216. Section 28 of the Student Support Act 2011 is amended—

(a) by the substitution of “controller” for “data controller” in each place it occurs,

(b) in subsection (1), by the substitution of “Notwithstanding anything contained in any enactment (other than the Act of 2018)” for “Notwithstanding anything contained in the Data Protection Acts 1988 and 2003 or any other enactment”, and

(c) in subsection (5), by—

(i) the substitution of the following definitions for the definition of “data controller”:

“ ‘Act of 2018’ means the Data Protection Act 2018;

‘controller’ means a controller within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;

‘Data Protection Regulation’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016⁴¹ on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);”,

(ii) the substitution of the following definition for the definition of “personal data”:

“ ‘personal data’ means personal data within the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;”,

and

(iii) the substitution of the following definition for the definition of “processing”:

“ ‘processing’ means processing with the meaning of—

(a) the Data Protection Regulation, or

(b) Part 5 of the Act of 2018;”.