no independent authority over processing decisions; instead, it processes personal information on behalf of a personal information controller, acting strictly on that controller’s documented instructions and subject to the contractual and security obligations imposed by the controller.

Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
China	Personal Information Protection Law	In Force	This definition covers organizations or individuals who independently determine purposes and means, explicitly assigning them primary compliance obligations like security measures, DPIAs, and data subject requests.
Philippines	Data Privacy Act of 2012 (Republic Act No. 10173)	In Force	This definition limits the term to persons or organizations processing on behalf of a controller, bound by the controller's documented instructions and contractual security obligations.

What it triggers

In China under the PIPL, processors bear the primary compliance obligations, including implementing security measures, conducting DPIAs, and fulfilling data subject requests.source
In the Philippines under the Data Privacy Act of 2012, processors are subject to contractual and security obligations imposed by the controller.

Definitions (2)

Any organization or individual that independently determines the purposes and means of processing personal information. Processors bear the primary compliance obligations under the PIPL, including implementing security measures, conducting DPIAs, and fulfilling data subject requests.

Personal Information Protection Law of the People's Republic of China (PIPL)Definition 1 of 2

Any person or organization who processes personal information on behalf of a personal information controller, acting only on the controller’s documented instructions and subject to contractual and security obligations imposed by the controller.

Data Privacy Act of 2012 (Republic Act No. 10173)Definition 2 of 2

Not to be confused with

Data processor

Data processor processes personal data only on behalf of a controller, whereas personal information processor under [2] matches that but [1] includes those independently determining purposes and means.

personal information controller/processor

Personal information controller/processor encompasses both those determining purposes/means and those processing on behalf, while personal information processor under [1] is only the former and under [2] only the latter.

Processor

Processor processes data solely on behalf of the controller, aligning with [2] but differing from [1] which includes independent decision-makers.

Questions and answers

Who has primary obligations as a personal information processor in China?

Under the PIPL, organizations or individuals independently determining purposes and means of processing bear primary compliance obligations. These include implementing security measures, conducting DPIAs, and fulfilling data subject requests.

What binds a personal information processor in the Philippines?

Processors act only on the controller’s documented instructions. They are subject to contractual and security obligations imposed by the controller.

How does personal information processor differ between China and Philippines?

In China, it refers to those independently deciding purposes and means with primary duties. In the Philippines, it is limited to those processing on behalf of a controller under their instructions and obligations.