What is a PII controller?

A PII controller is the privacy stakeholder that determines the purposes and means of processing personally identifiable information. This means the controller decides why PII is processed, what PII is needed, how it is processed, how long it is retained, who receives it, and which controls are required. Option A describes the PII principal, which is the natural person to whom the PII relates. Option C describes a PII processor, which processes PII on behalf of and according to the instructions of the controller. ISO/IEC 27002 includes privacy and PII protection as part of its information security control guidance where privacy obligations apply. The distinction matters because controllers carry decision-making responsibility and accountability for lawful, secure, and appropriate processing. Processors must protect the information but do not independently determine the processing purpose. Relevant controls include privacy and protection of PII, access control, supplier relationships, information deletion, data masking, data leakage prevention, and cloud service controls. The verified answer is therefore option B. References/Chapters: ISO/IEC 27002:2022, Control 5.34 Privacy and protection of PII; Control 5.19 Information security in supplier relationships; Control 8.11 Data masking.

==========