PII controller and PII processor

The two roles the ISO privacy standards attach controls to. A PII controller decides why and how personally identifiable information is processed; a PII processor processes it on the controller's behalf and on its instructions. They map to Data Fiduciary and Data Processor under DPDP and to controller and processor under GDPR, but the standards only tell you which controls to implement; the legal duties come from the law that applies to you.