CEICC key terms

A binding legal instrument adopted by a public authority that applies directly and generally, often without needing national implementing legislation. Non-compliance exposes an organization to enforcement action, fines, or other sanctions.

A legal instrument that sets a required outcome but leaves member states to choose the form and method of implementation, usually through national transposing law. Compliance therefore depends on the local version, not the directive text alone.

The process of aligning laws, standards, or practices across jurisdictions or sectors so that a single approach satisfies multiple requirements. It reduces conflicting obligations and simplifies cross-border compliance operations.

An independent public body empowered to interpret and enforce data protection law, investigate complaints, and impose corrective measures or fines. Organizations typically deal with the authority where they are established or where affected individuals reside.

The single supervisory authority designated to coordinate cross-border processing matters for an organization with establishments in several jurisdictions. It acts as the main contact and consolidates enforcement under the one-stop-shop model.

The obligation to take responsibility for complying with data protection rules and to be able to demonstrate that compliance through policies, records, and evidence. It shifts focus from mere notification to provable, ongoing control.

Any information relating to an identified or identifiable natural person, including identifiers such as names, numbers, location data, or online identifiers. Whether data is personal depends on the realistic possibility of re-identification.

Personal data revealing sensitive characteristics such as racial or ethnic origin, political opinions, religion, health, sexual orientation, or biometric and genetic data. Processing usually requires a specific legal basis and stronger safeguards.

The individual to whom personal data relates and from whom data protection rights derive. Organizations must support rights such as access, correction, erasure, and objection within defined timeframes.

A request from an individual to confirm whether their personal data is processed and to receive a copy plus contextual information. Organizations must verify identity, locate all relevant data, and respond within the statutory deadline.

The lawful ground that justifies handling personal data, such as consent, contract performance, legal obligation, vital interests, public task, or legitimate interests. Each processing activity needs an identified and documented basis.

A freely given, specific, informed, and unambiguous indication of agreement to processing, expressed by a clear affirmative action. It must be as easy to withdraw as to give and is documented for proof.

A structured risk assessment required before processing that is likely to cause high risk to individuals, such as large-scale monitoring or sensitive data use. It documents necessity, risks, and mitigating measures.

An approach that builds data protection safeguards into systems and processes from the outset rather than adding them afterward. It includes data minimization, purpose limitation, and default settings that protect privacy.

Replacing direct identifiers with artificial keys so data can no longer be attributed to a person without separately secured additional information. It reduces exposure while still treating the data as personal data.

Irreversibly altering data so that no individual can be identified by any means reasonably likely to be used. Properly anonymized data falls outside personal data rules, so the standard for irreversibility must be defensible.

Moving personal data to another country or to an international organization. It requires a valid transfer mechanism such as adequacy decisions, standard contractual clauses, or binding corporate rules.

A formal determination by an authority that another country provides an essentially equivalent level of data protection. Transfers to that country may then proceed without additional safeguards.

Pre-approved contractual terms that import data protection obligations into a transfer agreement between exporter and importer. They are commonly paired with a transfer impact assessment.

An internally binding set of data protection policies approved by a supervisory authority that governs intra-group transfers of personal data across jurisdictions. They require demonstrable enforcement within the corporate group.

An analysis of the destination country's laws and practices to judge whether imported safeguards can actually protect transferred data. It identifies supplementary measures where protection gaps exist.

The structures, roles, and decision rights that direct how an organization manages risk and compliance. It assigns accountability at board and executive level and sets the tone for control culture.

A governance structure separating management owning risk, an independent risk and compliance function providing oversight, and internal audit giving independent assurance. Clear separation prevents conflicts of interest.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative or quantitative terms. It guides decisions on controls, acceptance, and escalation thresholds.

The acceptable variation around the risk appetite applied to specific activities or metrics. It translates high-level appetite into practical thresholds that trigger action when breached.

Selecting and implementing options to address assessed risk: mitigate through controls, transfer through insurance or contracts, avoid the activity, or accept the residual level with documented approval.

The risk remaining after existing controls and treatments have been applied. It must be compared against tolerance and formally accepted by an accountable owner when it exceeds thresholds.

The level of risk that exists before any controls are applied, used as a baseline to judge control effectiveness. Comparing it with residual risk shows how much protection controls actually provide.

A measurable metric that provides early warning that risk exposure is rising or exceeding tolerance. Effective indicators are tied to specific risks, monitored regularly, and have defined escalation triggers.

A safeguard, policy, procedure, or technical measure that reduces the likelihood or impact of a risk. Controls are designed, implemented, tested, and evidenced to show they operate as intended.

A measure designed to stop an unwanted event before it occurs, such as access restrictions, input validation, or segregation of duties. It reduces likelihood rather than detecting failure after the fact.

A measure that identifies unwanted events after they happen, such as log monitoring, reconciliation, or intrusion detection. Detection speed directly limits the damage an incident can cause.

Granting users and systems only the access needed to perform their assigned tasks, for only as long as needed. It limits the blast radius of compromised accounts and insider misuse.

Dividing sensitive tasks so no single person can initiate, approve, and record a transaction alone. It prevents fraud and error by requiring collusion to bypass controls.

Converting data into a form unreadable without the correct key, protecting confidentiality in transit and at rest. Its value depends on sound key management and correct configuration.

Recording system and user activity and reviewing it for signs of misuse, error, or attack. Logs must be protected from tampering and retained long enough to support investigation and audit.

A documented set of roles, steps, and communication paths for detecting, containing, eradicating, and recovering from security incidents. It is validated through exercises and updated after lessons learned.

An event that actually or potentially compromises the confidentiality, integrity, or availability of information or systems. Classification determines escalation, evidence handling, and whether notification duties arise.

The duty to inform regulators and affected individuals about a personal data breach within prescribed timeframes when it poses a risk to their rights. It requires documented assessment of scope and harm.

A post-incident review that identifies root causes and control weaknesses and converts them into tracked corrective actions. It closes the loop between response and improved resilience.

Pre-contract investigation of a vendor's security, financial, and compliance posture to judge whether risks are acceptable. Depth should be proportionate to the criticality and data sensitivity of the service.

Risk introduced by a vendor's own subcontractors or suppliers, which can bypass controls the organization assessed directly. It requires flow-down obligations and visibility into the extended supply chain.

A contractual provision allowing the customer or its appointed auditor to examine a supplier's controls and evidence. It is often satisfied through independent reports instead of on-site visits.

A contract term requiring the supplier to impose specified obligations, such as security or privacy duties, on its own subcontractors. It preserves protection as services pass down the chain.

An independent auditor's report on a service provider's controls, covering either design at a point in time or design and operating effectiveness over a period. It supports oversight of outsourced processes.

An independent function that evaluates the design and effectiveness of controls and governance and reports objectively to the board or audit committee. It provides assurance, not management of risk.

Information gathered to support an auditor's conclusion, such as records, observations, configurations, and interviews. Evidence must be sufficient and appropriate in quality and quantity.

A chronological record of activity and changes that allows reconstruction of who did what and when. It supports investigations, demonstrates control operation, and underpins accountability.

A documented schedule of remediation steps, owners, and deadlines addressing findings from audits, incidents, or assessments. Progress is tracked and verified to confirm issues are genuinely closed.

The degree to which a control actually achieves its intended objective when operating in practice. It is tested rather than assumed, and results inform residual risk and remediation priorities.

Ongoing automated or periodic checking of controls, configurations, and compliance status instead of relying on annual point-in-time reviews. It surfaces drift and exceptions early enough to act.