PECB CDPO key terms

Any information relating to an identified or identifiable natural person, directly or indirectly, by reference to an identifier such as a name, number, location data, or an online identifier.

The natural person to whom personal data relates and whose protection the legal framework is designed to secure, including their rights of access, correction, erasure, and objection.

Any operation performed on personal data, whether automated or manual, such as collection, recording, organization, storage, adaptation, retrieval, consultation, disclosure, alignment, restriction, erasure, or destruction.

The entity that alone or jointly with others determines the purposes and means of processing personal data, and therefore carries the primary legal responsibility for compliance.

An entity that processes personal data on behalf of and under the documented instructions of a controller, without deciding the underlying purposes of the processing.

Two or more entities that jointly determine the purposes and means of processing, requiring a transparent arrangement that allocates responsibilities and gives data subjects a single point of contact.

A third party engaged by a processor to carry out part of the processing, which requires prior controller authorization and equivalent contractual data protection obligations.

A binding contract setting out the subject matter, duration, nature, purpose, and obligations of processing, including security measures, confidentiality, assistance duties, and deletion or return of data.

The principle that an organization must not only comply with data protection law but also be able to demonstrate that compliance through policies, records, assessments, and evidence.

An independent advisor with expert knowledge of data protection law, tasked with monitoring compliance, advising on impact assessments, and acting as contact point for supervisory authorities and data subjects.

An independent public body established by law to monitor and enforce compliance with data protection rules, handle complaints, and impose corrective measures and administrative fines.

A legal ground that must exist before processing begins, such as consent, contract performance, legal obligation, vital interests, public task, or legitimate interests.

A freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they agree to processing, expressed by a statement or clear affirmative action.

A lawful basis allowing processing that serves a genuine organizational or third-party interest, provided the interest is not overridden by the rights and freedoms of the data subject.

The principle that personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.

The principle that personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

The principle that personal data must be kept in an identifiable form no longer than is necessary for the purposes of processing, with defined retention periods and deletion routines.

Sensitive data such as racial or ethnic origin, political opinions, religious beliefs, health, sex life, or biometric data, which generally requires a stricter legal basis and higher safeguards.

Replacing identifying attributes with artificial identifiers so that data can no longer be attributed to a person without additional information kept separately and protected by technical and organizational measures.

Irreversibly altering data so that no individual can be identified by any means reasonably likely to be used, taking account of singling out, linkability, and inference risks.

The entitlements of individuals over their data, including information, access, rectification, erasure, restriction, portability, and objection, each subject to defined conditions and deadlines.

A request by an individual to confirm whether their data is processed and to obtain a copy together with information about purposes, recipients, retention, and rights.

The right to have personal data deleted without undue delay where grounds such as withdrawal of consent, unlawful processing, or obsolescence apply, subject to legal retention exceptions.

A transparent statement informing individuals about what data is collected, why, on what legal basis, for how long, who receives it, and how rights can be exercised.

The movement of personal data to another country or international organization, permitted only with an adequacy decision, appropriate safeguards, or a specific derogation.

Pre-approved contractual terms that controllers and processors can incorporate into agreements to provide appropriate safeguards for transfers of personal data to third countries.

A structured process that describes processing, assesses necessity and proportionality, identifies risks to individuals, and defines measures to address high-risk processing before it begins.

Embedding data protection into the design of systems, processes, and products from the outset, rather than adding controls after processing has already been implemented.

Configuring systems and processes so that, without user intervention, only the personal data necessary for each specific purpose is processed and access is limited accordingly.

Identifying, analyzing, and evaluating the likelihood and severity of harm to individuals from processing, then determining whether risks are acceptable or need treatment.

Selecting and applying options such as avoidance, reduction through controls, transfer, or acceptance to bring identified data protection risks within the organization's tolerance level.

The level of risk that remains after planned or implemented controls have been applied, which must be documented and accepted by an accountable owner.

A maintained inventory recording identified data protection risks, their owners, ratings, treatment actions, target dates, and current status for monitoring and reporting.

A structured register describing each processing operation, its purposes, categories of data and subjects, recipients, transfers, retention periods, and security measures.

A documented framework of policies, roles, processes, controls, and reviews that an organization uses to govern data protection in a consistent and auditable way.

A top-level management statement defining commitments, principles, responsibilities, and the governance structure for protecting personal data across the organization.

The duty to inform the supervisory authority without undue delay where a breach poses a risk to individuals, and to inform affected individuals where the risk is high.

A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data, whether caused by attack, error, or negligence.

Documented procedures for detecting, containing, assessing, escalating, and remediating security incidents, including decision paths for notifying authorities and individuals.