Entities (such as an organisation) which determine the purposes and means of the processing of personal data.