Section 83Meaning of “controller” and “processor”

(A1) [^F1 For the purposes of this Part—

• (a)
  an intelligence service is the “controller” in relation to the processing of personal data if it satisfies subsection (1) alone or jointly with others, and
• (b)
  a qualifying competent authority is the “controller” in relation to the processing of personal data that is the subject of a designation notice that is for the time being in force if the authority satisfies subsection (1) jointly with others.]

(1) [^F2This subsection is satisfied by a person who—]

• (a)
  determines the purposes and means of the processing of personal data, or
• (b)
  is the controller by virtue of subsection (2).

(2) Where personal data is processed only—

• (a)
  for purposes for which it is required by an enactment to be processed, and
• (b)
  by means by which it is required by an enactment to be processed,

the [^F3person on whom] the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.

(3) In this Part, “processor” means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).