CIPP/E key terms

The body of legal rules governing how information about individuals may be collected, used, shared, stored and deleted, together with the rights those individuals can assert over that information. It is narrower than privacy, which is a broader concept covering many aspects of private life.

A Council of Europe treaty opened for signature in 1981 and the first binding international instrument on data protection. It sets out principles for automated processing of personal data and guarantees rights for individuals; it was modernised as Convention 108+.

The EU's catalogue of fundamental rights, given binding legal effect by the Lisbon Treaty in 2009. Article 7 protects private and family life, while Article 8 separately protects personal data and requires fair processing, a lawful basis, access and rectification.

Non-binding recommendations adopted in 1980 that set out basic privacy principles such as collection limitation, purpose specification, use limitation, security safeguards, openness and accountability. They strongly influenced later national and regional data protection laws.

The 1995 EU Data Protection Directive, which harmonised national laws and introduced concepts such as controller, data subject and adequacy that were later carried into the GDPR. It was repealed when the GDPR became applicable in 2018.

Any information relating to an identified or identifiable natural person. Identifiability may be direct, through a name or number, or indirect, through identifiers such as location data, online identifiers or factors specific to a person's identity.

The natural person to whom personal data relates. The concept covers living individuals only; companies, public bodies and deceased persons are not data subjects, though some national laws extend protection to the deceased.

Any operation or set of operations performed on personal data, whether or not by automated means. It includes collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transfer, erasure and destruction.

The natural or legal person, public authority, agency or other body that alone or jointly with others determines the purposes and means of processing personal data. The controller bears the main legal responsibility toward data subjects and supervisory authorities.

A person or organisation that processes personal data on behalf of, and on the documented instructions of, a controller. A processor must be bound by a written contract and may not use the data for its own purposes.

Two or more controllers that jointly determine the purposes and means of a processing operation. They must agree how responsibilities are allocated, but a data subject may still exercise rights against each of them.

Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data concerning sex life or sexual orientation. Processing is generally prohibited unless a specific exception applies.

Processing personal data so that it can no longer be attributed to a specific person without additional information kept separately and protected by technical and organisational measures. It reduces risk but the data remains personal data.

Irreversibly removing identifiability so that the information no longer relates to an identified or identifiable person and falls outside data protection law. Whether it works depends on re-identification risk assessed against all means reasonably likely to be used.

One of six grounds that must support each processing purpose: consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a public task, or legitimate interests. The ground must be identified and documented.

A freely given, specific, informed and unambiguous indication of the individual's wishes, given by a statement or clear affirmative action. It can be withdrawn at any time and withdrawing must be as easy as giving it.

A lawful basis assessed through a three-part test: the controller or a third party pursues a legitimate interest, the processing is necessary for it, and that interest is not overridden by the individual's interests, rights or freedoms.

Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Compatibility is judged by links between purposes, context, data nature and safeguards applied.

Personal data must be adequate, relevant and limited to what is necessary for the purposes for which it is processed. In practice this requires deciding what is truly needed and periodically reviewing retained data.

The obligation of a controller to be able to demonstrate that its processing complies with data protection principles. It is met through measures such as policies, records, assessments, training, contracts and evidence of decisions taken.

A documented assessment required before processing likely to result in a high risk to individuals. It describes the processing, assesses necessity and risks, identifies mitigation measures, and where residual risk stays high requires consultation with the supervisory authority.

A designated contact with expert knowledge of data protection law. Appointment is mandatory for public bodies and for organisations carrying out large-scale monitoring or large-scale processing of sensitive data; the DPO monitors compliance, advises and cooperates with the supervisory authority.

The individual's right to obtain confirmation of whether their data is processed, a copy of that data, and information about purposes, categories of data, recipients, retention, rights and any automated decision-making. The first copy is normally free of charge.

Also called the right to be forgotten: the right to have personal data deleted where it is no longer needed, consent has been withdrawn, an objection has succeeded, processing was unlawful, or a legal obligation requires deletion, subject to exceptions such as legal claims.

The right to receive data supplied by the individual in a structured, commonly used and machine-readable format and to have it transmitted to another controller, where processing is based on consent or contract and is carried out by automated means.

A decision about a person based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them. It is generally restricted unless necessary, authorised by law or based on explicit consent, and safeguards such as human intervention apply.

An independent public body established in each EU member state to monitor and enforce data protection law. It handles complaints, conducts investigations, issues guidance, approves codes and certification, and can impose corrective measures and fines.

The arrangement under which a controller or processor engaged in cross-border processing deals with a single lead supervisory authority, generally that of the member state where its main establishment is located, while other authorities act as concerned authorities.

A monetary penalty imposed by a supervisory authority. There are two tiers: up to EUR 10 million or 2% of worldwide annual turnover, and up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher in each case.

Sending personal data, or making it accessible, to a controller, processor or other recipient located in a third country or international organisation. Such transfers must satisfy additional conditions beyond ordinary domestic compliance.

A decision by the European Commission concluding that a third country, territory, specified sector or international organisation ensures an adequate level of protection for personal data, so transfers may take place without further safeguards being added.

Pre-approved model contract terms adopted by the European Commission or a supervisory authority that impose data protection obligations on exporter and importer. Since the Schrems II judgment they normally require an assessment of the destination country's law.

Internal data protection rules approved by a competent supervisory authority that allow transfers within a corporate group to entities in third countries. They must be legally binding, grant enforceable third-party beneficiary rights and meet specified content requirements.

Narrow exceptions permitting a transfer without an adequacy decision or appropriate safeguards, for example explicit consent, necessity for a contract with the individual, important reasons of public interest or legal claims. They must be occasional rather than routine.

An analysis of the laws and practices of a destination country, and of any supplementary measures, to judge whether imported data will receive protection essentially equivalent to that in the EU. The assessment should be documented and kept under review.

A 2023 European Commission adequacy decision covering US organisations that self-certify to a set of privacy commitments, replacing the invalidated Privacy Shield. It includes redress channels and limitations on US intelligence access.

A transfer by a data importer to another party, often in a further third country. It must be permitted by the mechanism used for the original transfer, typically by requiring the importer to impose equivalent safeguards on the new recipient.