EXIN PDPF key terms

Any information relating to an identified or identifiable natural person, recorded electronically or otherwise. Identification can occur directly from the data or indirectly by combining it with other available information.

The natural person to whom a piece of personal information relates. Under the law this individual holds rights such as access, correction, and deletion, and organizations owe duties directly to them.

An organization or individual that independently decides why and how personal information is processed. This role carries the core legal obligations, including lawful basis, notice, security, and responding to data subject requests.

A relationship where one party handles personal information on behalf of and under the instructions of another. The handler may not use the data for its own purposes and must return or delete it when the engagement ends.

Categories of data whose misuse can easily harm dignity or personal safety, such as biometric, religious, health, financial account, location tracking, and minors' data. It attracts stricter consent and impact assessment duties.

A voluntary, specific, informed, and unambiguous expression of will by the data subject permitting processing of their information. It must be obtained freely, without bundling, and can be withdrawn at any time.

A heightened consent standard requiring a distinct, standalone affirmative action for sensitive data, sharing with third parties, public disclosure, or other high-risk uses. It cannot be buried in general terms and conditions.

The data subject's right to revoke previously given permission at any time. Withdrawal stops future processing but does not invalidate processing already lawfully carried out, and must be as easy as giving consent.

The duty to tell data subjects, before or at collection, the processor's identity, purposes, methods, categories of data, retention period, and how rights can be exercised. Notice must be clear, prominent, and in plain language.

A public document describing how an organization collects, uses, shares, stores, and protects personal information, and how individuals can exercise their rights. It should match actual practices and be easily accessible.

The legal ground that justifies processing, such as consent, contract necessity, legal obligation, public interest, or vital interests. Every processing activity needs at least one basis, and the chosen basis shapes the applicable duties.

A lawful basis allowing processing that is indispensable to conclude or perform a contract to which the data subject is a party. It cannot be stretched to cover unrelated marketing or optional features.

A lawful basis where processing serves a genuine, specific business or societal need that is not overridden by the individual's rights and expectations. It requires a documented balancing test and appropriate safeguards.

The principle that personal information must be collected for a clear, specific, and legitimate purpose and not further processed in ways incompatible with that original purpose without a new lawful basis.

The principle that only personal information adequate, relevant, and necessary for the stated purpose may be collected and retained. Collecting extra data 'just in case' violates this principle.

The rule that personal information should be kept only as long as needed for its purpose or as required by law. Retention periods must be defined, documented, and enforced through deletion or anonymization.

The defined length of time an organization keeps a category of personal information before deleting or anonymizing it. It should be justified by purpose or legal requirement and stated in the privacy notice.

Irreversibly transforming personal information so that it can no longer identify any individual, even when combined with other data. Properly anonymized data falls outside the scope of personal information law.

Reducing the link between data and individuals through masking, pseudonyms, or generalization while retaining re-identification potential. De-identified data generally remains personal information and stays within legal scope.

Replacing direct identifiers with codes so data can still be linked to a person via separately held keys. It reduces exposure but does not anonymize, so the data remains subject to protection obligations.

The likelihood that a person can be singled out from data, directly or by combining it with other reasonably available information. It determines whether information counts as personal information in a given context.

Providing personal information to an external party that will process it for its own purposes. It requires a separate lawful basis, specific notice of the recipient and purpose, and often separate consent.

A situation where two or more organizations jointly determine the purposes and means of processing. They must agree on responsibilities and inform data subjects who to contact to exercise rights.

Sending personal information to a recipient outside the jurisdiction. It requires a permitted mechanism such as a security assessment, certification, or standard contractual clauses, plus notice and separate consent where required.

A requirement that certain personal information, often for critical infrastructure operators or above volume thresholds, be stored within the country. Cross-border movement of such data needs a security assessment before it can occur.

Decisions about individuals produced solely by algorithms without human involvement, such as profiling for pricing or credit. It triggers transparency duties and a right to request explanation or refuse decisions with significant impact.

Automated use of personal information to evaluate personal aspects such as performance, health, preferences, or behavior. It raises risks of bias and unfair outcomes and requires transparency and, in some cases, impact assessment.

A documented pre-assessment required before high-risk processing, such as handling sensitive data, automated decision-making, entrusting data, or cross-border transfer. It records purpose, necessity, impact on rights, and safeguards, and is retained for at least three years.

A designated person responsible for overseeing compliance, advising on impact assessments, handling complaints, and liaising with regulators. Certain organizations, including large-scale processors, must appoint one and publish their contact details.

The set of entitlements individuals hold over their data, including access, copy, correction, deletion, withdrawal of consent, explanation of automated decisions, and complaint. Requests must be handled within a defined period.

The data subject's entitlement to know whether their information is being processed and to obtain a copy of it, along with information about purposes, categories, and recipients. Requests should be answered promptly and free of charge.

The entitlement to have personal information deleted when the purpose is fulfilled, consent is withdrawn, processing was unlawful, or the contract ends. Exceptions apply where retention is legally required.

Any event involving leakage, loss, theft, or unauthorized access to personal information. The processor must take immediate remedial action and notify regulators and affected individuals where harm is likely.

The duty to report a personal information security incident to the supervisory authority and, where individuals' rights are affected, to those individuals. Notification must be timely, factual, and include remediation and mitigation advice.

Controls such as encryption, access control, logging, and pseudonymization applied to protect personal information. They must be appropriate to the risk and reviewed as technology and threats change.

Non-technical controls including policies, role assignment, staff training, confidentiality agreements, access approval workflows, and internal audits. They complement technical safeguards and are assessed alongside them.

The principle that an organization must be able to demonstrate compliance, not merely claim it. It requires documented policies, records of processing, impact assessments, training evidence, and audit trails.