ICDL Data Protection (ICDL) flashcards
ICDL Data Protection · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Personal data
- Any information relating to an identified or identifiable natural person, including identifiers such as names, ID numbers, location data, or online identifiers that can single out an individual.
- Data subject
- The natural person to whom personal data relates and whose data protection rights are protected under data protection law.
- Data controller
- The entity that alone or jointly determines the purposes and means of processing personal data, and bears primary responsibility for compliance.
- Data processor
- An entity that processes personal data on behalf of and under the instructions of a controller, without deciding the purposes of processing.
- Special category data
- Personal data revealing health, biometrics used for unique identification, racial or ethnic origin, political opinions, religious beliefs, or sexual orientation, requiring stricter legal conditions.
- Pseudonymisation
- A technique replacing identifying attributes with keys held separately, reducing linkability while the data remains personal data subject to the law.
- Anonymisation
- Irreversibly removing identifiability so the data no longer relates to a person; such data falls outside data protection law if the standard is truly met.
- Personal data breach
- A security incident causing accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
- Legal basis for processing
- At least one of six grounds must apply: consent, contract, legal obligation, vital interests, public task, or legitimate interests.
- Consent validity
- Consent must be freely given, specific, informed, and unambiguous, expressed by a clear affirmative action, and withdrawable as easily as it was given.
- Purpose limitation
- Personal data may only be collected for specified, explicit, and legitimate purposes and not further processed in a way incompatible with those purposes.
- Data minimisation
- Only personal data that is adequate, relevant, and limited to what is necessary for the stated processing purpose may be collected and used.
- Storage limitation
- Personal data must be kept in identifiable form no longer than necessary for the purpose, with defined and documented retention periods.
- Accuracy principle
- Personal data must be accurate and, where necessary, kept up to date; inaccurate data must be rectified or erased without undue delay.
- Accountability principle
- The controller must be able to demonstrate compliance through documented policies, records of processing, risk assessments, and other evidence.
- Legitimate interests test
- A three-part assessment: a genuine legitimate interest exists, processing is necessary for it, and it is not overridden by the data subject's rights.
- Data protection impact assessment
- A structured risk assessment required before processing likely to result in high risk, such as large-scale special category data or systematic monitoring.
- Right of access
- The data subject may obtain confirmation that their data is processed, a copy of it, and details of purposes, recipients, and retention.
- Right to rectification
- The data subject may have inaccurate personal data corrected and incomplete data completed without undue delay.
- Right to erasure
- The data subject may have data deleted where it is no longer necessary, consent is withdrawn, or processing was unlawful, subject to legal exceptions.
- Right to restriction
- The data subject may limit processing to storage only, for example while accuracy or lawfulness of processing is being verified.
- Right to data portability
- The data subject may receive data they provided, processed by automated means under consent or contract, in a structured, machine-readable format.
- Right to object
- The data subject may object to processing based on legitimate interests or public task; for direct marketing the objection is absolute and processing must stop.
- Automated decision-making rights
- Safeguards against decisions based solely on automated processing with significant effects include human intervention, expressing a view, and contesting the decision.
- Rights response deadline
- Controllers must answer data subject requests generally within one month, extendable by two further months for complex or numerous requests, usually free of charge.
- Privacy by design
- Data protection measures are built into systems and processes from the outset rather than added afterwards, embedding safeguards into the design.
- Privacy by default
- The most privacy-protective settings apply automatically, so only data necessary for each specific purpose is processed without user action.
- Data protection officer
- An independent advisor who monitors compliance, advises on obligations, and acts as contact point for supervisory authorities and data subjects.
- Records of processing activities
- Documentation listing purposes, categories of data and data subjects, recipients, retention periods, and security measures for each processing operation.
- Breach notification to authority
- Where a breach poses risk to rights and freedoms, the controller must notify the supervisory authority generally within 72 hours of becoming aware.
- Breach notification to data subjects
- Where a breach is likely to result in high risk to individuals, the controller must inform affected data subjects without undue delay.
- Processor contract
- A written agreement binding the processor to documented instructions, confidentiality, security, sub-processor rules, and assistance with data subject rights.