ICS CDPP key terms

Any information relating to an identified or identifiable natural person, including identifiers such as name, number, location data, or factors specific to physical, physiological, genetic, mental, economic, cultural, or social identity.

The living individual to whom a set of personal data relates. Data subjects hold rights over their data, such as access, rectification, erasure, and objection, which organizations must honor under applicable law.

Any operation performed on personal data, whether automated or manual, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, alignment, restriction, erasure, or destruction.

The entity that alone or jointly with others determines the purposes and means of processing personal data. The controller bears primary legal responsibility for compliance and for demonstrating accountability.

A party that processes personal data on behalf of and under the instructions of a controller. Processors have their own statutory duties, including security, record-keeping, and restrictions on sub-processing.

Two or more entities that jointly determine the purposes and means of processing. They must allocate responsibilities transparently, often through an arrangement, while data subjects may exercise rights against each of them.

A processor engaged by another processor to carry out specific processing activities. The original processor must obtain controller authorization and impose equivalent data protection obligations downstream.

A binding contract between a controller and processor that sets out the subject matter, duration, nature and purpose of processing, and obligations such as confidentiality, security, sub-processor rules, and assistance with data subject rights.

One of the legal grounds that legitimizes processing, such as consent, contract, legal obligation, vital interests, public task, or legitimate interests. Processing without a valid basis is unlawful.

A freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they agree to processing, given by a statement or clear affirmative action. It must be as easy to withdraw as to give.

The data subject's right to revoke previously given consent at any time. Withdrawal must be simple, must not affect the lawfulness of prior processing, and should stop future processing based on that consent.

A lawful basis allowing processing that is necessary for the legitimate interests of the controller or a third party, unless overridden by the rights and freedoms of the data subject. It requires a balancing assessment.

A documented three-part test covering the identification of a legitimate interest, the necessity of processing to achieve it, and a balancing of that interest against the individual's rights and reasonable expectations.

A core principle requiring that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. Compatibility assessment governs reuse.

The principle that personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. It discourages collecting data that may be useful later.

The principle that personal data should be kept in identifiable form no longer than necessary for the stated purposes. It requires defined retention periods and mechanisms for deletion or anonymization.

Sensitive personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life and sexual orientation, subject to stricter conditions.

The set of entitlements individuals hold over their personal data, typically including access, rectification, erasure, restriction, portability, objection, and rights concerning automated decision-making. Requests must be handled within statutory timeframes.

A data subject's request to obtain confirmation of whether their data is processed and to receive a copy of that data along with information about purposes, recipients, retention, and rights. Usually subject to a one-month deadline.

Also called the right to be forgotten, it allows individuals to request deletion of personal data where grounds apply, such as withdrawal of consent or unlawful processing, subject to legal retention exceptions.

The right to receive personal data in a structured, commonly used, machine-readable format and to transmit it to another controller, applicable where processing is based on consent or contract and is automated.

The process of obscuring or removing information, such as third-party data or privileged material, from documents before disclosure, for example in response to a subject access request.

A tool that captures, records, and enforces user consent choices across channels and systems, enabling granular preferences, proof of consent, and propagation of withdrawals to downstream processing systems.

The principle requiring organizations to take responsibility for compliance and to be able to demonstrate it through policies, records, training, assessments, and other documented evidence of appropriate measures.

The organizational structure of roles, policies, procedures, and oversight mechanisms that direct how personal data is managed, ensuring responsibility is assigned, decisions are documented, and compliance is monitored.

A designated individual tasked with informing and advising on compliance, monitoring data protection performance, and acting as a contact point for regulators and data subjects. Independence is essential to the role.

An inventory documenting each processing operation, including purposes, categories of data and data subjects, recipients, transfers, retention periods, and security measures. It supports accountability and oversight.

An approach embedding privacy protections into systems and processes from the outset, including default settings that minimize data collection and exposure, rather than retrofitting compliance after implementation.

A structured assessment required for processing likely to result in high risk to individuals, such as large-scale monitoring or sensitive data use. It describes the processing, assesses necessity and risks, and identifies mitigations.

The process of identifying threats to personal data, estimating likelihood and severity of harm to individuals, and evaluating whether existing controls reduce risk to an acceptable level before processing begins.

The level of risk remaining after mitigation measures have been applied. It must be evaluated against acceptance criteria and may require escalation or prior consultation with a supervisory authority.

The selection and application of controls to modify risk, such as avoiding, reducing, transferring, or accepting it. Measures should be proportionate to the sensitivity and volume of data involved.

A process where the controller seeks advice from a supervisory authority before processing when a data protection impact assessment indicates residual high risk that cannot be sufficiently mitigated.

A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. It may be caused by malicious action, error, or technical failure.

The obligation to report qualifying personal data breaches to the supervisory authority, typically within 72 hours of awareness, and to inform affected individuals when the breach poses a high risk to their rights.

A documented set of procedures for detecting, containing, assessing, eradicating, and recovering from security incidents, including defined roles, escalation paths, evidence preservation, and communication steps.

An independent public body established to monitor and enforce data protection law, with powers to investigate, impose corrective measures and fines, and receive breach notifications and consultation requests.

Pre-approved contractual terms used to provide appropriate safeguards when transferring personal data to jurisdictions lacking an adequacy decision, binding the importer to defined protection standards.

A formal determination by a supervisory or regulatory body that a third country or territory provides an essentially equivalent level of data protection, allowing transfers without additional safeguards.

Any disclosure of personal data to a recipient in another jurisdiction, including remote access from abroad. Transfers require a lawful basis plus a transfer mechanism such as adequacy or safeguards.

An analysis of the destination country's laws and practices to determine whether imported data will receive essentially equivalent protection, and whether supplementary technical or organizational measures are needed.

An approved internal framework of policies and safeguards enabling multinational groups to transfer personal data between their entities worldwide, subject to authorization by a competent supervisory authority.

The irreversible process of removing or altering identifiers so that data can no longer be attributed to an individual by any reasonably likely means. Properly anonymized data falls outside data protection law.

Replacing direct identifiers with codes so data can no longer be attributed to an individual without additional information held separately. Pseudonymized data remains personal data and stays within scope.