CDPSE flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Accountability principle

The controller must be able to demonstrate compliance with privacy principles, not merely comply. Evidence includes records of processing, DPIAs, policies, and training records.

Controller versus processor

A controller determines the purposes and means of processing. A processor handles personal data on the controller's documented instructions and cannot repurpose it independently.

Joint controllers

Two or more parties that jointly determine purposes and means of processing. They must define responsibilities transparently, but each remains liable to data subjects.

Three lines of defense

Operations owns and manages privacy risk, the privacy or compliance function monitors and advises, and internal audit provides independent assurance to the board.

Purpose limitation

Personal data may be collected for specified, explicit, and legitimate purposes and must not be further processed in ways incompatible with those original purposes.

Privacy policy versus standard

A policy states external commitments and high-level intent. A standard sets mandatory internal requirements that implement the policy, such as encryption levels or retention rules.

Policy exception register

A log of approved deviations from privacy standards, each with an owner, justification, compensating control, and expiry date so exceptions do not become permanent.

Privacy governance reporting

A defined cadence and escalation path that carries privacy risk metrics and incidents to executive management and the board for oversight.

Risk scoring formula

Privacy risk is assessed as likelihood multiplied by impact on data subjects and the organisation, scored before controls (inherent) and after controls (residual).

DPIA trigger conditions

A DPIA is required for systematic and extensive profiling, large-scale special-category processing, or large-scale systematic monitoring of a publicly accessible area.

DPIA required contents

A systematic description of processing and purposes, an assessment of necessity and proportionality, identified risks to rights and freedoms, and planned mitigation measures.

Transfer impact assessment

An analysis of destination-country law and surveillance exposure that determines whether supplementary technical, organisational, or contractual measures are needed for a data transfer.

Breach notification deadline

Under GDPR, notify the supervisory authority within 72 hours of becoming aware of a personal data breach unless it is unlikely to result in risk.

Data subject request clock

Requests must be answered within the statutory period, one month under GDPR, extendable by two further months for complex requests with notice to the requester.

Records of processing activities

An inventory of processing operations covering purposes, data categories, recipients, transfers, retention, and security measures, required as an accountability artifact.

Vendor risk tiering

Classifying suppliers by data sensitivity and volume so that due diligence depth, contract terms, and reassessment frequency match the actual risk exposure.

Standard contractual clauses

Pre-approved contractual terms that legitimise transfers of personal data outside the EEA, valid only if a transfer impact assessment supports them.

Consent validity test

Consent must be freely given, specific, informed, and unambiguous, expressed by a clear affirmative action, and withdrawable as easily as it was given.

Data life cycle stages

Collection, use, sharing, retention, and disposal. Each stage needs a defined legal basis, control set, and owner rather than relying on collection-time review alone.

Retention schedule

A documented period for each data category derived from legal or business need, paired with a disposal trigger and an accountable owner.

Legal hold

A documented instruction that suspends scheduled disposal of specific records because of litigation or investigation, released formally when the matter closes.

Verifiable disposal

Destruction or deletion that produces evidence, such as certificates, logs, or attestations, and that covers backups, archives, and third-party copies.

Secondary use compatibility

Reuse of personal data for a new purpose must be assessed against the original purpose; incompatible reuse requires a new legal basis or fresh consent.

Data classification scheme

Tiered labels such as public, internal, confidential, and restricted, each prescribing storage, encryption, sharing, and disposal requirements for the data.

Data flow mapping

A record of what personal data moves where, to which recipients, under which agreement, and in which jurisdiction, used to support transfers and vendor oversight.

Data minimisation

Only personal data that is adequate, relevant, and limited to what is necessary for the stated purpose may be collected and retained.

Privacy by design

Embedding privacy controls into systems and processes at the design stage rather than retrofitting them after deployment, covering the full data life cycle.

Privacy by default

The most privacy-protective settings apply automatically without user action, including minimal data collection and limited visibility of personal data.

Pseudonymisation versus anonymisation

Pseudonymised data remains personal data because re-identification is possible with additional information. Anonymised data cannot be re-identified by any reasonably likely means.

k-anonymity limitation

Ensuring each record is indistinguishable from at least k-1 others reduces re-identification risk but does not protect against attribute disclosure or homogeneity attacks.

Purpose-based access control

An attribute-based model that grants access only when the request's declared purpose matches the purpose for which the data was collected.

Consent record fields

A defensible consent record captures the notice version shown, timestamp, identity, scope granted, and the withdrawal mechanism and history.