. "The data controller may be an individual or an organization that is legally treated as an individual, such as a corporation or partnership." . . . .