Personal Data Protection Act, No. 9 of 2022 49 “Data Protection Officer” means, the person designated or appointed under section 20 of this Act; “data subject” means, an identified or identifiable natural person, alive or deceased, to whom the personal data relates; “identifiable natural person” is a natural person who can be identified, directly or indirectly, by reference to any personal data; “encryption” means, the act of ciphering or altering data using mathematical algorithm to make such data unintelligible to unauthorized users; “financial data” means, any alpha-numeric identifier or other personal data which can identify an account opened by a data subject, or card or payment instrument issued by a financial institution to a data subject or any personal data regarding the relationship between a financial institution and a data subject, financial status and credit history relating to such data subjects, including data relating to remuneration; “genetic data” means, personal data relating to the genetic characteristics of a natural person which gives unique information about the physiology or the health of that natural person which results from an analysis of a biological sample or bodily fluid of that natural person;