Part 2: General processing Chapter 2: The GDPR Section 6: Meaning of "controller"
This section supplements the definition of "controller" found in Article 4(7) of the GDPR. This section explains that when personal data is processed only for the purpose and means for which it is required by legislation to be processed, the person who has the obligation under that legislation to process the data is the controller. This provision replicates section 1(4) of the 1998 Act.