Under GDPR, the entity that created or collected the PII. Bears ultimate legal liability for how that data is handled.
Want to actually apply concepts like this instead of just reading definitions?