The General Data Protection Regulation applies to $q,$ which are the human beings whose data an organization has or processes.

natural persons

data processors

data controllers

$$ data subjects