ICDL Data Protection (ICDL) flashcards
ICDL Data Protection · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Personal data
- Any information relating to an identified or identifiable natural person, including identifiers such as names, ID numbers, location data, or online identifiers.
- Data controller
- The entity that determines the purposes and means of processing personal data and bears primary responsibility for compliance with data protection obligations.
- Data processor
- An entity that processes personal data on behalf of and under the instructions of a controller, usually bound by a written processing contract.
- Processing
- Any operation performed on personal data, automated or not, such as collection, storage, retrieval, use, disclosure, transmission, or erasure.
- Purpose limitation
- A principle requiring personal data to be collected for specified, explicit and legitimate purposes and not further processed incompatibly with those purposes.
- Data minimisation
- A principle requiring personal data to be adequate, relevant and limited to what is necessary for the purposes of processing.
- Special category data
- Sensitive personal data such as health, genetic, biometric, racial or ethnic origin, political opinions, religious beliefs, trade union membership, or sex life data.
- Valid consent
- Freely given, specific, informed and unambiguous agreement to processing, expressed by a statement or clear affirmative action rather than silence or pre-ticked boxes.
- Pseudonymisation
- Replacing identifying attributes with artificial identifiers so data cannot be attributed to a person without separately held additional information; data remains personal data.
- Lawful basis
- One of the permitted grounds for processing, such as consent, contract, legal obligation, vital interests, public task, or legitimate interests.
- Privacy by design
- Embedding data protection measures into the design of processing systems and business processes at the time the means of processing are determined.
- Data protection impact assessment
- A structured assessment required where processing is likely to produce high risk to individuals, identifying risks and mitigating measures before processing starts.
- Record of processing activities
- A register listing processing purposes, categories of data and data subjects, recipients, cross-border transfers, retention periods, and security measures.
- Processor contract
- A written agreement specifying subject matter, duration, nature and purpose of processing, data types, data subject categories, and each party's obligations.
- Storage limitation
- A principle requiring personal data to be kept in identifiable form no longer than necessary, with defined retention periods and deletion or anonymisation afterwards.
- Anonymisation
- Irreversibly removing identifiability so the data no longer relates to an identifiable person and falls outside the scope of data protection law.
- Cross-border transfer mechanism
- A legal tool enabling transfer of personal data abroad, such as an adequacy decision, standard contractual clauses, or binding corporate rules.
- Personal data breach
- A security incident causing accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
- 72-hour notification
- The requirement to notify the supervisory authority of a reportable breach without undue delay and, where feasible, within 72 hours of awareness.
- Breach notification to individuals
- A communication to affected data subjects, without undue delay, required when a breach is likely to result in a high risk to their rights and freedoms.
- Breach register
- A record of all personal data breaches documenting the facts, effects, and remedial action taken, including breaches not notified to authorities.
- CIA triad
- A security model covering confidentiality (no unauthorised disclosure), integrity (no unauthorised alteration), and availability (timely access to data).
- Processor breach duty
- The obligation of a processor to notify the controller without undue delay after becoming aware of a personal data breach.
- Encryption as safeguard
- A technical measure rendering data unreadable without a key, often reducing breach risk and potentially removing the need to notify affected individuals.
- Right of access
- A data subject's right to obtain confirmation of processing and a copy of their personal data plus information about purposes, recipients, and retention.
- Right to rectification
- The right to have inaccurate personal data corrected and incomplete personal data completed without undue delay.
- Right to erasure
- The right to have personal data deleted on specified grounds such as no longer being necessary or unlawful processing; it is not absolute.
- Right to data portability
- The right to receive data provided by the individual in a structured, commonly used, machine-readable format and transmit it to another controller, for consent or contract-based automated processing.
- Right to object
- The right to object to processing based on legitimate interests or public task; for direct marketing the objection is absolute and processing must stop.
- Right to restriction
- The right to limit a controller to storing data only while accuracy, lawfulness, or the controller's legitimate grounds are being verified.
- One-month response deadline
- The general period for answering a data subject request, extendable by up to two further months for complex or numerous requests with notice to the individual.
- Automated decision-making right
- The right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, subject to exceptions.