CPPA key terms

Any information relating to an identified or identifiable natural person, including identifiers such as name, location data, or an online identifier that can single out an individual directly or indirectly.

The natural person to whom personal data relates. This individual holds the rights granted by applicable privacy law, such as access, correction, deletion, and objection, and must be informed about processing.

The entity that alone or jointly with others determines the purposes and means of processing personal data. The controller bears primary legal responsibility for compliance and for answering data subject requests.

An entity that processes personal data on behalf of and under the documented instructions of a controller. Processors have limited direct obligations, typically including security, confidentiality, and assisting the controller.

A category of data warranting heightened protection because misuse could cause serious harm, such as health, biometric, genetic, racial or ethnic origin, religious belief, sexual orientation, or criminal record information.

Any operation performed on personal data, whether automated or manual, including collection, recording, organization, storage, alteration, retrieval, consultation, use, disclosure, transmission, and erasure or destruction.

A legal ground that must exist before processing personal data, such as consent, contract performance, legal obligation, vital interests, public task, or legitimate interests. Without one, processing is unlawful.

A freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they agree to processing, expressed through a clear affirmative action that can be withdrawn at any time.

A heightened form of consent, usually expressed in a clear statement or affirmative action, required for certain sensitive processing. It demands greater specificity and clarity than ordinary consent.

The data subject's right to revoke previously given consent at any time. Withdrawal must be as easy as giving consent and does not affect the lawfulness of prior processing.

The set of entitlements individuals hold over their personal data, commonly including access, rectification, erasure, restriction, portability, and objection, which organizations must facilitate within statutory deadlines.

A request from an individual to confirm whether their personal data is being processed and to obtain a copy plus related information such as purposes, recipients, and retention periods.

Also called the right to be forgotten, it lets individuals request deletion of personal data when it is no longer necessary, consent is withdrawn, or processing is unlawful, subject to legal exceptions.

The right to receive personal data in a structured, commonly used, machine-readable format and to transmit it to another controller, supporting competition and individual control.

A principle requiring that personal data be collected for specified, explicit, and legitimate purposes and not further processed in ways incompatible with those original purposes.

The principle that personal data collected and processed should be adequate, relevant, and limited to what is necessary for the stated purpose, reducing risk and compliance burden.

A principle requiring that identifiable personal data be kept no longer than necessary for the purposes of processing, with defined retention periods and deletion or anonymization afterwards.

The defined length of time personal data is kept before deletion or anonymization, set by legal requirements, business need, or the purpose of processing and documented in a retention schedule.

The principle that an organization must be able to demonstrate compliance with privacy obligations, through policies, records, assessments, training, and evidence of controls, not merely claim adherence.

An approach embedding privacy protections into systems, processes, and products from the outset, including default settings that limit data collection and sharing without user action.

The requirement that, without user intervention, the most privacy-protective settings apply, so only necessary personal data is processed and shared by default.

A structured risk assessment required before processing likely to result in high risk, such as large-scale profiling or sensitive data handling, documenting risks and mitigating measures.

An inventory documenting what personal data an organization processes, why, where, who receives it, and how long it is kept, supporting accountability and regulatory inquiries.

The practice of tracing personal data flows across systems, teams, and third parties to build an accurate picture of collection, storage, sharing, and transfer, forming the basis for many compliance activities.

An independent role responsible for monitoring privacy compliance, advising on obligations, and acting as a contact point for regulators and data subjects. Required in some jurisdictions under specified conditions.

An independent public body that monitors and enforces compliance with privacy law, with powers to investigate, impose fines, and order processing to stop, and to cooperate across borders.

The European Union's comprehensive privacy law governing processing of personal data, granting data subject rights, imposing accountability duties, and levying significant fines for violations.

A determination by a regulator that a third country provides an essentially equivalent level of data protection, allowing personal data to flow there without additional safeguards.

Pre-approved contract terms used to legitimize transfers of personal data to countries lacking an adequacy decision, imposing data protection obligations on the importer.

An approved internal framework enabling multinational organizations to transfer personal data among their entities under consistent, binding privacy safeguards, subject to regulatory approval.

The movement of personal data from one jurisdiction to another, which typically requires a legal mechanism such as adequacy, contractual clauses, or explicit consent.

A contract between controller and processor setting out processing instructions, security measures, confidentiality, sub-processor rules, and assistance duties, required by many privacy laws.

A third party engaged by a processor to carry out part of the processing. The processor must obtain controller authorization and impose equivalent data protection obligations downstream.

A situation where two or more entities jointly determine the purposes and means of processing, sharing responsibility for compliance and typically requiring an arrangement allocating duties.

Replacing identifying attributes with codes so data can no longer be attributed to an individual without additional separately held information, reducing risk while data remains personal data.

Irreversibly transforming personal data so that the individual can no longer be identified by any means reasonably likely to be used, removing it from the scope of privacy law.

A security control converting data into unreadable form unless decrypted with a key, protecting confidentiality in transit and at rest and often supporting breach notification defenses.

An event that compromises or threatens the confidentiality, integrity, or availability of information systems or data, whether accidental or malicious, triggering investigation and response procedures.

A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data, which may require notification to regulators or individuals.

The legal duty to inform regulators, and sometimes affected individuals, about a personal data breach within defined timeframes when it poses a risk to rights and freedoms.

A documented set of roles, steps, and communication procedures for detecting, containing, assessing, and remediating security incidents, including breach notification decision points and post-incident review.

A lawful basis allowing processing that serves a genuine business or third-party interest, balanced against the individual's rights and expectations, often requiring a documented balancing test.

A public statement explaining what personal data is collected, why, how long it is kept, who it is shared with, and how individuals can exercise their rights.

The principle that organizations communicate clearly and openly about data practices, enabling individuals to understand and make informed choices about how their information is used.

The process of assessing, contracting with, and monitoring third parties that handle personal data, ensuring appropriate safeguards, security, and compliance obligations are in place throughout the relationship.

A structured evaluation of the likelihood and severity of harm to individuals from processing, used to prioritize controls, determine whether a formal impact assessment is required, and guide mitigation.

The coordinated set of policies, roles, processes, training, and monitoring activities an organization uses to meet privacy obligations and demonstrate accountability over time.

A term used in some laws for sensitive data types such as health, biometric, genetic, political opinions, or religious beliefs, whose processing is generally prohibited unless a specific exception applies.