Part 1: Preliminary Section 3: Terms relating to processing of personal data
This section defines key terms used in the Act.
	Part 2 of the Act concerns general data and makes provision for those areas where the GDPR gives Member States discretion in their implementation. To fully understand the Act it is necessary to read it alongside the definitions found in the GDPR.
	The Act adopts many of the definitions found in Article 4 of the GDPR and extends them to apply across the Act. In particular the following definitions are adopted:
Term
GDPR Definition
Act Definition
Personal data
Any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Subsections (2) and (3) extend the GDPR definition to apply across the Act.
Processing
Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Subsection (4) extends the GDPR definition to apply across the Act.
Filing system
Any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.
Subsection (7) extends the GDPR definition to apply across the Act.
	The meaning of the terms "personal data", "processing", "controller" and "processor" within Parts 2 to 4 of the Act may be limited or modified by the regimes within those Parts. For example, the meaning of "controller" is modified in Chapter 2 of Part 2 for the purposes of that chapter (see section 6) and also limited by the scope of the Chapter 2 of Part 2 regime. Subsection (14) states that where such terms appear in Parts 5 to 7 of the Act – which contains cross-cutting provisions that apply to all of the regimes in Parts 2 to 4 of the Act – its meaning will depend on the applicable regime, except where otherwise provided. Generally, references in Parts 5 to 7 to the GDPR should be read as including the applied GDPR; and references in Parts 5 to 7 to Chapter 2 of Part 2 should be read as including Chapter 3 of Part 2.