Welcome to your favorite one-stop guide: the Data Privacy Dictionary. In our world today, personal data is constantly shared and collected at an alarming rate. It’s more important than ever to stay informed on how you can safeguard your customer’s privacy.
Whether you’re running a business or simply conscious about preserving online privacy, this dictionary simplifies complex concepts into easily understood language for everyone.
No longer will terms like “data breach,” “GDPR,” or “personally identifiable information” leave you puzzled!
Our all-inclusive dictionary has got it sorted out in simple yet precise explanations covering commonly used data privacy jargon and beyond – everything tailored to make understanding effortless just for you!
Accountability
The idea that organizations have a responsibility to follow data protection laws and regulations. They must also show proof of compliance to both individuals whose data they hold as well as authorities in charge of overseeing data privacy.
Anonymization
The process of modifying or removing personal information so that it can no longer be used to identify an individual.
Automated decision-making
When decisions with legal consequences are made using algorithms or computer techniques instead of human judgment.
Biometric data
Information derived from measuring or analyzing physical characteristics of a person, like fingerprints or facial recognition.
Breach notification
The requirement is to notify individuals and/or authorities if there is an accidental or unauthorized access, loss, modification, destruction, or disclosure of personal data.
California Consumer Privacy Act (CCPA)
Stands for California Consumer Privacy Act. This is a state law in California, USA, that gives consumers more control over their personal data by providing them specific rights like knowing what information an organization collects about them and asking to delete it if they wish. It also affects how companies can share and sell this kind of data.
Children
In the context of data privacy, children refer to individuals who are under a certain age and require additional layers of protection when it comes to their personal information. Different jurisdictions have different definitions for this group (in GDPR terms, anyone below 16 years old.
In some U.S. states, COPPA regulation considers anyone below 13 years old) as they may not fully understand the implications of sharing personal information online.
Cookies
These are small files saved on your device when you visit certain websites. They’re designed to hold data specific to a particular client or website, such as user preferences, and can be accessed either by the web server or the client computer for various purposes, like tracking user behavior over time.
Consent
When someone freely agrees and gives explicit permission for their personal data to be processed in a specific way.
Consent Management
This is the process of asking, collecting, and managing individuals’ permission to collect or use their personal data. This generally includes providing clear information about how, where, and why people’s data will be stored or used to make informed decisions regarding consent.
Consent management also involves keeping records of given consents and ensuring options are available for easy withdrawal if an individual changes his/her mind later on.
Controller-processor agreement
A legal contract between the organization (controller) that decides how and why personal information is processed and another party (processor) that carries out the actual processing on behalf of the controller. This agreement outlines their roles and responsibilities regarding protecting privacy rights.
Cross-border data transfer
The movement of personal information from one country to another.
Data breach
A security incident where there is an unintended or unlawful exposure, loss, alteration, destruction, or unauthorized access to personal data that has been processed/stored/transmitted.
Data controller
An individual, organization, authority, or other entity determines why and how personal information should be processed.
Data Minimization
This refers to the principle of only collecting, processing, or retaining as much personal data as is necessary for a specific purpose. It’s about ensuring that no unnecessary additional information unrelated to what you need for your service or process should be gathered from users.
This practice reduces potential risks associated with having excessive amounts of sensitive data, and it also helps organizations comply better with privacy laws like GDPR.
Data processor
An individual/organization/body processes personal data on behalf of a data controller following their instructions.
Data protection
The act of safeguarding individuals’ privacy rights regarding their personal information.
Data protection authority (DPA)
An independent public organization established by a country to supervise and enforce data protection laws.
Data subject
A person who is identified or can be identifiable based on the personal data that has been processed.
Data subject access request (DSAR)
A DSAR is a request made by an individual to see the personal data a company has on them. This includes details about where it was sourced and how it’s being used, providing transparency for individuals in regard to their own information.
De-identified data
This refers to personal information that has been stripped of identifiable details, such as names or addresses. This ensures the person to whom the data belongs cannot be identified directly or indirectly through combinations of different kinds of information. Creating de-identified datasets is an important step in protecting people’s privacy when sharing and using their information.
Encryption
Converting information into a secret code or form in order to prevent unauthorized access. This ensures that only authorized parties with the appropriate key can decipher and access the original information.
General Data Protection Regulation (GDPR)
These are guidelines forming a legal framework dictating organizations’ responsibilities when collecting, using, storing, or sharing personal data of citizens residing within Europe — even if these activities extend beyond European borders.
International data transfer
The movement of personal information from one country to another, either within the same organization or between different organizations.
Legal basis
In terms of data protection, a legal basis is the justification for processing personal information in accordance with privacy laws. For example, obtaining consent from an individual or having legitimate interests to process certain personal data can be considered as a legal basis under GDPR law.
Opt in
This refers to the action where individuals actively agree or provide consent for their personal data being collected, used, and shared by a third party. Usually, this involves checking boxes on forms online.
Opt out
This is an option that enables individuals an easy way of discontinuing participation or refusing further collection/use/sharing of their personal information.
Personally identifiable information (PII)
This term refers to any piece of information that can be used to identify a person. Examples include someone’s name, address or social security number.
Privacy by default
Designing systems in a way that privacy settings are automatically set to provide a maximum protection without individuals needing to take any additional actions themselves.
Privacy by design
Integrating privacy measures into the development process and architecture of systems or processes right from the beginning rather than adding them later on as an afterthought.
Processing restriction
An individual’s right under certain circumstances to limit or restrict how their personal data is processed by an organization.
Profiling
Using automated processing methods using personal data for analyzing or predicting various aspects related specifically to work performance levels.
Privacy impact assessment (PIA)
An evaluation tool used to identify and analyze potential privacy risks and impacts that may arise from certain data processing activities.
Privacy notice
A message provided by organizations informing people about the ways their personal data will be collected, used, and shared. It also explains how they plan to protect this data while explaining why it needs to be collected at all.
Processing
Any action involving personal data, such as collecting, recording, organizing, storing, modifying, or altering it. This can also include activities like accessing or sharing the information with others.
Privacy Shield
An agreement between the European Union and the United States to ensure adequate protection when transferring personal data from EU countries to organizations certified under this framework based in the US.
Publicly available information
This is information that can be openly accessed by anyone. It may include data found in public directories, social media platforms or websites, government records, or widely distributed media sources. Oftentimes, it is treated differently than personal information.
Retention Period
This is the length of time for which an organization decides to keep personal data. It depends upon various factors such as legal requirements, industry standards or regulations, and business needs. After this period ends, the respective information should be securely deleted or destroyed according to privacy laws and practices.
Record of Processing Activities (RoPA)
This is a documentation requirement under the GDPR. It’s essentially an inventory for companies to record what personal data they hold, where it comes from, why and how it’s processed, who has access to it, and with whom this data gets shared.