(g) “critical personal data” means such personal data retained by the public service provider - excluding data open to the public - as well as data identified by sector regulators and classified by the Commission as critical or any data related to international obligations; (h) “data controller” means a person or the government, who either alone or jointly has the authority to decide on the collection, obtaining, usage, or disclosure of personal data; (i) “data processor” means a person or the government who alone or in conjunction with other(s) processes data on behalf of the data controller; (j) “data subject” means a natural person who is the subject of the personal data; (k) “disability” means the inability to engage in any substantial gainful activity because of any medically determinable physical or mental impairment or is perceived to exist whether or not it exists, which can be expected to result in death, or which has lasted or can be expected to last for a continuous period of not less than 12 months; (l) “financial data” means information regarding finances, including, but not limited to assets, income, liabilities, net worth, bank balances, financial history, any specific information of financial nature or any financial activities, or credit history; (m) “foreign data subject” means a data subject who is not a Pakistani national; (n) “genetic data” means personal data relating to inherited or acquired genetic characteristics of a natural person which give unique information about the behavioural characteristics, physiology, or health of that natural person and which results in particular, from an analysis of a biological sample from the natural person in question; (o) “Government” means the Federal Government, Provincial Government, and Local Governments and divisions or entities under their control; (p) “harm” means any harm, whether physical or non-physical, including, without limitation, psychological, financial, or reputational harm, or results in loss of employment or being subjected to blackmailing or extortion, under the circumstances, or withdrawal of any services and benefit due to an evaluative decision about data subject; 7