GDPR Foundation flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

GDPR full name

General Data Protection Regulation (EU) 2016/679, a regulation that harmonises data protection law across the EU and applies directly in all member states.

GDPR application date

The GDPR entered into force on 24 May 2016 and became applicable on 25 May 2018, replacing Directive 95/46/EC.

Personal data definition

Any information relating to an identified or identifiable natural person (data subject); an identifiable person can be identified directly or indirectly by identifiers such as name, ID number, location, or online identifier.

Processing definition

Any operation performed on personal data, whether automated or not, such as collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, or erasure.

Controller definition

The natural or legal person, public authority, agency, or other body which alone or jointly with others determines the purposes and means of the processing of personal data.

Processor definition

A natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.

Data subject definition

An identified or identifiable natural person whose personal data is processed; the GDPR protects individuals, not legal persons.

Lawful basis for processing

Under Article 6, processing is lawful only if at least one basis applies: consent, contract, legal obligation, vital interests, public task, or legitimate interests.

Consent requirements

Consent must be freely given, specific, informed, and unambiguous, expressed by a clear affirmative action; silence, pre-ticked boxes, or inactivity do not constitute valid consent.

Special category data

Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification, health data, or data concerning sex life or sexual orientation.

Data minimisation principle

Personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.

Storage limitation principle

Personal data must be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes of processing.

Accuracy principle

Personal data must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure inaccurate data is erased or rectified without delay.

Integrity and confidentiality

Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

Accountability principle

The controller is responsible for, and must be able to demonstrate compliance with, all GDPR principles, for example through records, policies, and data protection impact assessments.

Privacy by design

Article 25 requires data protection measures to be designed into processing systems from the outset, and by default only necessary data is processed.

Data protection impact assessment

A DPIA is required before processing likely to result in high risk to rights and freedoms, such as large-scale systematic monitoring or large-scale special category processing.

Data Protection Officer (DPO)

A mandatory role for public authorities, organisations carrying out large-scale systematic monitoring, or large-scale special category processing; the DPO monitors compliance independently.

Records of processing activities

Article 30 requires controllers and processors to maintain records of processing, unless the organisation has fewer than 250 employees and processing is occasional and low risk.

Breach notification to authority

The controller must notify the supervisory authority of a personal data breach within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to rights and freedoms.

Breach communication to data subjects

When a breach is likely to result in high risk, the controller must communicate it to data subjects without undue delay, describing the nature and consequences and mitigation measures.

Right of access

Article 15 gives data subjects the right to obtain confirmation of whether their data is processed, a copy of the data, and information about purposes, recipients, and retention.

Right to erasure

Article 17 allows data subjects to request deletion of personal data where it is no longer necessary, consent is withdrawn, or processing is unlawful, subject to legal exceptions.

Right to data portability

Article 20 allows data subjects to receive their data in a structured, commonly used, machine-readable format and to transmit it to another controller where processing is based on consent or contract.

Right to object

Article 21 allows data subjects to object to processing based on legitimate interests or public task; for direct marketing, the objection is absolute and processing must stop.

Automated decision-making

Article 22 restricts decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, unless necessary for a contract, authorised by law, or based on explicit consent.

Territorial scope

The GDPR applies to controllers and processors established in the EU, and to non-EU entities offering goods or services to, or monitoring the behaviour of, data subjects in the EU.

International data transfers

Transfers outside the EEA require an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a specific derogation.

Standard contractual clauses

Pre-approved contractual terms adopted by the European Commission that provide appropriate safeguards for transfers of personal data to third countries.

One-stop-shop mechanism

A cross-border processing arrangement where the lead supervisory authority in the controller's main establishment acts as the single point of contact for supervision.

Administrative fines

Supervisory authorities may impose fines up to €20 million or 4% of global annual turnover for serious infringements, and up to €10 million or 2% for lesser infringements.

Pseudonymisation

Processing that replaces identifying attributes with pseudonyms so data can no longer be attributed to a data subject without additional information kept separately; it reduces risk but data remains personal data.