190. Section 28 of the Education (Welfare) Act 2000 is amended—

(a) by the substitution of “controller” for “data controller” in each place it occurs, and

(b) in subsection (3), by the deletion of “ ‘data controller’ and ‘personal data’ have the meanings assigned to them by the Data Protection Act 1988” and the insertion of the following:

“ ‘controller’ means a controller within the meaning of the Data Protection Regulation;

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016²⁵ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

‘personal data’ means personal data within the meaning of the Data Protection Regulation;”.