“genetic data” means all data relating to the genetic characteristics of an individual which have been either inherited or acquired during prenatal development, as they result from an analysis of a biological sample from the individual concerned, in particular chromosomal, DNA or RNA analysis or analysis of any other element enabling equivalent information to be obtained; “personal data” means any information relating to an identified or identifiable individual (‘data subject’). An identifiable individual is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, a pseudonym, and IP address, location data, factors relating to the economic, mental, cultural, physical, genetic, biometric or social identity and online identifier, and includes ‘singling-out’ an individual; “personal data breach” means a breach of security leading to the accidental or unlawful use, destruction, loss, alteration, disclosure of, or access to, personal data transmitted, stored or otherwise processed; “processing” means any operation or set of operations performed on personal data, whether or not it occurs by automatic mean, and includes, but not exhaustively, the collection, recording, organisation, structuring, storage or preservation, combination, adaption or alteration, access, retrieval or consultation, transmission, disclosure or making available, restriction, erasure, or destruction of, or the carrying out of logical and/or arithmetical operations on such data; Where automated processing is not used, ‘processing’ means an operation or set of operations performed upon personal data within a structured set of such data, which are accessible or retrievable according to specific criteria allowing the controller or any other person to search, combine or correlate the data to a specific data subject; “processor” means a natural or legal person which processes personal data on behalf of the controller. Instructions that a controller is required to provide to a processor shall limit what the processor is permitted to do with the personal data; “profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular, to analyse or predict aspects concerning that individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements; “pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information and the additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable individual; “recipient” means a natural or legal person or public body to whom data are disclosed or made available; “restriction of processing” means the marking of stored personal data to limit their processing in the future; “special categories of personal data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, 4