The GDPR uses specific terms to identify different activities and responsibilities in the data workstream. ‘Data processing’ refers to any automated or manual action that is performed on data (e.g. collecting, recording, organising, deleting). The ‘data controller’ is the legal entity which decides why and how personal data will be processed while the ‘data processor’ is the organisation which processes the personal data on behalf of the data controller and under their instructions. Depending on the nature of the data processing in question, ResMed may be the data controller and/or the data processor.