GDPR Foundation key terms

Any information relating to an identified or identifiable natural person, including names, identification numbers, location data, or factors specific to that person's physical, physiological, genetic, or social identity.

The identified or identifiable natural person to whom personal data relates. The data subject is the individual whose rights the regulation protects, not an organisation or a deceased person.

Any operation performed on personal data, whether automated or manual, such as collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure, erasure, or destruction.

The natural or legal person, public authority, agency, or other body that alone or jointly with others determines the purposes and means of processing personal data. The controller carries primary accountability.

A natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller. The processor acts on documented instructions and must not use data for its own purposes.

Two or more controllers that jointly determine the purposes and means of processing. They must transparently allocate responsibilities among themselves, but each remains liable toward data subjects.

A third party engaged by a processor to carry out specific processing activities on behalf of the controller. The processor needs prior authorisation and must impose the same data protection obligations downstream.

A binding contract between controller and processor setting out subject matter, duration, nature and purpose of processing, data types, and obligations such as confidentiality, security, and assistance with data subject rights.

One of six legal grounds permitting processing: consent, contract, legal obligation, vital interests, public task, or legitimate interests. Every processing activity needs a valid basis before it begins.

A freely given, specific, informed, and unambiguous indication of the data subject's wishes, expressed by a statement or clear affirmative action, agreeing to processing of their personal data.

The data subject's right to take back consent at any time. Withdrawal must be as easy as giving consent and does not affect the lawfulness of processing carried out before withdrawal.

A lawful basis where processing is necessary for the legitimate interests of the controller or a third party, unless overridden by the interests or fundamental rights of the data subject, especially for children.

A documented three-part test: identify the legitimate interest, show processing is necessary, and balance it against the data subject's rights and reasonable expectations. It supports reliance on the legitimate interests basis.

A core principle requiring personal data to be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.

A principle requiring personal data to be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

A principle requiring personal data to be kept in a form permitting identification of data subjects for no longer than necessary for the processing purposes, with defined retention periods and review.

A principle requiring personal data to be accurate and, where necessary, kept up to date, with reasonable steps taken to erase or rectify inaccurate data without delay.

A principle requiring personal data to be processed securely, using appropriate technical and organisational measures to protect against unauthorised or unlawful processing, loss, destruction, or damage.

The principle making the controller responsible for, and able to demonstrate compliance with, all data protection principles. It requires documented policies, records, and evidence of measures taken.

An approach requiring data protection measures to be built into processing activities and systems from the outset, rather than added afterwards, considering volume, scope, context, and risks.

A requirement that, by default, only personal data necessary for each specific purpose is processed, covering amount, extent, retention, and accessibility, without manual adjustment by the user.

The security safeguards a controller and processor must implement, taking into account state of the art, costs, and processing risks, to ensure a level of security appropriate to the risk.

Processing personal data so it can no longer be attributed to a data subject without additional information held separately and protected by technical and organisational measures. It reduces risk but data remains personal data.

Irreversibly transforming data so that no individual can be identified by any means reasonably likely to be used. Anonymous information falls outside the scope of the regulation.

Sensitive data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification, health data, and data concerning sex life or sexual orientation.

Personal data relating to criminal convictions and offences. Processing is permitted only under official authority control or where authorised by law with appropriate safeguards.

A higher standard of consent required for special categories of data, expressed in a clear statement, whether written or oral, that specifically confirms agreement to the sensitive processing.

The enforceable rights of individuals, including information, access, rectification, erasure, restriction, data portability, objection, and rights relating to automated decision-making, exercisable free of charge.

A request by a data subject to obtain confirmation of whether their personal data is processed, plus a copy of that data and specified supplementary information such as purposes and recipients.

Also called the right to be forgotten. It allows a data subject to request deletion of personal data where grounds apply, such as withdrawal of consent or unlawful processing, subject to legal exceptions.

The data subject's right to limit processing of their data, for example while accuracy is contested or processing is unlawful but erasure is refused, during which data may generally only be stored.

The data subject's right to have inaccurate personal data corrected without undue delay and to have incomplete data completed, including by a supplementary statement.

The right to receive personal data provided to a controller in a structured, commonly used, machine-readable format and to transmit it to another controller where processing is based on consent or contract and automated.

The data subject's right to object to processing based on public task or legitimate interests, and to direct marketing at any time, after which processing generally must stop.

A decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. It is restricted unless necessary for a contract, authorised by law, or based on explicit consent.

Any form of automated processing of personal data to evaluate personal aspects of a natural person, such as performance at work, health, preferences, reliability, or behaviour.

A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It must be notified to the supervisory authority within 72 hours where risk is likely.

An independent public authority established by a member state to monitor and enforce the regulation. Its tasks include handling complaints, conducting investigations, and imposing administrative fines.

A designated expert who informs and advises the controller or processor, monitors compliance, and acts as contact point for supervisory authorities, where designation is required by the regulation.

A structured assessment of the impact of planned processing on personal data protection, required for high-risk activities such as large-scale monitoring or sensitive data processing.

Internal documentation describing processing purposes, categories of data and data subjects, recipients, transfers, retention periods, and security measures. Controllers and processors must maintain these records.

A mechanism letting organisations operating in several member states deal mainly with one lead supervisory authority for cross-border processing, with cooperation and consistency among authorities.

The supervisory authority of the member state where a controller or processor has its main establishment, coordinating supervision of cross-border processing and acting as single contact point.

A monetary penalty imposed by a supervisory authority for infringement, in two tiers up to 10 million euros or 2 percent of global turnover, and 20 million euros or 4 percent, whichever is higher.

Sending personal data outside the European Economic Area. It is allowed only with an adequacy decision, appropriate safeguards such as standard contractual clauses, or specific derogations.

A European Commission finding that a third country, territory, or sector ensures an adequate level of data protection, allowing personal data to flow there without further safeguards.

Pre-approved model contract terms adopted by the European Commission that controllers and processors can use to provide appropriate safeguards for international data transfers.

Internal data protection rules adopted by a multinational group and approved by a supervisory authority, providing appropriate safeguards for intra-group international transfers of personal data.