DPO flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Personal data

Any information relating to an identified or identifiable natural person. Identifiability may be direct, such as a name, or indirect, such as an IP address or device identifier.

Special category data

Data revealing racial or ethnic origin, political opinions, religion, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation. Requires heightened protection.

Data controller

The entity that alone or jointly determines the purposes and means of processing personal data. It bears primary accountability for compliance with data protection obligations.

Data processor

An entity that processes personal data on behalf of and on the documented instructions of a controller. It must not use data for its own purposes.

Lawful basis

A legal ground permitting processing: consent, contract, legal obligation, vital interests, public task, or legitimate interests. At least one must apply before processing begins.

Valid consent

Consent that is freely given, specific, informed, and unambiguous, indicated by a clear affirmative action. Silence, pre-ticked boxes, or inactivity are insufficient.

Purpose limitation

A core principle requiring personal data to be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.

Data minimisation

A principle requiring that personal data be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

Storage limitation

A principle requiring that personal data be kept in a form permitting identification of data subjects for no longer than necessary for the processing purposes.

Right of access

A data subject's right to obtain confirmation of whether their data is processed, plus a copy of the data and information about purposes, recipients, and retention.

Right to erasure

Also called the right to be forgotten; allows a data subject to request deletion of personal data where grounds apply, subject to legal exceptions such as legal obligations.

Data portability

The right to receive personal data in a structured, commonly used, machine-readable format and to transmit it to another controller where processing is based on consent or contract.

Breach notification deadline

Personal data breaches must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of the controller becoming aware, unless unlikely to pose a risk.

Cross-border transfer mechanism

A legal tool enabling international data transfers, such as an adequacy decision, standard contractual clauses, binding corporate rules, or a specific derogation.

Privacy by design

An approach embedding data protection into system design and business processes from the outset, rather than adding protections after processing has begun.

Data subject request

A request from an individual to exercise a privacy right. Controllers generally must respond within one month, extendable by two further months for complex cases.

Three lines model

A governance structure: the first line owns and manages risk, the second line provides oversight and compliance, and the third line gives independent assurance through internal audit.

Risk appetite

The amount and type of risk an organisation is willing to accept in pursuit of its objectives. It sets the threshold against which residual risk is evaluated.

Residual risk

The level of risk remaining after controls and treatment measures have been applied. It must be compared against the organisation's defined risk appetite.

Risk treatment options

The four standard responses to risk: accept, mitigate or reduce, transfer through insurance or contract, and avoid by ceasing the activity.

Risk register

A central record of identified risks including owner, description, likelihood, impact, existing controls, residual rating, and treatment plan with target dates.

Data Protection Impact Assessment

A structured assessment required before high-risk processing, such as large-scale special category data or systematic monitoring. It documents risks and mitigating measures.

Accountability principle

The obligation to demonstrate compliance, not merely comply. Evidence includes processing records, policies, training logs, impact assessments, and audit trails.

Data Protection Officer

A designated role responsible for advising on data protection obligations and monitoring compliance. The DPO must be independent, report to senior management, and avoid conflicting duties.

Records of processing

Documentation describing processing activities, including purposes, data categories, recipients, retention periods, and security measures. A core accountability and governance artifact.

Controller-processor agreement

A contract setting out a processor's obligations, including processing only on documented instructions, confidentiality, security, sub-processor rules, and assistance with data subject rights.

Third-party risk management

The process of assessing, contracting with, monitoring, and offboarding vendors. The controller remains accountable for data protection even when using processors.

Key risk indicator

A metric that provides early warning of increasing risk exposure, such as rising breach frequency, overdue access requests, or incomplete training completion rates.

Privacy by default

A configuration principle ensuring that, without user action, systems process only the minimum personal data necessary for each purpose, with the most protective settings applied.

Security of processing

The obligation to implement appropriate technical and organisational measures, such as encryption, access control, resilience, and regular testing, proportionate to the risk.

Supervisory authority

An independent public body that monitors and enforces data protection law, handles complaints, and may impose corrective measures and administrative fines on controllers and processors.

Privacy governance framework

The policies, roles, committees, and reporting lines that direct data protection activity, linking executive oversight to operational controls and measurable compliance indicators.

Automated decision-making

Decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. Such decisions generally require safeguards or explicit consent.