Let's get this sorted now.

Yeah, I guess the first thing to say is there's a distinction to be drawn between controllers and processors.

So the UK GDPR has got this concept of a controller, which is the organisation that decides what happens with personal data.

It determines the purposes and means of the processing.

It's the language used.

And then a processor, which is essentially a service provider, they process data on behalf of the controller.

And the GDPR has some direct obligations that apply to processors, but it's much more limited.

What about cookies and electronic marketing? Are those covered by the same rules?