CPPA flashcards
CPPA · Build recall with a focused review session.
33 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Personal data definition
- Any information relating to an identified or identifiable natural person; identifiability may be direct or indirect through identifiers such as names, location data, or online identifiers.
- Data subject
- The natural person whose personal data is being processed; the individual to whom data protection rights attach under GDPR and similar laws.
- Controller vs processor
- Controller determines purposes and means of processing; processor acts on the controller's documented instructions. The controller bears primary accountability for compliance.
- Pseudonymisation
- Processing that makes data no longer attributable to a specific person without additional information kept separately; data remains personal and GDPR still applies.
- Personal data breach
- A security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
- GDPR territorial scope
- Applies where an EU controller or processor is involved, or where an organisation outside the EU offers goods/services to, or monitors the behaviour of, EU data subjects.
- CCPA revenue threshold
- A for-profit business qualifies if gross revenue exceeds the CPI-adjusted threshold ($26,625,000 from 1 January 2025), or meets data-volume or revenue-share tests.
- PIPL
- China's Personal Information Protection Law; requires separate consent for sensitive data and cross-border transfers, and imposes DPO duties on large processors.
- LGPD
- Brazil's General Data Protection Law; modelled on GDPR principles, enforced by the ANPD, with legal bases including consent, contract, and legitimate interest.
- PIPEDA
- Canada's federal private-sector privacy law applying to commercial activity; based on ten fair information principles including consent and accountability.
- APEC CBPR
- A voluntary cross-border privacy certification framework originally under APEC, now administered by the Global CBPR Forum for participating economies.
- Six lawful bases
- Consent, contract, legal obligation, vital interests, public task, and legitimate interests. Only one basis is needed per processing purpose.
- Legitimate interests test
- Three-part assessment: identify a legitimate interest, show processing is necessary, and balance against the data subject's rights and reasonable expectations.
- Purpose limitation
- Data must be collected for specified, explicit, legitimate purposes and not further processed incompatibly; compatible research and statistical use is permitted.
- DPIA trigger
- Required when processing is likely high risk: systematic monitoring, large-scale special category data, or innovative technology. Two or more WP248 criteria typically trigger it.
- Privacy by design
- Article 25 obligation to embed data protection into processing design and ensure only necessary data is processed by default.
- Right of access
- Article 15 right to obtain confirmation of processing, a copy of personal data, and information on purposes, recipients, retention, and rights.
- Right to erasure
- Article 17 right to have personal data deleted; does not apply where processing is necessary for legal obligation, legal claims, or freedom of expression.
- Right to portability
- Article 20 right to receive data provided by the subject in a structured, machine-readable format; applies only to automated processing based on consent or contract.
- Valid consent
- Freely given, specific, informed, unambiguous indication of wishes via clear affirmative action; silence, pre-ticked boxes, or inactivity are invalid.
- Consent withdrawal
- Withdrawal must be as easy as giving consent; it does not affect the lawfulness of processing carried out before withdrawal.
- DPO mandatory triggers
- Required for public authorities, large-scale systematic monitoring, or large-scale special category processing; the DPO reports to the highest management level.
- DPO conflict of interest
- The DPO cannot hold a role determining purposes or means of processing, such as head of marketing or IT operations, and receives no instructions on DPO tasks.
- Records of processing
- Article 30 documentation of purposes, data categories, recipients, transfers, retention periods, and security measures; required for most organisations above 250 employees.
- Accountability principle
- Article 5(2) requires the controller to demonstrate compliance through policies, records, DPIAs, training logs, and audit evidence.
- Article 32 measures
- Appropriate technical and organisational safeguards: encryption, pseudonymisation, resilience, restoration capability, and regular testing, weighed against state of the art and risk.
- Least privilege
- Access control principle granting users only the minimum access needed for their role; implemented via role-based access control and periodic access reviews.
- Processor security duty
- Article 28(3)(c) requires the processor to implement Article 32 safeguards and assist the controller with security and breach obligations.
- 72-hour notification
- Controllers must notify the supervisory authority within 72 hours of becoming aware of a breach likely to result in risk, unless risk is unlikely.
- Data subject breach notice
- Article 34 requires notification without undue delay when a breach is likely to result in high risk to rights and freedoms.
- Breach documentation duty
- Article 33(5) requires recording all breaches, including facts, effects, and remedial action, even when notification to the authority is not required.
- Standard contractual clauses
- EU-approved model clauses for international transfers; valid post-Schrems II but require a transfer impact assessment and supplementary measures where needed.
- Transfer impact assessment
- Analysis of third-country laws and practices affecting transferred data, and of supplementary measures needed to ensure essentially equivalent protection.