DSCI DCPP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Personal data

Any information relating to an identified or identifiable natural person, where identifiability may be direct via name or ID, or indirect via IP address, device identifier, or location data.

Data minimisation principle

A principle requiring that personal data collected be adequate, relevant, and limited to what is necessary for the specified purpose, reassessed whenever processing purposes change.

Purpose limitation

Personal data may be processed only for purposes specified and documented at collection, unless a lawful basis supports reuse that is compatible with the original purpose.

Controller versus processor

The controller determines processing purposes and means, while the processor acts only on the controller's documented instructions and cannot repurpose data without becoming a controller.

Valid consent elements

Consent must be freely given, specific, informed, unambiguous, and withdrawable; silence, pre-ticked boxes, and bundled conditions do not constitute valid consent.

Privacy by design

An approach embedding privacy protections into systems and processes at the design stage, with default settings that minimise data collection and sharing without user action.

Pseudonymisation

Replacing direct identifiers with tokens so data cannot be attributed to a person without separately held additional information, reducing risk without achieving full anonymisation.

Puttaswamy privacy judgment

The 2017 Indian Supreme Court decision holding privacy a fundamental right under Article 21, requiring legality, necessity, and proportionality for state intrusion.

DPDP Act scope

India's 2023 data protection law applies to digital personal data processed in India and to foreign processing that offers goods or services to data principals in India.

Data Fiduciary

Under the DPDP Act, the entity that alone or with others determines the purpose and means of processing personal data, bearing primary compliance obligations.

Significant Data Fiduciary

A Data Fiduciary designated by the Indian government based on factors such as data volume, sensitivity, and risk, attracting additional obligations like DPIAs and audits.

DPDP consent notice

A pre-consent notice stating the personal data sought, the purpose of processing, and how the Data Principal can exercise rights and complain to the Data Protection Board.

DPDP cross-border transfer rule

Transfers of personal data outside India are permitted except to countries the Central Government restricts by notification, a restricted-list rather than adequacy model.

Data Protection Board of India

The adjudicating authority under the DPDP Act that hears breaches, directs remediation, and imposes monetary penalties, including up to INR 250 crore for security safeguard failures.

GDPR extraterritorial scope

Article 3(2) extends GDPR to organisations outside the EU that offer goods or services to EU data subjects or monitor their behaviour within the EU.

Standard contractual clauses

Pre-approved contractual terms used to transfer personal data to countries without an adequacy decision, requiring a transfer impact assessment after Schrems II.

Binding corporate rules

An intra-group transfer mechanism approved by a supervisory authority that binds all group entities to specified data protection standards for cross-border flows.

Adequacy decision

A formal determination by a regulator that a destination country provides essentially equivalent data protection, permitting transfers without additional safeguards.

CCPA opt-out rights

California consumer rights to opt out of sale or sharing of personal information and to limit use of sensitive personal information, alongside know, delete, and correct rights.

Data localisation models

Regulatory approaches requiring data to remain in-country, requiring a local copy while permitting foreign processing, or permitting transfer subject to specified conditions.

Records of processing activities

A register documenting each processing activity's purpose, data categories, data subjects, recipients, cross-border transfers, retention periods, and security measures; foundational for programme governance.

Privacy risk scoring

Assessment combining likelihood and impact to classify risk as low, medium, or high, with high residual risk requiring senior sign-off before processing begins.

Data retention schedule

A documented plan setting retention periods per data category and purpose, triggering deletion when periods end, and recording legal-hold exceptions.

Vendor privacy due diligence

Pre-contract assessment of a processor's privacy and security posture, followed by contractual terms, periodic reassessment, and confirmed deletion at offboarding.

Privacy programme metrics

Measurable indicators of effectiveness such as DPIA completion rate, data subject request turnaround, incident counts, training completion, and vendor assessment coverage.

Role-based privacy training

Awareness programmes tailored to job function, such as developers, marketers, and HR, with completion tracking and periodic refresher requirements.

Privacy-enhancing technologies

Technical measures reducing privacy risk, including encryption, tokenisation, pseudonymisation, differential privacy, secure multi-party computation, and homomorphic encryption.

Data classification tiers

Labels such as public, internal, confidential, and restricted that determine access control, encryption, retention, and vendor handling requirements for each dataset.

Data subject request workflow

A process covering intake, identity verification, cross-system data discovery, fulfilment or lawful refusal, response within statutory deadlines, and a maintained audit trail.

Incident response lifecycle

Structured phases of preparation, detection, containment, assessment, notification, remediation, and post-incident review applied to privacy and security incidents.

GDPR 72-hour notification

The requirement to notify the supervisory authority of a personal data breach within 72 hours of becoming aware, unless the breach is unlikely to result in risk.

Breach severity assessment

Evaluation of an incident weighing data sensitivity, volume, identifiability of affected individuals, containment status, and potential harm to determine notification obligations.