"Data controllers can either be legal entities such as companies, Government departments or voluntary organisations or they can be individuals such as general practitioners (GPs), pharmacists or sole traders." . . . .