ICDL Data Protection (ICDL) key terms

Any information relating to an identified or identifiable living person. This includes names, identification numbers, location data, and factors specific to a person's physical, economic, cultural, or social identity.

The living individual whom personal data is about. This person holds enforceable rights over how their information is gathered, used, stored, and shared by organisations.

Any operation performed on personal data, whether automated or manual. Examples include collecting, recording, organising, storing, adapting, retrieving, consulting, disclosing, erasing, or destroying information.

The organisation or entity that decides why and how personal data is processed. It bears primary legal responsibility for complying with data protection rules and answering to individuals and regulators.

A separate organisation or person that handles personal data on behalf of a controller, following the controller's documented instructions. A processor must not use the data for its own purposes.

The set of laws, principles, and practices that safeguard individuals' personal information from misuse, unauthorised access, and unfair handling while still allowing legitimate use of data.

A broader concept covering a person's freedom from unwanted intrusion and control over information about themselves. Data protection is one legal mechanism that helps protect privacy.

Sensitive personal information needing extra protection. It covers racial or ethnic origin, political opinions, religious beliefs, health, sex life, sexual orientation, genetic data, biometric data used for identification, and trade union membership.

A legal justification required before processing personal data. Common bases include consent, contract performance, legal obligation, vital interests, public task, and legitimate interests.

A clear, affirmative agreement by a data subject to processing, given freely after being properly informed. It must be specific, unambiguous, and as easy to withdraw as to give.

A stronger form of agreement, given through a clear statement or positive action, required for processing special category data. It must be specific and leave no room for doubt.

A lawful basis allowing processing that serves a genuine business or organisational need, provided the individual's rights and expectations are not overridden. It requires a documented balancing assessment.

A core principle requiring data to be collected for specified, explicit, and legitimate purposes and not reused for incompatible new purposes without a fresh legal basis.

A principle requiring that only personal data which is adequate, relevant, and necessary for the stated purpose is collected and kept. It limits over-collection and reduces harm from breaches.

The principle that personal data should be kept in identifiable form only for as long as needed for its purpose. It requires defined retention periods and secure deletion afterwards.

A principle requiring that personal data is correct and, where necessary, kept up to date. Inaccurate data must be corrected or erased without undue delay.

The obligation on controllers to demonstrate compliance with data protection principles, not merely claim it. It involves policies, records, training, and documented decisions that can be shown to a regulator.

An approach where privacy protections are built into systems, products, and processes from the outset rather than added afterwards. It includes minimising data collection and setting secure defaults.

A requirement that, without any action by the user, the most privacy-protective settings apply. Only data necessary for each specific purpose should be processed by default.

A structured review carried out before risky processing, such as large-scale monitoring or sensitive data handling. It identifies risks to individuals and the measures needed to reduce them.

An internal register listing what personal data an organisation holds, why, where it came from, who it is shared with, and how long it is kept. It supports accountability and regulatory scrutiny.

A contract between a controller and a processor setting out the processor's obligations, including confidentiality, security, sub-processor rules, and return or deletion of data at the end.

A third party engaged by a processor to carry out part of the processing. The controller must authorise such arrangements and the same protective obligations must flow down to them.

Disclosing personal data to another organisation or party. It requires a lawful basis, transparency to the individual, and appropriate safeguards such as contracts or agreed protocols.

Sending personal data outside its originating legal jurisdiction. It is permitted only where safeguards exist, such as an adequacy decision, standard contractual clauses, or explicit consent.

A formal ruling by an authority that another country or territory provides an essentially equivalent level of data protection, allowing personal data to be sent there without extra safeguards.

Irreversibly removing identifying features so that a person can no longer be identified by any means reasonably likely to be used. Anonymised data falls outside data protection law.

Replacing identifying details with codes so data can no longer be attributed to a person without separate additional information kept securely apart. The data remains personal data and stays in scope.

The defined length of time personal data is kept before deletion or anonymisation. It should be justified by the purpose or a legal requirement and documented in a retention schedule.

The technical and organisational measures used to protect personal data against accidental loss, destruction, alteration, or unauthorised access and disclosure. Measures must suit the risk involved.

The security property ensuring information is accessible only to those authorised to see it. It is protected through access controls, encryption, and staff confidentiality obligations.

The security property ensuring data is accurate, complete, and protected from unauthorised alteration or corruption. It is supported by checksums, version control, and restricted write permissions.

The security property ensuring data and systems are accessible to authorised users when needed. It is maintained through backups, redundancy, and resilience planning against outages or attacks.

The rules and mechanisms deciding who may view or use which data. It relies on role-based permissions, authentication, and the principle of least privilege to limit exposure.

The practice of giving each user or system only the minimum access needed to perform their role. It limits the damage a compromised account or careless insider can cause.

Converting readable data into a coded form that can only be read with the correct key. It protects data at rest and in transit if a device is lost or a network is intercepted.

Technology-based safeguards such as encryption, firewalls, access controls, logging, and backup systems that protect personal data. They complement organisational measures like policies and training.

Non-technical safeguards including written policies, staff training, confidentiality agreements, defined roles, and physical security procedures that support protection of personal data alongside technical controls.

A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It can be caused by attack, error, or accident.

The duty to report certain personal data breaches to the supervisory authority, usually within 72 hours of becoming aware, and to inform affected individuals where there is high risk.

An independent public body that supervises compliance with data protection law. It can investigate, issue fines, order processing to stop, and receive breach notifications and complaints.

A data subject's right to obtain confirmation of whether their data is processed and to receive a copy plus information about purposes, recipients, and retention. Usually answered within one month.

A request from an individual asking an organisation to confirm and provide the personal data it holds about them. Organisations must verify identity and respond within legal time limits.

A data subject's right to have inaccurate personal data corrected and incomplete data completed without undue delay. Organisations must notify recipients where corrections are made.

A data subject's right to have personal data deleted in specified circumstances, such as when it is no longer needed or consent is withdrawn. It is not absolute and can be overridden by legal obligations.

The data subject's ability to reverse a previously given consent at any time. Withdrawal must be as easy as giving consent and does not affect processing already carried out lawfully.

A data subject's right to oppose processing based on legitimate interests or public task, and to object absolutely to direct marketing. The organisation must stop unless it shows compelling grounds.

A data subject's right to limit how their data is used, for example while accuracy is checked or an objection is assessed. The data may be stored but not otherwise actively processed.

A data subject's right to receive their data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where processing is based on consent or contract.

The principle that individuals must be told clearly, concisely, and in plain language how their data is used, why, for how long, and with whom it is shared, usually through a privacy notice.

A statement giving individuals required information about processing at the point data is collected, including identity of the controller, purposes, lawful basis, retention, and rights.

A formal claim submitted by an individual to a supervisory authority alleging that processing of their personal data infringes the law. Authorities must inform the complainant of progress and outcome.

The right of a data subject to a fair hearing and compensation for material or non-material damage caused by unlawful processing, enforceable through the courts against a controller or processor.