PECB CDPO flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Personal data

Any information relating to an identified or identifiable natural person, where identification can occur directly or indirectly through identifiers such as names, numbers, location data, or online identifiers.

Data minimisation principle

Personal data must be adequate, relevant, and limited to what is necessary for the stated purposes, so collection scope is justified against each processing purpose rather than retained by default.

Purpose limitation

Data collected for specified, explicit, and legitimate purposes may not be further processed in an incompatible way; compatibility is assessed on link to original purpose, context, and expectations.

Lawful basis

One of the enumerated legal grounds that legitimises processing, such as consent, contract, legal obligation, vital interests, public task, or legitimate interests, each with distinct conditions.

Valid consent

A freely given, specific, informed, and unambiguous indication of wishes expressed by clear affirmative action, which can be withdrawn at any time as easily as it was given.

Data subject access right

The individual's right to obtain confirmation of whether their data is processed, plus a copy of the data and information about purposes, recipients, retention, and rights.

Controller versus processor

The controller determines purposes and means of processing and bears primary accountability; the processor acts only on documented controller instructions and must not repurpose data.

Adequacy decision

A formal finding by an authority that a third country or sector ensures an essentially equivalent level of protection, permitting transfers without additional safeguards.

Accountability principle

The obligation to demonstrate compliance through documented evidence such as policies, processing records, impact assessments, training logs, and audit results, rather than merely asserting it.

Data Protection Officer role

An independent adviser who informs and advises the organisation, monitors compliance, advises on impact assessments, cooperates with the supervisory authority, and acts as contact point.

DPO conflict of interest

The DPO cannot simultaneously hold a role that determines purposes or means of processing, such as head of marketing or IT operations, because monitoring would become self-review.

Record of processing activities

A maintained inventory describing each processing activity's purposes, data categories, data subjects, recipients, transfers and safeguards, retention periods, and security measures.

Joint controllers

Two or more parties that jointly determine the purposes and means of processing, requiring a transparent arrangement allocating responsibilities that is made available to data subjects.

Processor contract terms

Mandatory clauses covering processing on instructions, confidentiality, assistance with rights and assessments, breach notification to the controller, deletion or return, and audit rights.

RACI in privacy governance

A responsibility matrix distinguishing who is responsible for doing work, accountable for the outcome, consulted for input, and informed of decisions across privacy activities.

Three lines model

A governance structure where operations own and manage risk, an independent function monitors compliance, and internal audit provides assurance to the governing body.

Privacy risk definition

The likelihood and severity of harm to individuals' rights and freedoms arising from processing, assessed separately from organisational financial or reputational impact.

DPIA trigger criteria

Conditions requiring an impact assessment: systematic and extensive evaluation including profiling, large-scale sensitive data, large-scale monitoring of public areas, or high-risk new technology.

Necessity and proportionality test

An assessment of whether the processing is needed for the stated purpose, whether less intrusive means exist, and whether the intrusion is balanced against the benefit.

Residual risk

The risk remaining after mitigation measures are applied; if it stays high, prior consultation with the supervisory authority is required before processing begins.

Prior consultation

A formal engagement with the supervisory authority undertaken when an impact assessment shows residual high risk that the organisation cannot reduce with available measures.

Risk treatment options

The four responses to identified risk: avoid the activity, reduce likelihood or impact through controls, transfer via contract or insurance, or accept with documented ownership.

Re-identification risk

The chance that pseudonymised or aggregated data can be linked back to individuals by combining datasets, quasi-identifiers, or auxiliary information available to an attacker.

Vendor due diligence

Pre-contract assessment of a processor's security controls, sub-processor chain, breach notification commitments, audit rights, and transfer safeguards, repeated periodically.

Privacy by design

Embedding data protection into system and process design from the outset, including minimisation, access control, retention limits, and documented design decisions at project gates.

Policy hierarchy

A layered structure from framework policy through topic policies, standards, procedures, and work instructions, where each lower document traces to and implements the level above.

Privacy KPI versus KRI

KPIs measure activity such as training completion or assessment coverage; KRIs measure exposure such as open high risks, overdue mitigations, or rising complaint volumes.

Breach notification clock

The regulatory deadline, commonly seventy-two hours after awareness, for notifying the supervisory authority of a personal data breach likely to create risk.

Breach register

A log recording each incident's facts, affected data, risk assessment, notification decisions with rationale, containment actions, and root-cause remediation status.

Control self-assessment

A structured review in which process owners evaluate their own controls against defined criteria, producing findings that feed the corrective-action and monitoring cycle.

Corrective action register

A tracked list of improvement actions with named owner, due date, root cause, and verification of closure, reviewed at management level to confirm progress.

Retention purge verification

Testing that data scheduled for deletion is actually deleted or anonymised across production systems, backups, archives, and third-party stores, with evidence retained.