An entity (such as an organisation) which determines the purposes and means of the processing of personal data.