Personal information processing may be carried out by individuals, or by non-public or community organisations, for instance corporations or public authorities. Their tasks and liability for certain data processing count on the function that they play from the processing in question. PCI compliance is split into four levels, determined by https://www.nathanlabsadvisory.com/blog/tag/data-protection-impact-assessments/