C CLE key terms

Information relating to an identified or identifiable natural person, including identifiers such as name, ID number, location data, or online identifiers that can single out an individual directly or indirectly.

The entity that determines the purposes and means of processing personal data. Controllers carry primary legal responsibility for lawful processing, notices, and responding to data subject requests.

A party that processes personal data on behalf of and under the instructions of a controller, typically bound by a written contract that restricts use and imposes security and confidentiality obligations.

Legal entitlements of individuals over their personal data, commonly including access, correction, deletion, restriction, portability, and objection, which organizations must honor within statutory timeframes.

A data subject's right to have personal data deleted without undue delay where specified grounds apply, such as withdrawal of consent or unlawful processing, subject to legal retention exceptions.

The obligation to demonstrate, not merely claim, compliance with data protection law through documented policies, records of processing, training, and audit evidence that can be shown to regulators.

A legally recognized justification for handling personal data, such as consent, contract performance, legal obligation, vital interests, public task, or legitimate interests, which must be identified before processing begins.

A freely given, specific, informed, and unambiguous indication of a person's wishes by which they agree to processing of their personal data, revocable at any time and documented by the controller.

A structured risk evaluation required before processing that is likely to result in high risk to individuals, documenting necessity, proportionality, safeguards, and residual risks for review and approval.

An approach that embeds privacy protections into systems, processes, and products from the outset rather than adding them afterward, including data minimization and default privacy-protective settings.

The principle that only personal data adequate, relevant, and necessary for a stated purpose should be collected and retained, reducing exposure in the event of a breach.

Movement of personal data to another jurisdiction, permitted only where a legal transfer mechanism exists, such as adequacy decisions, standard contractual clauses, or binding corporate rules.

Pre-approved contractual terms used to legitimize transfers of personal data to jurisdictions lacking an adequacy determination, imposing data protection obligations on the receiving party.

A regulatory finding that a destination country or territory provides an essentially equivalent level of personal data protection, allowing transfers without additional safeguards.

Maintained documentation describing categories of data, purposes, recipients, retention periods, and security measures for processing activities, often required to demonstrate accountability to regulators.

A documented schedule specifying how long each category of data is kept and how it is destroyed, balancing legal retention duties against minimization and breach exposure.

A directive suspending routine destruction of potentially relevant records once litigation, investigation, or a regulatory matter is reasonably anticipated, to prevent spoliation.

The collection of statutes, rules, and guidance issued by authorities that govern an organization's security and privacy obligations, including sector-specific and general data protection regimes.

An independent public body empowered to enforce data protection law, investigate complaints, impose corrective measures, and levy administrative fines on controllers and processors.

A monetary penalty imposed by a regulator for legal violations, often calculated using factors such as intent, negligence, mitigation efforts, and the number of affected individuals.

An organization's structured set of policies, controls, training, monitoring, and governance designed to meet legal obligations and evidence good-faith efforts to regulators and auditors.

Rules targeting particular industries, such as finance, healthcare, or telecommunications, that impose security, reporting, or privacy duties beyond general data protection law.

A contract governing a processor's handling of personal data, specifying permitted purposes, security measures, sub-processor conditions, breach notification duties, and deletion or return obligations.

The process of assessing, contracting with, and monitoring vendors and service providers to ensure their security and privacy practices protect data the organization shares with them.

A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data, which may trigger notification obligations.

The legal duty to inform regulators and, where risk is high, affected individuals about a data breach within prescribed timeframes, describing the nature, consequences, and remedial measures.

The risk or harm standard that determines whether a breach must be reported, often framed as a likelihood of risk to rights and freedoms or a risk of harm to individuals.

A documented evaluation of the likely adverse effects of a breach on individuals, considering data sensitivity, identifiability, volume, and potential for fraud or discrimination.

A pre-approved playbook defining roles, escalation paths, communication channels, and technical steps for detecting, containing, eradicating, and recovering from security incidents.

A designated group with defined responsibilities, including security, legal, communications, and executive representatives, that coordinates the organization's response to a suspected or confirmed incident.

The fixed period, often measured in hours or days from awareness, within which a breach must be reported to an authority, with delays permitted only under stated conditions.

Criminal conduct involving computers, networks, or data, including unauthorized access, interference with systems, fraud, and offenses related to the misuse of devices or credentials.

Intentionally entering or using a computer system, network, or data without permission or exceeding granted authority, a core element of many computer misuse offenses.

A statutory crime penalizing unauthorized access, unauthorized modification or impairment of data, and sometimes possession of tools or credentials intended for such activity.

Information stored or transmitted in binary form that may be relied upon in legal proceedings, such as logs, files, messages, and metadata, requiring authenticated and reliable handling.

A documented chronological record of who handled evidence, when, and for what purpose, used to demonstrate integrity and admissibility from seizure through analysis and presentation.

Creating a bit-for-bit copy of a storage device or system for analysis, preserving the original while enabling verification that the copy is an exact duplicate.

A fixed-length digital fingerprint computed from data; comparing hashes before and after copying or analysis helps verify that evidence has not been altered.

The loss, destruction, or alteration of evidence relevant to anticipated or ongoing legal proceedings, which can lead to sanctions, adverse inferences, or separate liability.

An internal inquiry conducted under the direction of legal counsel to preserve attorney-client privilege and work-product protection over findings and communications, subject to waiver risks.