Who holds resonponsibility for data security?

Data Processor

One of the data protection positions. A human or legal being, governmental entity, business, or other organization that handles personal data on behalf of the controller. In some cases, an entity can be both a data controller and a data processor.