ICS ECDPO flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Personal data

Any information relating to an identified or identifiable natural person, including identifiers, location data, and online identifiers that can single out an individual directly or indirectly.

Purpose limitation principle

Personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those original purposes.

Data minimisation principle

Personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

Special category data

Data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, and data on sex life or sexual orientation.

Storage limitation principle

Personal data must be kept in a form permitting identification of individuals for no longer than is necessary for the purposes of the processing.

Accountability principle

The controller must not only comply with data protection principles but also be able to demonstrate that compliance through documented evidence and records.

Legitimate interests basis

A lawful basis requiring a legitimate interest, necessity of processing to achieve it, and a balancing test showing individual rights do not override that interest.

Valid consent

A freely given, specific, informed, and unambiguous indication of the individual's wishes by a statement or clear affirmative action.

Withdrawal of consent

The individual's right to withdraw consent at any time, which must be as easy to exercise as giving consent and must not cause detriment.

Lawful basis selection

The controller must determine and document the lawful basis before processing begins and cannot substitute an alternative basis retrospectively.

Consent record keeping

Controllers must retain evidence of consent, including the identity of the individual, timing, information provided, and the method by which consent was given.

Right of access

The individual's right to obtain confirmation of whether their data is processed and a copy of that data along with specified supplementary information.

Response deadline extension

A two-month extension to the one-month response period is available for complex or numerous requests, with notification to the requester within the first month.

Right to erasure

The right to have personal data deleted where it is no longer necessary, consent is withdrawn, objection succeeds, or processing was unlawful, subject to exemptions.

Right to restriction

The right to require a controller to store but not otherwise process personal data, typically pending verification of accuracy or assessment of an objection.

Right to data portability

The right to receive data provided by the individual in a structured, commonly used, machine-readable format where processing is automated and based on consent or contract.

Absolute marketing objection

An objection to processing for direct marketing purposes must be honoured immediately and cannot be overridden by compelling legitimate grounds.

DPIA trigger conditions

A DPIA is required where processing, especially with new technologies, is likely to result in a high risk to individuals' rights and freedoms.

DPIA required content

A DPIA must describe the processing, assess necessity and proportionality, identify and assess risks, and specify measures addressing those risks.

Prior consultation

Where residual risk remains high after mitigation, the controller must consult the supervisory authority before commencing the processing.

Risk assessment perspective

Risk is evaluated from the individual's viewpoint, combining the likelihood and severity of harm rather than focusing only on organisational impact.

Personal data breach

A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

72-hour notification rule

Controllers must notify the supervisory authority of a breach within 72 hours of awareness where it is likely to result in a risk to rights and freedoms.

Individual breach notification

Where a breach is likely to result in high risk, affected individuals must be informed without undue delay in clear and plain language.

Breach register

A documented internal record of all personal data breaches, including non-notifiable ones, capturing facts, effects, and remedial actions taken.

Processor breach duty

A processor must notify the controller without undue delay after becoming aware of a breach, while the controller retains the regulatory notification obligation.

Records of processing activities

Documentation maintained by controllers and processors covering purposes, data categories, recipients, transfers, retention periods, and security measures.

Data Protection Officer role

An independent officer monitoring compliance, advising on obligations, and acting as contact point for the supervisory authority and individuals.

Data protection by default

A requirement that, by default, only personal data necessary for each specific purpose is processed in terms of amount, extent, and retention.

Role-based training

Training tailored to the specific data access, processing activities, and risks of each staff role, delivered recurrently and evidenced by completion records.

Adequacy decision

A determination by an authority that a destination country or organisation ensures an adequate level of data protection, permitting transfers without further safeguards.

Transfer impact assessment

An evaluation of destination-country laws and practices and of supplementary measures needed to ensure protection essentially equivalent to that in the originating jurisdiction.