which are data handlers?

In the context of GRC, which are data handlers?

A.
Employees and contractors

B.
Service providers

C.
SAN components

D.
End users populating a web form