The data controller decides the purposes for which as well as suggests by which own data is processed. PCI compliance is divided into 4 stages, determined by the annual amount of credit rating or debit card transactions a company processes. The classification level decides what an organization needs to do https://www.nathanlabsadvisory.com/blog/nathan/discover-the-best-software-vulnerability-scanning-in-the-usa/