Personal data processing could be carried out by people, or by private or public organisations, like businesses or public authorities. Their duties and liability for unique info processing count on the job that they Enjoy in the processing in issue. Formally attest your compliance. An AOC (attestation of compliance) is https://www.nathanlabsadvisory.com/pci-3ds.html