Under the Data Protection Act in the United Kingdom, data subjects are individuals whose data is collected and data controllers are those upon which duties are placed to decide how and why that data is processed. "A data controller means ... a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed." A data controller must be a "person" under the law, meaning it could be an individual, an organization, and other corporate and unincorporated bodies of persons. They are usually organizations, though.
Even if a person is given the responsibility within an organization, that person will be acting on behalf of the organization, so the organization will be the data controller. The data controller "must ensure that any processing of personal data for which they are responsible complies with the Act." As such, a data processor "in relation to personal data, means any person (other than an employee of the data controller) who processes the data on behalf of the data controller."
Go here for a comprehensive explanation of the difference between data controllers and data processors and what the governance implications are for each: https://ico.org.uk/media/for-organisations/documents/1546/data-controllers-and-data-processors-dp-guidance.pdf.