EXIN PDPP key terms

Any information relating to an identified or identifiable natural person, directly or indirectly, such as a name, identification number, location data, or an online identifier.

The natural person to whom personal data relates and whose protection the privacy rules serve.

Any operation performed on personal data, whether automated or not, including collection, recording, storage, alteration, retrieval, consultation, disclosure, and erasure.

The entity that alone or jointly determines the purposes and means of processing personal data, and therefore carries primary legal responsibility for it.

An entity that processes personal data on behalf of a controller, acting only on documented instructions and without deciding the underlying purposes.

Two or more entities that together determine the purposes and means of processing, sharing responsibility for compliance and for enabling data subject rights.

A further processor engaged by a processor to carry out part of the processing, requiring controller authorisation and equivalent contractual obligations.

Sensitive data such as health, biometrics, genetic data, sexual orientation, religion, ethnicity, or political opinions, subject to stricter processing conditions.

The extent to which a person can be singled out from data, directly or indirectly, using means reasonably likely to be used, including combining datasets.

Irreversibly altering data so that no individual can be identified by any means reasonably likely to be used, taking it outside personal data rules.

Replacing identifying attributes with codes so data can no longer be attributed to a person without additional separately kept information, reducing risk while remaining personal data.

A freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they agree to processing of their personal data.

A clear, affirmative statement or action specifically confirming agreement, typically required for special categories of data or certain transfers.

The data subject's right to revoke consent at any time, after which processing based on that consent must stop unless another legal basis applies.

One of the permitted grounds, such as consent, contract, legal obligation, vital interest, public task, or legitimate interest, that justifies processing personal data.

A legal basis allowing processing that serves a genuine, lawful business or third-party interest, balanced against the rights and expectations of data subjects.

The assessment weighing a controller's legitimate interest against the impact on data subjects, considering safeguards and reasonable expectations.

The principle that personal data must be collected for specified, explicit, and legitimate purposes and not further processed incompatibly with those purposes.

The principle that personal data must be adequate, relevant, and limited to what is necessary for the stated purposes.

The principle that personal data may be kept in identifiable form only as long as needed for the purposes, after which it must be deleted or anonymised.

The principle that personal data must be correct and, where necessary, kept up to date, with inaccurate data erased or rectified without undue delay.

The obligation to be able to demonstrate compliance with privacy principles through policies, records, assessments, and other documented evidence.

Embedding privacy protections into systems, processes, and products from the outset rather than adding them afterwards.

Configuring systems so that, without user action, only the minimum personal data necessary for each purpose is processed and shared.

A structured analysis of a high-risk processing activity, describing the flow of data, assessing risks to individuals, and defining mitigating measures before processing starts.

Processing likely to result in a significant risk to individuals' rights and freedoms, such as large-scale sensitive data use or systematic monitoring, triggering extra safeguards.

The process of identifying threats to personal data and individuals, estimating likelihood and impact, and choosing controls to reduce risk to an acceptable level.

The duty to apply appropriate technical and organisational measures, such as encryption and access control, to protect personal data against breaches and unauthorised access.

A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

The obligation to inform a supervisory authority, and sometimes affected individuals, about a personal data breach within defined time limits when risk thresholds are met.

The rights individuals can exercise over their data, including access, rectification, erasure, restriction, portability, and objection.

A data subject's request to obtain confirmation of whether their data is processed and a copy of that data together with supporting information.

Also called the right to be forgotten, it lets a data subject require deletion of personal data when it is no longer necessary or processing is unlawful.

An independent expert responsible for advising on privacy obligations, monitoring compliance, and acting as contact point for data subjects and the supervisory authority.

An independent public body that monitors and enforces compliance with privacy law, handles complaints, and may impose corrective measures and fines.

An internal register describing processing activities, their purposes, data categories, recipients, retention periods, and security measures, used to evidence accountability.

A documented plan stating how long each category of personal data is kept and how it is disposed of once the period ends.

A contract setting out how a processor must handle personal data for a controller, including instructions, security, confidentiality, and assistance duties.

Moving personal data to another country or international organisation, permitted only with a lawful transfer mechanism and appropriate safeguards.

A formal determination by an authority that a destination country provides an essentially equivalent level of data protection, allowing transfers without extra safeguards.

A public notice explaining what personal data an organisation collects, why, how long it keeps it, who receives it, and how individuals can exercise their rights.

The principle that processing must be explained clearly and openly to data subjects, using concise, intelligible language at the time data is collected.