The data controller, typically the organization collecting and using the data, is primarily responsible for the security of sensitive data. However, data processors, who handle data on behalf of the controller, also share responsibility for implementing appropriate security measures as specified in their contract with the controller.