Everyone, because GDPR is made to ensure global protection of personal data

Individuals, because they need to take appropriate measures to protect their data

Controllers, because they decide what is done with personal data