CDPSE key terms

A set of seven foundational principles, such as proactive prevention and embedding privacy into system architecture, that requires privacy to be built into processes and technology from the outset rather than added afterward.

The obligation of an organization to demonstrate, not merely claim, that it complies with privacy requirements, including maintaining records, policies, training evidence, and audit trails available to regulators on request.

The entity that alone or jointly determines the purposes and means of processing personal data; it bears primary legal responsibility for lawful processing, notices, and honoring data subject rights.

An entity that processes personal data on behalf of and under the documented instructions of a controller, without independent authority over purposes; obligations typically flow from a written processing agreement.

A relationship where two or more parties jointly determine the purposes and means of processing, creating shared or allocated responsibilities that should be documented in a transparent arrangement between them.

A binding contract between controller and processor specifying processing scope, duration, security measures, sub-processor conditions, breach notification duties, and return or deletion of data at termination.

A third party engaged by a processor to carry out part of the processing, requiring controller authorization, flow-down of equivalent contractual obligations, and visibility into changes in that chain.

Legally granted powers of individuals over their personal data, commonly including access, correction, deletion, restriction, portability, and objection, each with response deadlines and identity verification requirements.

A lawful basis for processing where an individual freely gives specific, informed, and unambiguous permission; it must be demonstrable, withdrawable as easily as given, and refreshed when purposes change.

A lawful basis requiring a documented three-part test: a genuine business interest, necessity of the processing, and a balancing of that interest against individual rights and reasonable expectations.

A public statement describing what personal data is collected, why, how long it is kept, who receives it, and how rights can be exercised, written in clear and accessible language.

An inventory documenting each processing operation, its purposes, categories of data and subjects, recipients, retention periods, and security measures; it is a core accountability artifact and audit input.

A structured analysis performed before high-risk processing begins, identifying necessity, proportionality, risks to individuals, and mitigations, with consultation of a supervisory authority when residual risk stays high.

A method that estimates likelihood and severity of harm to individuals from a processing activity, then compares the result to defined tolerance thresholds to decide whether treatment is required.

The risk remaining after controls and mitigations have been applied; it must be compared against the organization's risk appetite and formally accepted by an accountable owner.

A documented set of actions chosen to modify risk, such as mitigating with controls, transferring through contract, avoiding the activity, or accepting it, each with owners and target dates.

The amount and type of privacy risk an organization is willing to accept in pursuit of its objectives, expressed as thresholds or criteria that guide consistent treatment decisions across business units.

A catalog of data assets recording system location, owner, data elements, classification, source, and downstream flows; it underpins records of processing, retention, and access decisions.

A visual or tabular representation of how personal data moves between systems, teams, and external parties, used to find gaps in notices, contracts, transfer mechanisms, and security controls.

Assigning sensitivity tiers to data so that handling rules, access controls, encryption, and retention differ appropriately; privacy-relevant tiers usually reflect identifiability and potential harm.

Collecting and using only the personal data that is adequate, relevant, and necessary for a stated purpose, reducing both compliance burden and the impact of any future breach.

A principle restricting use of personal data to the purposes disclosed and legitimized at collection, unless a compatible new purpose is assessed and, where required, additional consent is obtained.

A rule set specifying how long each data category is kept and what triggers disposition, balancing legal or operational retention needs against the principle of storage limitation.

The controlled destruction or de-identification of data once its retention period ends, using methods appropriate to the medium and producing evidence of secure sanitization for audit purposes.

Irreversibly transforming data so that no individual can be identified by any means reasonably likely to be used, removing it from privacy law scope but requiring resistance to re-identification attacks.

Replacing direct identifiers with tokens so data can no longer be attributed to an individual without additional separately secured information; the data usually remains personal data and legally in scope.

A disclosure-control property ensuring each combination of quasi-identifiers appears for at least k records, reducing re-identification risk but not protecting against attribute disclosure or homogeneity attacks.

A formal guarantee that analysis outputs change only marginally when any single record is added or removed, implemented by calibrated noise and quantified through an epsilon privacy-loss budget.

Technical measures such as homomorphic encryption, secure multiparty computation, and synthetic data that enable processing or sharing with reduced exposure of identifiable information.

Substituting a sensitive value with a non-sensitive token mapped to the original in a protected vault, commonly used to reduce scope of cardholder or identifier data in downstream systems.

A formal individual request to obtain confirmation and a copy of their personal data plus related details; workflows must verify identity, meet statutory deadlines, and log every action taken.

Movement of personal data to another jurisdiction, permitted only through recognized safeguards such as adequacy decisions, standard contractual clauses, or binding corporate rules, often after a transfer impact assessment.

An evaluation of whether destination-country laws and practices undermine contractual protections for transferred data, and of what supplementary technical or organizational safeguards are needed.

Due diligence on third parties handling personal data, covering security posture, subcontracting, breach history, and contractual alignment, repeated at a frequency proportionate to data sensitivity.

A security incident leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of personal data, triggering assessment and possible notification to regulators and affected individuals.

The time-bound duty to inform a supervisory authority, and sometimes affected individuals, about a personal data breach likely to pose risk, including its nature, consequences, and remediation measures.

Documented roles, escalation paths, containment steps, evidence preservation, and communication templates activated when a privacy incident occurs, rehearsed through periodic exercises.

A staged framework describing progression from ad hoc, reactive privacy practices to measured, continuously improved, and embedded governance, used to prioritize program investments and report progress.

Quantitative indicators such as request cycle time, assessment coverage, training completion, and incident rates that demonstrate program effectiveness and support reporting to executive leadership.