EXIN PDPP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Personal data

Any information relating to an identified or identifiable natural person. Identifiability may be direct, such as a name, or indirect, such as an IP address or device identifier combined with other data.

Special category data

Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, or data about sex life and sexual orientation.

Data minimisation

The principle that personal data must be adequate, relevant and limited to what is necessary for the purposes for which it is processed. It applies at collection and throughout the processing lifecycle.

Purpose limitation

Personal data may only be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Compatible further processing may be permitted.

Storage limitation

Personal data must be kept in a form that permits identification of data subjects for no longer than necessary for the purposes. Retention periods should be defined, documented and enforced.

Controller

The natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of processing personal data. It bears primary legal responsibility.

Processor

A natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller. It must act only on documented instructions and provide sufficient guarantees.

Pseudonymisation

Processing that makes data impossible to attribute to a data subject without additional information kept separately and protected by technical and organisational measures. Pseudonymised data remains personal data.

Valid consent

A freely given, specific, informed and unambiguous indication of the data subject's wishes, given by a statement or clear affirmative action, after receiving clear information about the processing.

GDPR territorial scope

The GDPR applies to controllers and processors established in the EU regardless of where processing occurs, and to non-EU entities offering goods or services to, or monitoring the behaviour of, EU data subjects.

Lawful bases Article 6

Six lawful bases exist: consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a public task, and legitimate interests. Only one is needed.

GDPR fine tiers

Two tiers apply: up to EUR 10 million or 2 percent of worldwide annual turnover, and up to EUR 20 million or 4 percent, whichever is higher in each case.

Standard Contractual Clauses

Pre-approved contractual terms adopted by the European Commission that provide appropriate safeguards when exporting personal data to a third country lacking an adequacy decision. A transfer impact assessment is also expected.

Adequacy decision

A European Commission decision finding that a third country ensures an adequate level of data protection, allowing personal data to flow there without additional safeguards or authorisation.

ePrivacy Directive

EU rules protecting confidentiality of communications and regulating cookies and electronic marketing. Non-essential cookies and marketing messages generally require prior consent, alongside GDPR requirements.

NIS2 Directive

EU cybersecurity legislation requiring essential and important entities to adopt risk-management measures and report significant incidents to authorities within defined deadlines. It complements, but does not replace, GDPR obligations.

EU AI Act risk tiers

A risk-based framework distinguishing prohibited AI practices, high-risk systems subject to conformity assessment and documentation, limited-risk systems with transparency duties, and minimal-risk systems with no additional obligations.

Convention 108+

The modernised Council of Europe Convention for the protection of individuals regarding automated processing of personal data. It is the only binding international treaty in this field.

One-stop-shop mechanism

A GDPR cooperation model where the supervisory authority of the member state where the controller's main establishment is located acts as lead authority for cross-border processing.

Data Protection Impact Assessment

An assessment required where processing is likely to result in a high risk to rights and freedoms. It describes the processing, assesses necessity and risks, and defines mitigation measures, possibly requiring prior consultation.

Breach notification deadline

Controllers must notify the supervisory authority without undue delay and where feasible within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk.

Record of processing activities

A GDPR Article 30 record listing purposes, categories of data subjects and personal data, recipients, third-country transfers, retention periods and security measures for each processing activity.

DSAR response time

Controllers must respond to data subject access requests without undue delay and within one month, extendable by two further months for complex or numerous requests, with reasons given.

Processor agreement content

A GDPR Article 28 contract must state subject matter, duration, nature and purpose, data types and subject categories, plus confidentiality, security, sub-processor rules, assistance duties, deletion terms and audit rights.

Transfer impact assessment

An analysis of the destination country's laws and practices that may affect transferred data, and of supplementary technical, organisational or contractual measures needed to ensure an essentially equivalent protection level.

Cookie consent requirements

Non-essential cookies require prior consent obtained through accept and reject options of equal prominence, granular per-purpose choices, no pre-ticked categories, and no penalty for refusal.

Privacy by design

Building data protection into processing systems and business practices from the outset, using measures such as minimisation, pseudonymisation, encryption and access control rather than retrofitting safeguards later.

Privacy risk assessment

Evaluation of the likelihood and severity of harm to individuals arising from processing, distinct from security risk assessment, which focuses primarily on business and organisational impact.

Accountability principle

The controller must be able to demonstrate compliance, not merely achieve it, through policies, processing records, impact assessments, training records, audit results and documented decisions.

Data Protection Officer

A mandatory role for public authorities and for large-scale monitoring or special-category processing. The DPO advises, monitors compliance, cooperates with authorities and reports to the highest management level.

Privacy programme layers

A typical programme has a governance layer of policy and roles, an operational layer of records, assessments, consent and breach handling, and an assurance layer of audits, metrics and training evaluation.

Vendor privacy management

Due diligence before onboarding a processor, contractual data protection terms, periodic reassessment of guarantees, and a maintained register of processors and sub-processors with defined responsibilities.