Data Protection [No. 3 of 2021 93 “data auditor” means a person licensed as a data auditor under section 29; “data controller” means a person who, either alone or jointly with other persons,controls and is responsible for keeping and using personal data on a computer, or in structured manual files, and requests, collects, collates, processes or stores personal data from or in respect of a data subject; “data processor” means a person, or a private or public body that processes personal data for and on behalf of and under the instruction of a data controller; “Data Protection Commissioner” means a person appointed as Data Protection Commissioner under section 5; “data retention” means a process of retention of personal data for a specified purpose for a defined period; “data subject” means an individual from, or in respect of whom, personal information is processed; “genetic data” means any personal information relating to the inherited or acquired genetic characteristics of an individual which result from the analysis of a biological sample from the individual in question, in particular chromosomal deoxyribonucleic acid (DNA) or ribonucleic acid (RNA) analysis, or from the analysis of another element enabling equivalent information to be obtained; “health practitioner” has the meaning assigned to the word under the Health Professions Act, 2009; “Independent BroadcastingAuthority” means the Independent Broadcasting Authority established by the Independent Broadcasting Authority Act, 2002; “information system” means a system for the generation, sending, reception, storage, display or other processing of data messages, and includes the internet; “joint controllers” means two or more data controllers who jointly determine the purposes for which and the means by which personal data is processed; Act No. 24 of 2009 Act No. 17 of 2002