The person or organisation who determines the purposes for which and the manner in which any personal data are, or are to be processed. The “data processor” is any person (other than an employee of the data controller) who processes the data on behalf of the data controller.