What is the difference between a data controller and a data processor in privacy law contexts?

What is the difference between a data controller and a data processor in privacy law contexts?

• A. A data processor sets the purposes while the controller handles compliance.
• B. They are the same roles.
• C. A data controller determines purposes and means of processing PHI; a data processor processes PHI on behalf of the controller and is bound by contractual obligations.
• D. A data controller only handles non-PHI data.

Answer: (C)