ICS ECDPO key terms

Any information relating to an identified or identifiable natural person, such as a name, identification number, location data, or online identifier, whether held electronically or in paper files.

The living individual to whom personal data relates. Data subjects have enforceable rights over how their information is collected, used, stored, and shared by organizations.

Any operation performed on personal data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction, whether automated or manual.

Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification, health data, or data concerning sex life or sexual orientation, requiring extra protection.

The principle that personal data collected must be adequate, relevant, and limited to what is necessary for the specified purpose, avoiding excessive or unrelated collection.

The requirement that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.

The principle that personal data should be kept in identifiable form only for as long as necessary for the purposes for which it is processed, with defined retention periods and secure deletion thereafter.

The obligation on organizations to demonstrate compliance with data protection principles, including maintaining records, policies, training evidence, and the ability to prove appropriate measures are in place.

A legal ground that justifies processing personal data, such as consent, contract, legal obligation, vital interests, public task, or legitimate interests. At least one basis must apply before processing begins.

A freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they agree to processing, given by a statement or clear affirmative action, and which can be withdrawn at any time.

A lawful basis where processing is necessary for the legitimate interests of the controller or a third party, unless overridden by the rights and freedoms of the data subject, requiring a balancing assessment.

A documented three-part test identifying the legitimate interest, showing processing is necessary, and balancing it against the individual's rights and expectations, used to justify processing under that basis.

The data subject's right to revoke previously given consent at any time. Withdrawal must be as easy as giving consent, and processing based on consent must stop once it is withdrawn.

The set of entitlements individuals have over their personal data, including access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making.

A request from an individual to obtain a copy of their personal data held by an organization, together with information about processing purposes, recipients, retention, and rights, typically answered within one month.

Also called the right to be forgotten, it allows individuals to request deletion of their personal data where there is no compelling reason for continued processing, subject to legal exceptions.

The process of confirming that a person making a data subject request is who they claim to be, using proportionate checks before disclosing or changing personal data.

A structured risk assessment required before high-risk processing, identifying the nature of the processing, assessing necessity and risks to individuals, and documenting mitigation measures and safeguards.

Processing likely to result in a high risk to individuals' rights and freedoms, such as large-scale special category data, systematic monitoring, or automated decision-making, which triggers a DPIA requirement.

The process of identifying, analyzing, and evaluating risks to individuals from data processing, considering likelihood and severity of harm, and determining appropriate controls to reduce risk.

Actions taken to reduce identified data protection risks to an acceptable level, such as technical safeguards, policy controls, training, or contractual restrictions, documented as part of risk management.

Decisions about individuals made solely by automated means without human involvement, including profiling, which may require safeguards such as human intervention or the right to contest the decision.

A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data, which may require notification to regulators and affected individuals.

The obligation to inform the supervisory authority of a personal data breach without undue delay, typically within 72 hours of awareness, and to notify affected individuals when the breach poses high risk.

A documented set of procedures for detecting, containing, investigating, and recovering from data security incidents, including roles, communication steps, and breach notification triggers.

A technical security measure that converts data into unreadable form unless decrypted with a key, protecting confidentiality and often reducing breach notification obligations when applied to affected data.

Processing personal data so it can no longer be attributed to a specific individual without additional information kept separately and protected, reducing risk while preserving some utility.

Irreversibly transforming personal data so that no individual can be identified by any means reasonably likely to be used, removing it from data protection law while requiring careful risk assessment.

An independent expert responsible for advising on compliance, monitoring data protection practices, providing training, and acting as contact point for regulators and data subjects, where appointment is required.

A documented inventory describing processing purposes, categories of data and individuals, recipients, transfers, retention periods, and security measures, required as evidence of accountability.

The approach of embedding data protection safeguards into systems, processes, and products from the outset, rather than adding them after development, to reduce risk and support compliance.

Mandatory education for staff on handling personal data lawfully and securely, covering policies, breach reporting, subject rights, and role-specific risks, with completion records kept as accountability evidence.

Sending personal data to a country or international organization outside the originating jurisdiction, which requires a lawful transfer mechanism such as adequacy decision, standard contractual clauses, or binding corporate rules.

Pre-approved contractual terms used to safeguard personal data transferred to countries without an adequacy decision, imposing obligations on importers and exporters to protect the data.

A formal determination by a supervisory authority that a third country provides an adequate level of data protection, allowing personal data to flow there without additional safeguards.

A contract between a controller and processor setting out the processor's obligations, including processing only on instructions, security measures, sub-processor rules, assistance with rights, and deletion or return of data.

The organization or entity that determines the purposes and means of processing personal data, bearing primary legal responsibility for compliance and for demonstrating accountability.

An entity that processes personal data on behalf of and on the instructions of a controller, with contractual duties regarding security, confidentiality, sub-processing, and assistance with data subject rights.

A third party engaged by a processor to carry out specific processing activities, requiring prior authorization from the controller and equivalent data protection obligations flowing down the chain.

An independent public body responsible for monitoring and enforcing data protection law, handling complaints, conducting investigations, and imposing corrective measures and fines.