UKOMNAS PDPA key terms

Any information relating to an identified or identifiable individual, directly or indirectly, including names, identification numbers, location data, or factors specific to physical, physiological, genetic, mental, economic, cultural, or social identity.

The living individual to whom a set of personal data relates and whose rights the law protects. The data subject is not necessarily a citizen or resident of the country where the controller operates.

The party that alone or jointly with others determines the purposes and means of processing personal data. The controller carries primary legal responsibility for compliance, including responding to data subject requests.

A party that processes personal data on behalf of and under the instructions of a controller, without deciding the purposes of processing. Processors owe contractual and statutory duties such as security and confidentiality.

Two or more controllers that jointly determine the purposes and means of processing. They must transparently allocate responsibilities, especially for handling data subject requests, while each remains liable to regulators and data subjects.

A category of personal data warranting heightened protection, typically covering health, biometric data, genetic data, religion, political opinions, sexual orientation, and criminal records. Processing usually requires explicit consent or another narrow legal condition.

Any operation performed on personal data, whether automated or manual, such as collection, recording, storage, alteration, retrieval, consultation, disclosure, transfer, or erasure. The definition is intentionally broad to cover the full data lifecycle.

A legally recognised ground that justifies processing personal data, such as consent, contract performance, legal obligation, vital interests, public task, or legitimate interests. At least one basis must apply before processing begins.

A freely given, specific, informed, and unambiguous indication of the data subject's wishes, expressed by a statement or clear affirmative action, agreeing to processing of their personal data for stated purposes.

A heightened form of consent, usually required for sensitive personal data, given through an express statement or action that leaves no doubt about the data subject's agreement to the specific processing.

The data subject's right to revoke previously given consent at any time. Withdrawal must be as easy as giving consent and does not affect the lawfulness of processing carried out before withdrawal.

The set of entitlements individuals hold over their personal data, commonly including access, correction, erasure, restriction, objection, portability, and protection against solely automated decisions. Controllers must facilitate their exercise.

A data subject's request to confirm whether their personal data is being processed and to obtain a copy plus information about purposes, categories, recipients, retention, and rights. Usually subject to a statutory response deadline.

The data subject's ability to require deletion of personal data in defined circumstances, such as when data is no longer necessary, consent is withdrawn, or processing was unlawful, subject to legal retention exceptions.

The right to receive personal data provided by the data subject in a structured, commonly used, machine-readable format and to transmit it to another controller, where processing is based on consent or contract and is automated.

A core principle requiring personal data to be collected for specified, explicit, and legitimate purposes and not further processed in ways incompatible with those purposes unless a lawful basis exists.

The principle that personal data collected must be adequate, relevant, and limited to what is necessary for the stated purpose. It reduces exposure, cost, and breach impact.

The defined length of time personal data may be kept, after which it must be deleted or anonymised. Retention should be justified by purpose, legal obligation, or legitimate need and documented in a retention schedule.

A lawful basis allowing processing that serves a genuine business or third-party interest, provided the interest is not overridden by the data subject's rights and expectations. A balancing assessment should be documented.

An approach embedding data protection into systems, processes, and products from the outset rather than adding it afterwards. It includes default settings that minimise collection and sharing without user action.

The requirement that, without user intervention, only the minimum personal data necessary for each purpose is processed and made accessible, with restrictive default sharing and visibility settings.

Data Protection Impact Assessment: a structured process to identify, evaluate, and mitigate risks to individuals before starting high-risk processing, such as large-scale sensitive data or systematic monitoring. It should be documented and reviewed.

Processing likely to result in a high risk to individuals' rights and freedoms, triggering mandatory impact assessment. Indicators include systematic profiling, large-scale sensitive data, vulnerable subjects, or innovative technologies.

The process of identifying threats and vulnerabilities to personal data, estimating likelihood and severity of harm to individuals, and deciding on controls. It focuses on harm to people, not only organisational loss.

The level of risk remaining after mitigation controls are applied. It must be evaluated against acceptance criteria and, where still high, escalated before processing proceeds.

The technical and organisational measures protecting personal data against unauthorised access, loss, alteration, or disclosure, proportionate to risk. Measures include encryption, access control, logging, and staff training.

Mechanisms restricting who can view or use personal data, based on role, least privilege, and need to know. Includes authentication, authorisation, and periodic review of permissions.

A security principle granting users and systems only the minimum access necessary to perform their tasks, reducing the scope of accidental or malicious data exposure.

Transforming data into unreadable form using cryptographic keys so that only authorised parties can restore it. Effective encryption of lost or stolen data can reduce breach severity and notification obligations.

Replacing identifying attributes with codes so data cannot be attributed to an individual without additional information kept separately and protected. It reduces risk while data remains personal data.

Irreversibly transforming personal data so that no individual can be identified by any means reasonably likely to be used. Properly anonymised data falls outside data protection law.

A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It includes confidentiality, integrity, and availability incidents.

The duty to inform a supervisory authority, and sometimes affected individuals, of a personal data breach without undue delay when it poses a risk to their rights and freedoms. Content and timing are prescribed.

A documented set of procedures for detecting, containing, assessing, remediating, and learning from data incidents, with defined roles, escalation paths, and communication templates. It should be tested regularly.

Sending personal data to another country or international organisation. It requires a lawful transfer mechanism such as adequacy, contractual safeguards, or explicit consent, plus an assessment of destination protections.

A formal determination by a supervisory authority that a destination country or organisation ensures an essentially equivalent level of data protection, allowing transfers without additional safeguards.

Pre-approved model contract terms used to provide safeguards for transfers to jurisdictions not covered by an adequacy decision. Parties must still assess whether local laws undermine the protections.

An evaluation of destination-country laws, practices, and safeguards to determine whether transferred data will receive adequate protection and whether supplementary measures are needed.

A contract between controller and processor setting out processing instructions, confidentiality, security measures, sub-processor rules, assistance with data subject rights, deletion, and audit rights. Required in most outsourcing arrangements.

A processor engaged by another processor to carry out part of the processing. The original processor must obtain controller authorisation and impose equivalent data protection obligations downstream.

The governance process for selecting, contracting, monitoring, and reviewing vendors that handle personal data, including due diligence, security requirements, and periodic performance assessment.

Pre-contract and ongoing checks on a supplier's data protection and security posture, such as certifications, audit reports, breach history, and sub-processor arrangements, documented as evidence of accountability.

A designated professional who advises on compliance, monitors data protection performance, and acts as contact point for regulators and data subjects. The role requires independence, expertise, and no conflicting duties.

The principle that a controller must be able to demonstrate compliance, not merely claim it. Evidence includes policies, records of processing, impact assessments, training logs, and audit results.

An inventory describing processing activities, purposes, data categories, recipients, transfers, retention, and security measures. It supports accountability, request handling, and impact assessments.

The independent public body that enforces data protection law, handles complaints, conducts investigations, and may impose corrective measures and fines. Controllers must cooperate with it.

Ongoing activities that verify controls operate effectively, such as key performance indicators, spot checks, training completion tracking, and management reporting on data protection risks and incidents.

An independent, structured examination of processing activities and controls against legal requirements and internal policy, producing findings, risk ratings, and remediation actions with owners and deadlines.

Tamper-evident logs recording who accessed or changed personal data, when, and from where. They support detection, investigation, and proof of compliance, and are essential evidence in breach response.