GDPR terms explained

Data Controller an individual or legal body who, alone or jointly with others, decides the purposes for and the means by which Personal Data is processed.  They are responsible for ensuring that the processing of Personal Data complies with the relevant requirements of the GDPR and the law governing privacy in general.
Data Processor someone (other than an employee of the Data Controller) who processes Personal Data on behalf of the Data Controller.
Data Subjects individuals about whom Personal Data is held.
Personal Data any information (whether opinion or fact) relating to an identified or identifiable living person.  A person can be identified (directly or indirectly) in a number of ways, including from their name, an identification number, an IP address or by factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity. In a pensions context, personal data includes members’ names, contact details, dates of birth, national insurance numbers,
bank account and salary details.
Processing is broadly defined, covering almost anything that can be done with Personal Data, including collecting, recording, organising, structuring, storing, adapting, altering, retrieving, consulting, using, disclosing or destroying.
Special categories of Personal Data the GDPR’s term for sensitive personal data, it comprises Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, as well as the Processing of genetic data and biometric data used for identification purposes.