Data Protection Glossary

The accountability principle requires organizations to demonstrate their compliance with data protection principles through proper documentation, policies, procedures, and technical measures.

An adequacy decision is a determination by the European Commission that a third country or international organization provides an adequate level of data protection, allowing free transfer of personal data from the EU without additional safeguards.

API security encompasses practices and technologies that protect application programming interfaces from unauthorized access and data exposure.

The APPI is Japan's primary data protection law that regulates the handling of personal information by business operators, with 2022 amendments strengthening individual rights and cross-border transfer rules.

Cloud data protection encompasses the policies, technologies, and controls used to protect personal data stored and processed in cloud computing environments.

A code of conduct in data protection is a set of rules developed by an industry association or group of organizations that specifies how data protection regulations apply to specific processing activities within their sector.

A compliance audit is a systematic review of an organization's adherence to data protection laws, regulations, policies, and standards, identifying gaps and areas for improvement.

COPPA is a US federal law that requires websites and online services directed at children under 13 to obtain verifiable parental consent before collecting personal information from children.

Cross-border data transfer refers to the movement of personal data from one country or jurisdiction to another, which is regulated by data protection laws that impose specific requirements to ensure adequate protection.

Data governance is the overall management of data availability, usability, integrity, and security within an organization, establishing policies, procedures, and accountability for data management.

DLP is a set of tools and processes that detect and prevent unauthorized transmission, sharing, or exfiltration of sensitive personal data outside the organization.

Data masking replaces sensitive data with realistic but fictitious values, protecting privacy while maintaining data utility for testing, development, and analytics.

A Data Principal (under India's DPDP Act) or Data Subject (under the GDPR) is the individual whose personal data is being collected, processed, or stored by an organization.

A Data Processing Agreement is a legally binding contract between a data controller and a data processor that governs how personal data will be processed, ensuring compliance with data protection regulations.

Data protection certification is a formal attestation by an accredited body that an organization's data processing operations comply with specific data protection standards or regulatory requirements.

Data stewardship is the management and oversight of an organization's data assets by designated individuals who ensure data quality, compliance, and proper handling throughout the data lifecycle.

A Data Subject Access Request is a formal request made by an individual to an organization to obtain confirmation of whether their personal data is being processed and, if so, to receive a copy of that data along with details about how it is used.

Data Subject Rights are the legal rights granted to individuals under data protection laws, enabling them to control how their personal data is collected, used, stored, and shared by organizations.

The UK Data Protection Act 2018 is the United Kingdom's implementation of the GDPR into domestic law, supplementing the UK GDPR with provisions for law enforcement processing, intelligence services, and specific UK exemptions.

Encryption in transit protects data as it moves between systems using protocols like TLS/SSL, preventing interception and eavesdropping during transmission.

The ePrivacy Directive is an EU directive that regulates the processing of personal data in electronic communications, including rules on cookies, direct marketing, and confidentiality of communications.

FERPA is a US federal law that protects the privacy of student education records, giving parents and eligible students the right to access and control the disclosure of their educational information.

A gap analysis is an assessment that compares an organization's current data protection practices against the requirements of applicable regulations or standards to identify areas of non-compliance.

Information governance is the overarching strategy for managing all types of information within an organization, encompassing data governance, records management, compliance, and risk management.

ISO 27701 is an international standard that extends ISO 27001 and ISO 27002 to include privacy-specific requirements for establishing, implementing, maintaining, and improving a Privacy Information Management System (PIMS).

The NIST Privacy Framework is a voluntary tool developed by the National Institute of Standards and Technology to help organizations identify and manage privacy risks through a flexible, outcome-based approach.

PCI DSS is a set of security standards established by major credit card companies to protect cardholder data, requiring organizations that handle payment card information to meet twelve security requirements.

Singapore's PDPA is a comprehensive data protection law that governs the collection, use, disclosure, and care of personal data by organizations, enforced by the Personal Data Protection Commission.

Thailand's PDPA is a comprehensive data protection law modeled after the GDPR that regulates the collection, use, and disclosure of personal data, with full enforcement beginning in June 2022.

PII is any information that can be used to identify a specific individual, including names, addresses, email addresses, phone numbers, Social Security numbers, and biometric data.

The PIPL is China's comprehensive personal information protection law that regulates the processing of personal information by organizations inside and outside China, with strict cross-border data transfer requirements.

POPIA is South Africa's comprehensive data protection law that promotes the protection of personal information processed by public and private bodies, enforced by the Information Regulator.

Australia's Privacy Act 1988 regulates the handling of personal information by Australian Government agencies and private sector organizations, built around thirteen Australian Privacy Principles.

Privacy by Default means that the strictest privacy settings automatically apply when a customer acquires a new product or service, without requiring any manual input or configuration by the individual.

Privacy by Design is a proactive approach that embeds data protection safeguards into the design and architecture of IT systems, business practices, and products from the earliest stages of development.

A privacy framework is a structured set of guidelines, standards, and best practices that organizations use to develop and maintain their data protection and privacy compliance programs.

A privacy notice is a public-facing document that informs individuals about how an organization collects, uses, stores, shares, and protects their personal data, as required by data protection regulations.

A privacy program is a comprehensive organizational framework encompassing the policies, procedures, people, and technologies that manage an organization's data protection obligations and privacy risks.

Profiling under the GDPR is any form of automated processing of personal data that evaluates personal aspects of a natural person, such as analyzing or predicting behavior, preferences, interests, or movements.

Regulatory compliance refers to an organization's adherence to laws, regulations, guidelines, and specifications relevant to its data processing and business operations.

RBAC restricts system access based on user roles within an organization, granting permissions to roles rather than individual users.

SOC 2 is a compliance framework developed by the AICPA that evaluates an organization's controls related to security, availability, processing integrity, confidentiality, and privacy of customer data.

The Sarbanes-Oxley Act is a US federal law that establishes requirements for financial reporting, internal controls, and record retention for publicly traded companies to protect investors from fraudulent accounting.

Storage limitation is a data protection principle requiring organizations to retain personal data only for as long as necessary to fulfill the purposes for which it was collected, then securely delete or anonymize it.

A supervisory authority is an independent public body established by a country to monitor and enforce compliance with data protection laws, such as the ICO in the UK or the CNIL in France.