Definitions of ‘data controller’ The definition of ‘controller’ under the General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR) is similar to the definitions under Directive 95/46/EC, the Data Protection Directive. A comparison with the definition under the Data Protection Act 1998 (DPA 1998) is set out below: Data Protection Directive DPA 1998 GDPR Article 2(d) of Directive 95/46/EC:'controller' shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by national or Community laws or regulations, the controller or the specific criteria for their nomination may be designated by national or Community law DPA 1998, s 1(1):‘data controller’ means, subject to subsection (4), a person