ICDL Data Protection (ICDL) key terms

Any information relating to an identified or identifiable living person, such as a name, photo, email address, location history, or an identification number.

The individual person whom a set of personal data is about. Data protection rules exist to protect this person's rights and freedoms.

The organisation or person that decides why and how personal data is processed, and bears the main legal responsibility for complying with data protection rules.

An organisation or person that handles personal data on behalf of a controller, following the controller's instructions rather than deciding the purposes itself.

Any operation performed on personal data, including collecting, recording, storing, organising, altering, retrieving, disclosing, combining, erasing, or destroying it.

A legally recognised reason that allows personal data to be processed, such as consent, contract, legal obligation, vital interests, public task, or legitimate interests.

A clear, affirmative agreement by the data subject to processing of their personal data, given freely, for specific purposes, after being properly informed, and withdrawable at any time.

A lawful basis where processing is necessary for a genuine business or organisational interest that is not overridden by the rights and expectations of the individual.

The principle that personal data must be collected for specified, explicit and legitimate purposes and not reused for incompatible new purposes without a proper legal basis.

The principle that only personal data that is adequate, relevant and necessary for the stated purpose should be collected and kept.

The principle that personal data should be kept in identifiable form only for as long as needed for its purpose, after which it must be deleted or anonymised.

The principle that personal data must be correct and, where necessary, kept up to date, with inaccurate data corrected or erased without undue delay.

The principle that personal data must be protected against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate security measures.

The principle that a controller must be able to demonstrate compliance with data protection rules, for example through policies, records, training and documented decisions.

Sensitive personal data needing extra protection, such as information about health, racial or ethnic origin, religion, political opinions, sexual orientation, or trade union membership.

The quality of being able to single out a person, directly by name or indirectly by combining details such as an address, device identifier or job title.

Irreversibly removing identifying details so that no individual can be recognised, meaning the data is no longer personal data and data protection rules no longer apply.

Replacing identifying details with codes so that data can no longer be linked to a person without extra information kept separately and securely; the data remains personal data.

The powers individuals have over their own personal data, including being informed, accessing it, correcting it, erasing it, restricting its use, and objecting to processing.

A data subject's right to obtain confirmation of whether their data is processed and to receive a copy of it together with key information about how and why it is used.

A data subject's right to have inaccurate personal data corrected and incomplete data completed without undue delay.

A data subject's right to have personal data deleted in specified circumstances, for example when it is no longer needed or consent has been withdrawn and no other basis applies.

A data subject's right to limit how their data is used, for example while its accuracy is being checked or while an objection is being assessed.

A data subject's right to refuse processing based on legitimate interests or public task, and to stop direct marketing at any time without needing to give reasons.

A data subject's right to receive data they provided in a structured, commonly used, machine-readable format and to have it transmitted to another provider where technically feasible.

A request from an individual asking an organisation to confirm what personal data it holds about them and to provide a copy, usually answered within a legal deadline.

The data subject's act of taking back previously given permission, which must be as easy as giving it and which stops processing that relied only on that consent.

Agreement given after the person receives clear information about what data will be used for, who will receive it, and what choices they have.

The duty to tell people clearly and openly what personal data is collected, why, how long it is kept, and who it is shared with, usually through a privacy notice.

A written statement explaining an organisation's handling of personal data, including purposes, lawful basis, retention, sharing and how to exercise rights.

A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

The duty to report certain personal data breaches to the supervisory authority, and to affected individuals where there is high risk, within specified time limits.

An independent public body that enforces data protection law, handles complaints from individuals, and can investigate organisations and impose penalties.

A structured review carried out before risky processing begins, to identify privacy risks and the measures needed to reduce them.

Building data protection safeguards into systems and processes from the outset, rather than adding them afterwards, including default settings that limit collection and sharing.

Technical and organisational safeguards such as encryption, access controls, staff training and backups that protect personal data against loss, misuse and unauthorised access.

The defined length of time personal data is kept before it is deleted or anonymised, based on the purpose, legal requirements and risk.

Any organisation or person outside the controller and processor who receives or accesses personal data, such as a supplier, adviser or public body.

Disclosing personal data to another organisation, which requires a lawful basis, transparency to the individual, and appropriate safeguards or agreements.