General processing Definitions
The key terms used in the GDPR are largely consistent with the 1998 Act but the new Act makes use of derogations where it is possible to achieve further consistency. Article 4(7) of the GDPR defines what is meant by a ‘controller’ as the legal or natural person that determines the purposes and means of the processing of personal data. This is similar to the 1998 Act, but section 1(4) of the 1998 Act goes further by clarifying who is the controller when processing is required under an enactment. The new Act ensures that the clarity in section 1(4) is preserved.
	The term ‘public authority’ is not defined in the GDPR. For clarity and legal certainty the Act adopts the definitions in the Freedom of Information Act 2000 ("the 2000 Act") and the Freedom of Information (Scotland) Act 2002, subject to two qualifications. First, public authorities are only to be treated as public authorities for the purposes of the GDPR when they are carrying out a task in the public interest or in the exercise of official authority vested in it. Second, the Act specifically excludes parish councils, community councils and similar bodies from the definition because in the government’s view these bodies are very small in terms of personnel, budget and the volume of personal data processed such that the additional safeguards that public authorities normally have to apply would be disproportionate in these instances.