For the purposes of this Part—
an intelligence service is the "controller" in relation to the processing of personal data if it satisfies subsection (1) alone or jointly with others, and
a qualifying competent authority is the "controller" in relation to the processing of personal data that is the subject of a designation notice that is for the time being in force if the authority satisfies subsection (1) jointly with others.
This subsection is satisfied by a person who—
determines the purposes and means of the processing of personal data, or
is the controller by virtue of subsection (2).
Where personal data is processed only—
for purposes for which it is required by an enactment to be processed, and
by means by which it is required by an enactment to be processed,
the person on whom the obligation to process the data is imposed by the enactment (or, if different, one of the enactments) is the controller.
In this Part, "processor" means any person who processes personal data on behalf of the controller (other than a person who is an employee of the controller).