US DPO key terms

A flexible legal standard requiring organizations to adopt safeguards proportionate to the sensitivity of data and the risks they face, rather than a fixed checklist of mandated controls.

The federal statute prohibiting unfair or deceptive acts or practices in commerce, used by the FTC to enforce privacy promises and inadequate data security across most industries.

The US model of regulating privacy industry by industry, such as health, finance, and education, instead of through one comprehensive federal statute covering all personal data.

The federal law governing privacy and security of protected health information held by covered entities and their business associates, including breach notification duties.

Individually identifiable health information created or received by a covered entity or business associate that relates to a person's health, care, or payment for care.

A Federal Trade Commission rule requiring non-bank financial institutions to develop, implement, and maintain a written information security program protecting customer information.

The federal law protecting education records, limiting disclosure of personally identifiable student information and giving parents or eligible students rights to inspect and amend records.

The federal law requiring verifiable parental consent before collecting personal information online from children under 13, with special rules for operators directed to children.

A COPPA requirement that operators use reasonable methods, such as signed forms or payment verification, to confirm that a parent or guardian authorized collection of a child's data.

California's comprehensive consumer privacy law, as amended by the CPRA, granting rights to know, delete, correct, and opt out of sale, sharing, and certain profiling.

Under CPRA, data such as government identifiers, precise geolocation, health, sexual orientation, and financial account credentials, carrying extra notice and use-limitation obligations.

A browser or device signal that California and some other states require businesses to honor as a valid opt-out of sale and sharing of personal information.

A legally recognized automated signal, such as GPC, that expresses a consumer's preference to opt out of sale or targeted advertising across participating websites.

A consumer's ability to direct a business to stop selling or sharing their personal information or to limit use of sensitive data, typically exercised through a link or signal.

A request by an individual to confirm whether an organization processes their data and to receive a copy, often accompanied by related correction or deletion demands.

A consumer right to have personal information erased, subject to exceptions such as legal retention duties, security needs, or completing a requested transaction.

The process of confirming a requester is who they claim to be, matched to the sensitivity of the data, before honoring access or deletion requests.

A person or entity legally permitted to submit privacy requests on a consumer's behalf, which the business may require to be registered or to provide written permission.

A freely given, informed agreement to processing, which under US law may be opt-in or opt-out depending on the statute, data type, and context.

A disclosure presented when data is first gathered, stating the categories collected, purposes, whether data is sold or shared, and how long it is retained.

A public statement describing an organization's data practices, including what is collected, why, with whom it is shared, retention periods, and how to exercise rights.

The principle that personal data should be collected for specified, legitimate purposes and not used for incompatible new purposes without fresh notice or consent.

Collecting and keeping only the personal data that is adequate, relevant, and necessary for the stated purpose, reducing exposure in the event of a breach.

A documented plan specifying how long each data category is kept, the legal or business justification, and the method and timing of secure disposal.

Assigning labels such as public, internal, confidential, or restricted to data assets so that handling, access, and protection controls match sensitivity.

A record of what personal data an organization holds, where it resides, how it flows between systems and vendors, and which business processes rely on it.

A maintained register describing each processing operation, its purposes, data categories, recipients, retention, and safeguards, forming the backbone of accountability documentation.

The principle that an organization must be able to demonstrate compliance through policies, records, training, and monitoring, not merely assert that it follows the law.

Building privacy protections into systems and processes from the outset, including default settings that limit collection and sharing without requiring user action.

A structured review of a new or changed processing activity that identifies privacy risks, evaluates necessity and safeguards, and documents mitigation before launch.

The process of identifying threats to individuals from data processing, estimating likelihood and severity of harm, and prioritizing controls to reduce that harm.

An assessment focused on adverse effects to people, such as discrimination, financial loss, reputational damage, or physical harm, rather than only harm to the business.

A documented three-part test weighing a genuine business interest, the necessity of processing, and the balance against individuals' reasonable expectations and rights.

Processing that makes decisions about individuals without meaningful human involvement, increasingly subject to notice, opt-out, and profiling rules under state laws.

Automated use of personal data to evaluate or predict aspects of a person's performance, health, preferences, behavior, or location, often triggering assessment and opt-out duties.

Moving or making personal data accessible across national borders, which requires a lawful transfer mechanism and assessment of the destination's legal protections.

Pre-approved contract terms used to legitimize transfers of personal data to jurisdictions lacking adequate protection, imposing obligations on both exporter and importer.

An analysis of the laws and practices in a recipient country, and of supplementary safeguards, to judge whether transferred data remains adequately protected.

A legal requirement that certain data be stored or processed within a country's borders, which can conflict with global systems and transfer mechanisms.

The lifecycle of selecting, contracting with, monitoring, and offboarding third parties that process personal data, including due diligence and ongoing assurance activities.

A contract between a controller and a processor setting out processing instructions, security duties, subprocessor rules, breach notice, audit rights, and return or deletion of data.

A HIPAA-required contract obligating a vendor handling protected health information to safeguard it, report breaches, and comply with applicable privacy and security rules.

Administrative, technical, and physical controls such as access management, encryption, logging, and workforce training that protect the confidentiality, integrity, and availability of data.

Encoding data so only authorized parties can read it, using keys; a common safeguard whose effectiveness depends on key management and whether data is at rest or in transit.

A legal provision excusing notification when breached data was encrypted or otherwise rendered unreadable, provided the keys were not also compromised.

A documented, tested procedure defining roles, detection, containment, escalation, communication, and post-incident review for security and privacy incidents.

An event that actually or potentially compromises confidentiality, integrity, or availability of data, which must be triaged to determine whether it is a notifiable breach.

The legal duty to inform individuals, regulators, or consumer reporting agencies within set timeframes after discovering a breach of personal information, varying by state and sector.

A trigger used in many breach laws requiring notification only when the breach creates a meaningful risk of harm, such as identity theft or financial loss, to affected people.

An independent, evidence-based review of privacy controls, records, and practices against legal requirements and internal policy, producing findings and remediation plans.

A staged framework describing progressive levels of privacy program capability, from ad hoc compliance to measured, continuously improved, and embedded practices.

Role-tailored education that builds workforce awareness of handling rules, incident reporting, and rights procedures, with completion tracked and refreshed periodically.

The designated individual accountable for a privacy program's strategy, policy, training, request handling, and regulatory engagement, with defined authority and reporting lines.