CIPT key terms

Any data element, or combination of elements, that can be linked to a specific individual - directly, such as a name, or indirectly, such as an account number plus a birth date.

The sequence of stages data passes through: collection, use, storage, sharing, archiving, and deletion. Each stage carries different privacy risks and calls for its own safeguards.

Data that describes other data, such as when a file was created, who opened it, or where a message was sent. Metadata can reveal behavior patterns even when the content is hidden.

A one-way calculation that turns any input into a fixed-length value and cannot be reversed. Short or guessable inputs stay vulnerable because an attacker can hash candidates until one matches.

A method where one shared secret key both encrypts and decrypts data. It is fast enough for large volumes, but every party holding that key can also read the data.

A method using two matched keys: a public key to encrypt and a private key to decrypt. It removes the need to share secrets in advance but is slower, so it often protects symmetric keys.

A small file a website asks a browser to store so it can remember state, such as a login session. Third-party cookies let other companies follow a person across many sites.

The numeric address a device uses on a network, identifying a connection and often a rough geographic area. Regulators frequently treat it as personal data because it can be tied to a subscriber.

Renting computing power, storage, or software over a network instead of owning it locally. The customer keeps the privacy obligations while the provider controls much of the technical environment.

A defined interface that lets one system request data or actions from another. It becomes a privacy risk when it returns more fields than needed or does not check who is calling.

A structured assessment of how a new project, system, or process will affect individuals' privacy, identifying risks and mitigations before work begins. It documents decisions and is often required for high-risk processing.

An access model that grants permissions by job function rather than per person, so staff reach only the data their role requires. It makes reviews and revocation easier as people change positions.

The rule that each user, process, and system gets only the access needed for its current task, nothing more. Narrow rights limit the damage caused by mistakes, malware, and stolen accounts.

A statement telling people what personal data is collected, why, how long it is kept, and who receives it. Effective notices are clear, layered, and shown at the moment data is collected.

A contract setting out how one organization may handle personal data on another's behalf, covering security duties, permitted uses, and what happens at termination. It governs vendor relationships.

Recording system events and reviewing them for signs of misuse, error, or attack. Logs support investigation and accountability, so they must themselves be protected and kept only as long as needed.

A documented rule stating how long each category of data is kept and how it is destroyed afterwards. It prevents indefinite accumulation, which widens exposure and complicates legal compliance.

A structured exercise asking what could go wrong, who might cause it, and what controls would stop it, usually done early in design. It turns vague worry into prioritized, testable requirements.

The total set of points where an attacker could try to enter or extract data, including interfaces, credentials, and connected devices. Shrinking it reduces the number of things that must be defended.

A deception that tricks someone into revealing credentials or clicking malicious content by impersonating a trusted party. It targets people rather than software, so training and multi-factor authentication are key defenses.

Malicious software that locks or steals data and demands payment to restore access. Beyond downtime, it becomes a reportable data breach when personal information is taken or exposed.

An attack that slips database commands into an input field so the application executes them. It can expose or alter whole tables, and is prevented by parameterized queries and input validation.

An attack that plants script inside a page viewed by others, letting the attacker act as the victim in their own browser. Output encoding and content security policies are typical defenses.

Risk from someone with legitimate access - an employee, contractor, or partner - who misuses it through malice, carelessness, or a compromised account. Typical controls include least privilege and behavior monitoring.

A security incident in which personal data is accessed, disclosed, altered, or lost without authorization. Breach rules usually require assessment, notification, and documented remediation within set timeframes.

An approach that builds privacy protections into systems, processes, and business practices from the start rather than adding them after launch. Privacy becomes a design requirement alongside function and security.

The practice of shipping products with the most privacy-protective settings already in place, so users must opt in to share more. Most people never change defaults, so the default is the real policy.

Collecting and keeping only the personal data actually needed for a stated purpose, and using it no further. Fewer fields mean smaller breach impact, simpler compliance, and less temptation to over-analyze.

Replacing direct identifiers with a key or code so data can be linked back only with extra information held separately. The data remains personal data but is safer to use for analysis and testing.

Irreversibly altering data so no individual can be identified by any means reasonably likely to be used. Done properly it takes data outside privacy law, so the standard is high and must be tested.

A property of a dataset where each combination of identifying attributes appears for at least k individuals, so no single record stands out. Larger k means stronger protection but usually more lost detail.

A mathematical guarantee that adding or removing one person's record changes query results only slightly. It lets analysts publish statistics while limiting what can be learned about any individual.

Swapping sensitive values for meaningless placeholders that map back to the real data through a secure vault. It reduces exposure in systems that only need a reference, not the original value.

A form of encryption that lets a system compute on data while it stays encrypted, decrypting only the result. It enables processing by untrusted parties but remains slow for many workloads.

The process of linking supposedly anonymous or de-identified records back to specific people, often by combining datasets or using outside information. It is why anonymization claims must be tested, not assumed.

Everyday devices with sensors and network connections - thermostats, watches, cameras - that collect and transmit data continuously. They often have weak security, limited consent interfaces, and long lifespans.

Software, cloud services, or devices adopted by staff without approval from technology or security teams. Such tools hold company and personal data outside known controls, so they escape inventories and assessments.

A policy allowing employees to use personal phones or laptops for work. It blends personal and business data on one device, raising questions about monitoring, remote wiping, and where data is stored.

Information about where a device or person is, or has been, derived from GPS, Wi-Fi, or cell signals. Precise trails can reveal home, work, health visits, and relationships, making them highly sensitive.