CCDL1 key terms

The system of decision rights and accountability that determines who may define, produce, approve, and use data, and how those decisions are enforced across an organization.

The operational role responsible for day-to-day care of a data domain: resolving quality issues, approving definitions, and ensuring policy is followed by producers and consumers.

The accountable role with authority over a specific data set or domain, including who may access it, how it is classified, and what retention rules apply to it.

A documented, approved statement of rules and expectations that governs how data is created, classified, stored, shared, retained, and destroyed within an organization.

A mandatory, measurable requirement that supports a policy, such as an approved date format, naming convention, or minimum encryption strength for a data class.

The process of assigning data to predefined sensitivity tiers, such as public, internal, confidential, and restricted, based on impact if disclosed or altered.

A maintained record of the data an organization holds, describing each data set, its location, owner, purpose, and classification so it can be governed and protected.

A searchable metadata repository that describes data assets, their schemas, lineage, ownership, and quality status, helping analysts find and trust suitable data.

A record of where data came from, how it was transformed, and where it flowed, used for impact analysis, debugging, audit, and regulatory traceability.

Data whose exposure or misuse could cause harm, including personal data, financial records, health information, credentials, and trade secrets, and which needs stricter controls.

The stages data passes through from creation or acquisition, through storage, use, sharing, archiving, and eventual destruction, each requiring distinct controls.

A defined period, justified by legal, regulatory, or business needs, during which a category of records must be kept before disposal is permitted.

A directive that suspends normal deletion and retention schedules for specified data because of anticipated litigation, investigation, or audit, until formally released.

The irreversible removal of data from all storage media, including backups and replicas, using methods such as cryptographic erasure or verified physical media destruction.

The principle of collecting and keeping only the data actually needed for a stated purpose, reducing exposure, storage cost, and regulatory scope.

Protection of stored data by converting it into unreadable ciphertext with a key, so that stolen disks, snapshots, or backups do not reveal plaintext content.

Protection of data while it moves across networks, typically with TLS, preventing interception or tampering between client, server, and internal service boundaries.

The disciplined generation, storage, rotation, use, and retirement of cryptographic keys, often through a dedicated service or hardware module with strict access controls.

Replacing real values with realistic but altered values so that non-production environments or lower-privileged users see data without sensitive content.

Substituting a sensitive value with a non-sensitive token that maps back to the original only through a protected vault, reducing the systems that must hold sensitive data.

The mechanisms that decide whether an authenticated subject may perform a given action on a given resource, enforced through policies, roles, or attributes.

The practice of granting each user, service, or process only the permissions needed for its current task, and no more, for the shortest practical duration.

An access model where permissions are bundled into roles and users receive access by being assigned roles, simplifying administration and review of entitlements.

Access that can change systems, data, or security settings, such as administrator or root accounts, which requires stronger authentication, logging, and session oversight.

A periodic, documented recertification in which managers or owners confirm that each user's existing entitlements are still required and remove those that are not.

An event that actually or potentially compromises confidentiality, integrity, or availability of data or systems, triggering a defined response process and possible notification duties.

A documented set of roles, phases, and procedures for preparing for, detecting, containing, eradicating, and recovering from security incidents, including communication and lessons learned.

A platform that centralizes logs from many sources, correlates events, and raises alerts, giving analysts a single view for detecting and investigating suspicious activity.

The legal or contractual duty to inform regulators and affected individuals within set deadlines after a confirmed data breach, usually requiring documented risk assessment.

Any information relating to an identified or identifiable individual, including identifiers, contact details, and data that can be linked back to a person.

The entitlements individuals have over their personal data, such as access, correction, deletion, restriction, and portability, which organizations must be able to fulfill.

A freely given, specific, informed, and unambiguous indication of agreement to processing, which must be recorded and can be withdrawn by the individual.

The rule that personal data collected for one stated purpose may not be reused for an incompatible purpose without a lawful basis or fresh consent.

A structured register describing each processing operation, its purposes, data categories, recipients, retention periods, and safeguards, often required as evidence of compliance.

A testable condition that data must satisfy, such as completeness, uniqueness, valid range, or referential integrity, used to measure and monitor fitness for purpose.

The measurable aspects used to judge data fitness, typically accuracy, completeness, consistency, timeliness, uniqueness, and validity, each assessed with defined rules.

The analysis of a data set's structure and values, such as null rates, distinct counts, and patterns, to reveal quality problems and inform rule design.

The assurance that data remains accurate, complete, and unaltered across storage, transfer, and processing, supported by validation, checksums, and controlled change.