Is Cyber Crucible a data controller or a data processor?

Short answer: In most engagements Cyber Crucible acts as a data processor on behalf of the customer, who is the controller. The customer determines the purposes and means of processing; Cyber Crucible processes data only on the controller's documented instructions, under a written Data Processing Agreement.

Why the distinction matters

Nearly every regime in this family — PDPL, GDPR, and their derivatives — allocates obligations by role. Controllers decide why and how data is processed and carry the heavier duties: informing data subjects, handling rights requests, and in some cases registration.

Processors must follow lawful instructions and protect the data. Under PDPL, a processor that used data beyond the controller's instructions would itself be treated as a controller — which is why scope is defined contractually rather than left to interpretation.

In practice

Cyber Crucible operates under a written DPA or service agreement specifying the scope of processing, and does not repurpose or retain data outside those instructions.

Because it is normally a processor, controller-specific obligations rest with you: informing data subjects about processing, responding to rights requests, and similar.

The exception

Only if Cyber Crucible processed personal data for its own purposes would it be a controller, and it would then assume full controller obligations including registration and consent where applicable. That is not the operating model.