natural person or legal entity or organization that processes personal information (PI) on behalf of and in accordance with the instructions of a PI controller and if it use PI only for the commissioned work