DPO key terms

Any information relating to an identified or identifiable natural person, including names, identifiers, location data, or factors specific to physical, physiological, genetic, mental, economic, cultural, or social identity.

The individual person to whom a set of personal data relates and whose rights and interests data protection law is designed to protect.

Any operation performed on personal data, whether automated or manual, such as collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, or erasure.

The entity that alone or jointly with others determines the purposes and means of processing personal data, and therefore bears primary legal responsibility for compliance.

A party that processes personal data on behalf of and under the documented instructions of a controller, without deciding the underlying purposes of the processing.

Two or more entities that together determine the purposes and means of processing, sharing responsibility for compliance and typically documenting their arrangement.

A third party engaged by a processor to carry out part of the processing, requiring controller authorization and flow-down of the same data protection obligations.

A contract between controller and processor that sets out processing instructions, security measures, confidentiality, sub-processor rules, assistance duties, and deletion or return of data.

A legally recognized ground that justifies processing personal data, such as consent, contract, legal obligation, vital interests, public task, or legitimate interests.

A freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they agree to processing, given by statement or clear affirmative action.

The data subject's right to revoke previously given consent at any time, after which processing based on that consent must stop unless another lawful basis applies.

A lawful basis allowing processing that serves a genuine business or third-party interest, provided the interest is not overridden by the rights and freedoms of data subjects.

A documented three-part analysis covering the purpose test, necessity test, and balancing test used to justify and evidence reliance on legitimate interests.

The principle that personal data must be collected for specified, explicit, and legitimate purposes and not further processed in ways incompatible with those purposes.

The principle that personal data collected and processed must be adequate, relevant, and limited to what is necessary for the stated purposes.

The principle that personal data should be kept in identifiable form only for as long as needed for the stated purposes, with defined retention periods and deletion routines.

The set of entitlements individuals hold over their personal data, typically including access, rectification, erasure, restriction, portability, and objection.

A data subject's right to obtain confirmation of whether their data is processed and to receive a copy plus information about purposes, recipients, retention, and rights.

The data subject's right to have personal data deleted without undue delay where specified grounds apply, often called the right to be forgotten.

The data subject's right to object to processing based on legitimate interests or public task, and to object absolutely to processing for direct marketing.

The right to receive personal data in a structured, commonly used, machine-readable format and to transmit it to another controller where processing is consent- or contract-based and automated.

Transparent information provided to data subjects describing what data is collected, why, who receives it, how long it is kept, and what rights are available.

The principle that processing must be fair and understandable, with clear, plain-language information given to data subjects about how their data is handled.

Sensitive personal data such as health, biometrics, genetics, ethnicity, religion, political opinions, sex life, or trade union membership, subject to stricter conditions.

Replacing direct identifiers with codes so data can no longer be attributed to a person without additional separately held information, reducing but not removing risk.

Irreversibly altering data so that no individual can be identified by any means reasonably likely to be used, taking it outside the scope of personal data law.

A structured risk assessment required before high-risk processing, describing the processing, assessing necessity and risks, and identifying mitigating measures.

Embedding data protection into systems, processes, and products from the outset rather than adding it afterward, including privacy-protective defaults.

Configuring products and services so that, without user action, only the minimum amount of personal data necessary for the stated purpose is processed.

An independent advisor responsible for monitoring compliance, advising on obligations, and acting as contact point for regulators and data subjects where appointment is required or voluntary.

The obligation to demonstrate compliance through policies, records, assessments, training, and other evidence, not merely to comply in practice.

An inventory documenting each processing activity, its purposes, data categories, recipients, retention periods, security measures, and cross-border transfers.

An independent public body that monitors and enforces data protection law, handles complaints, and can impose corrective measures and administrative fines.

A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.

The duty to report qualifying personal data breaches to the supervisory authority within a set time, and to affected individuals where the risk is high.

The process of identifying, analyzing, and evaluating the likelihood and severity of harm to individuals from a processing activity or incident.

Selecting and applying controls to modify risk, such as avoiding, reducing, transferring, or accepting it, with residual risk documented and monitored.

Encoding data so that only parties holding the correct key can read it, protecting confidentiality in transit and at rest and supporting breach-impact reduction.

Measures that restrict who can view or use systems and data, typically through least privilege, role assignment, authentication, and periodic review.

Moving personal data to another country or international organization, permitted only where a legal transfer mechanism or an approved safeguard applies.

A formal determination by an authority that another country provides an essentially equivalent level of data protection, allowing transfers without extra safeguards.

Pre-approved model contract terms used to impose data protection obligations on parties involved in a cross-border transfer where no adequacy finding exists.

An approved internal framework of policies and safeguards allowing transfers of personal data between members of a corporate group across jurisdictions.

Processing likely to result in a high risk to individuals' rights and freedoms, such as large-scale profiling or sensitive data use, triggering enhanced obligations.