Privacy & Data Protection Glossary

The policies, processes, and technical controls used to determine who or what is permitted to access systems, applications, or data, and under what conditions.

A decision by the European Commission that a country or territory outside the European Economic Area provides an adequate level of data protection, allowing personal data to be transferred there without requiring an additional transfer safeguard under the GDPR.

The process of transforming personal data so that an individual can no longer be identified, either directly or indirectly, using the resulting data.

Documents, records, logs, or other information used to demonstrate that required controls, policies, or processes are in place and operating as intended.

The continuous operational state of having the documentation, validated controls, and traceable evidence needed to demonstrate compliance and respond efficiently to an auditor's request at any time, without a last-minute scramble.

A chronological record of system activities and events that allows the sequence of actions surrounding an operation, transaction, or security-related event to be traced and reviewed.

The process of determining what an authenticated user, automated workload, or system component is permitted to access or do, based on policies, roles, attributes, and contextual conditions.

The process of making decisions about individuals using automated processing, with no human involvement in the decision. Under the GDPR, specific safeguards apply when such decisions produce legal or similarly significant effects on an individual.

Internal data protection rules adopted by a group of companies or organisations to govern transfers of personal data between entities in the group, including transfers to countries outside the EEA, where the rules meet GDPR requirements and are approved by a competent supervisory authority.

Biometric Data is personal data relating to an individual's physical, physiological, or behavioural characteristics that can be used to identify them. Under certain privacy laws, biometric data used for unique identification may receive additional protection.

The process of notifying relevant authorities, affected individuals, or other required parties about a data breach, including information about what happened, the potential impact, and the measures taken in response.

Personal data relating to children, e.g., under 18 years old for India’s DPDP Act, under 13 for Singapore’s PDPA, or under 16 for the EU’s GDPR, which may be subject to additional privacy protections and specific requirements around collection, processing, consent, and parental involvement depending on the applicable law.

An encryption approach in which data is encrypted on the user's device or application before it is sent to a server or cloud service, helping protect the data from unauthorised access while in storage or transit.

A security approach that protects data while it is being processed by using hardware-based technologies to isolate data and computation from unauthorised access, including from the underlying system or other workloads.

Permission given by an individual for an organisation to process their personal data for one or more specified purposes, where the consent meets the requirements of the applicable privacy law.

The process of collecting, recording, managing, updating, and withdrawing user consent for the processing of personal data, while maintaining records that demonstrate how and when consent was obtained.

The process of obtaining and managing a user's permission for cookies that require consent, including recording their choices and allowing them to accept, refuse, or change those choices.

Small files or pieces of data stored on a user's device by a website or service to remember preferences, maintain sessions, measure activity, or support other website functionality. Cookies may be first-party or third-party and can sometimes contain or be linked to personal data.

The transfer of personal data from one country or jurisdiction to another, which may be subject to specific legal requirements and safeguards depending on the countries involved and the applicable privacy laws.

A security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to data, particularly personal data.

The process of categorising data according to its type, sensitivity, or level of protection required, so that appropriate privacy, security, access, and handling controls can be applied.

An organisation or individual that determines the purposes and means of processing personal data. Under the EU GDPR, a Data Controller is responsible for ensuring that the processing complies with applicable data protection requirements.

The process of removing data from a system, database, application, or storage environment so that it is no longer available for normal use or processing, subject to applicable retention and backup requirements.

The process of identifying and locating data across systems, applications, databases, and other sources to understand what data an organisation holds, where it resides, and how it can be managed and protected.

Under India’s DPDP Act, an individual or organisation that determines the purpose and means of processing personal data and is responsible for meeting the obligations set out under the Act.

The framework of policies, processes, roles, and controls used to manage data responsibly throughout an organisation, including how data is accessed, used, protected, maintained, and retained.

A structured record of the data an organisation holds, including what types of data exist, where they are stored, how they are used, and who is responsible for managing them.

The record of where data comes from, how it moves and changes across systems, and where it is ultimately stored or used, helping organisations understand its flow and dependencies.

The practice of requiring certain data to be stored or processed within a specific country or geographic region, often to meet legal, regulatory, or organisational requirements.

The processes and technologies used to identify, monitor, and protect sensitive data from unauthorised access, use, disclosure, or transfer across systems and environments.

The process of documenting how data moves through an organisation, including where it is collected, stored, processed, shared, and transferred, to provide visibility into data flows and processing activities.

The process of concealing or replacing sensitive data with altered values so that the original information is not exposed, while allowing the data to remain usable for specific business or testing purposes.

The principle of collecting and processing only the personal data that is adequate, relevant, and necessary for a specific purpose, rather than collecting more data than is needed. Under the GDPR, data minimization is one of the core principles for processing personal data.

Under India’s DPDP Act, a Data Principal is the individual to whom personal data relates, explicitly including the parent or lawful guardian acting on behalf of a child or a person with a disability.

An operation or set of operations performed on personal data, such as collecting, recording, organising, storing, using, sharing, or deleting it.

A contract between a data controller and a data processor that sets out how personal data will be processed and the obligations of each party, including requirements around instructions, security, confidentiality, data subject rights, and deletion or return of data. Under the GDPR, these requirements are set out in Article 28.

An organisation or individual that processes personal data on behalf of a Data Controller or other entity responsible for determining how the data is processed. Under the GDPR, a processor acts on behalf of the controller and follows its documented instructions.

An independent public authority responsible for overseeing and enforcing data protection laws, including handling complaints, conducting investigations, and taking regulatory action where required.

The statutory body established under India’s DPDP Act to enforce the Act, inquire into personal data breaches and non-compliance, and exercise the powers and functions assigned to it under the law. The Board was formally established by the Central Government on November 13, 2025.

A structured assessment used to identify and evaluate privacy risks arising from personal data processing and determine measures to address those risks. Under the GDPR, it is required before processing that is likely to result in a high risk to individuals’ rights and freedoms.

Laws and regulations that govern how organisations collect, use, store, share, protect, and otherwise process personal data, while establishing rights and protections for individuals.

A designated person responsible for overseeing an organisation’s data protection and privacy obligations, advising on compliance, and serving as a point of contact for individuals and regulators where required. The role is specifically recognised under the EU GDPR, India’s DPDP Act, and Singapore’s PDPA, with the specific requirements and responsibilities varying by law.

The location or geographic region where an organisation's data is physically stored, which may be determined by business requirements, contractual commitments, or applicable legal and regulatory requirements.

The practice of keeping data for a defined period based on its purpose, legal or regulatory requirements, business needs, and applicable retention policies, before securely deleting or disposing of it.

A data security approach that continuously discovers and classifies sensitive data, maps where it is stored and how it is accessed, and identifies risks and misconfigurations across data environments.

An identified or identifiable person whose personal data is being collected, used, stored, or otherwise processed by an organisation.

A request made by an individual to exercise their rights over their personal data, such as requesting access, correction, deletion, portability, or restriction of processing, depending on the applicable law.

The rights individuals have over their personal data, which may include rights to access, correct, delete, restrict, object to, or obtain a copy of their data, depending on the applicable privacy law.

A mathematical technique that adds controlled statistical noise to data or query results to reduce the risk of identifying individuals while preserving useful information for analysis.

The Digital Personal Data Protection (DPDP) Act, 2023 is India’s law governing digital personal data processing that received Presidential assent on 11 August 2023. Supported by the DPDP Rules, 2025, it defines the rights of individuals (Data Principals) and sets strict consent, security, and breach-reporting duties for organisations (Data Fiduciaries). The framework introduces Consent Managers to make user control easier and is enforced by the Data Protection Board of India (DPBI).

Personal data relating to employees, such as identification, contact, employment, payroll, performance, or benefits information, that an organisation collects and processes in the course of employment.

The process of converting data into an encoded form that can only be read or used by authorised parties with the appropriate decryption key. It can protect data at rest, in transit, and, through specialised technologies, during processing.

Personal or other sensitive information relating to an individual's or organisation's financial activities, such as account details, payment information, transaction records, income, or credit information.

The European Union’s data protection law, formally Regulation (EU) 2016/679, which took effect on 25 May 2018 and governs the processing of personal data by organisations, including certain organisations outside the EU when they process the personal data of individuals in the EU in specified circumstances.

The process of receiving, reviewing, resolving, and responding to complaints or concerns raised by individuals about how their personal data is collected, used, or otherwise processed.

A dedicated hardware device designed to securely generate, store, and manage cryptographic keys and perform sensitive cryptographic operations while protecting keys from unauthorised access.

Personal data relating to an individual’s physical or mental health, including information about their medical history, treatment, health conditions, or healthcare services received.

A form of encryption that allows computations to be performed directly on encrypted data without first decrypting it, so that useful results can be obtained while the underlying data remains protected.

An international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS) within an organisation.

An international standard that provides requirements and guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS) as an extension of an Information Security Management System (ISMS).

The processes and controls used to generate, store, distribute, use, rotate, revoke, and securely dispose of cryptographic keys throughout their lifecycle.

A valid legal ground that allows an organisation to process personal data. Under the GDPR, these include consent, contract, legal obligation, vital interests, public task, and legitimate interests.

A lawful basis under the GDPR that allows an organisation to process personal data when it has a legitimate interest, the processing is necessary for that interest, and the individual’s rights and interests do not override it.

A security method that requires a user to provide two or more different types of authentication factors, such as something they know, have, or are, to verify their identity before access is granted.

Any information relating to an identified or identifiable individual, such as a name, identification number, location data, or information linked to a person’s identity or characteristics.

Information that can be used to identify an individual, either on its own or when combined with other information. The scope and definition of PII can vary across laws and regulatory frameworks.

The principle that privacy-protective settings and practices should be applied by default, so that only the personal data necessary for a specific purpose is collected, used, or made accessible.

The principle of building privacy protections into the design of products, services, systems, and processes from the outset, rather than addressing privacy risks only after they arise.

A management system that helps an organisation establish, implement, maintain, and continually improve processes for managing privacy risks and complying with applicable personal data protection requirements.

A statement that explains how an organisation collects, uses, shares, stores, and otherwise processes personal data, including information about individuals’ rights and how they can exercise them.

The potential for the processing of personal data to cause harm to individuals or negatively affect their privacy, including through misuse, unauthorised access, excessive collection, or unintended disclosure.

Technologies and techniques designed to reduce privacy risks while allowing data to be used for legitimate purposes, such as anonymization, differential privacy, encryption, and secure computation.

Any operation performed on personal data, whether by automated means or not, including collecting, recording, storing, using, sharing, modifying, or deleting it.

The automated processing of personal data to evaluate or analyse certain aspects of an individual, such as their preferences, interests, behaviour, location, or characteristics.

A process of replacing identifying information in personal data with artificial identifiers so that the data can no longer be directly linked to an individual without using additional information kept separately.

A system of technologies, policies, and processes used to create, manage, distribute, validate, and revoke digital certificates and public keys for secure communication and authentication.

The principle that personal data should be collected for specified, explicit, and legitimate purposes and should not be used for purposes that are incompatible with those original purposes.

A documented record of an organisation’s personal data processing activities, including information such as the purposes of processing, categories of data and individuals, recipients, retention periods, and applicable security measures.

The process of ensuring that an organisation’s activities, policies, processes, and controls meet the requirements of applicable laws, regulations, and regulatory standards.

The right of an individual to obtain confirmation about whether their personal data is being processed and, where applicable, access to that data and information about how it is being used.

The right of an individual to request the deletion of their personal data in certain circumstances, subject to applicable legal requirements and exceptions.

The right of an individual to object to certain types of processing of their personal data, including processing based on legitimate interests or for direct marketing, subject to applicable legal requirements.

The right of an individual, where applicable, to receive their personal data in a structured, commonly used, and machine-readable format and to have it transmitted to another organisation.

The right of an individual to request that inaccurate or incomplete personal data about them be corrected or completed.

The right of an individual to request that the processing of their personal data be limited in certain circumstances, while allowing the data to be stored and used only for permitted purposes.

An access control method that assigns permissions to defined roles and grants users access based on the roles they are assigned, rather than assigning permissions individually.

The processes and tools used to securely store, control access to, rotate, and manage sensitive credentials such as passwords, API keys, tokens, and encryption keys.

A cryptographic technique that allows multiple parties to jointly perform computations on their private data without revealing the underlying data to one another.

Personal data that requires a higher level of protection because of its nature or potential impact if misused or exposed, with the specific types and protections varying under applicable privacy laws.

Under India’s DPDP Act, a Data Fiduciary designated by the Central Government based on factors such as the volume and sensitivity of personal data processed, risk to individuals, and use of new technologies. Significant Data Fiduciaries have additional obligations under the Act.

Singapore’s Personal Data Protection Act (PDPA) came into full effect on 2 July 2014, governing the collection, use, and disclosure of personal data by organisations. The PDPA establishes obligations for organisations and rights and protections for individuals, and is administered and enforced by the Personal Data Protection Commission.

An assurance framework developed by the American Institute of Certified Public Accountants (AICPA) for evaluating controls at service organisations relating to security, availability, processing integrity, confidentiality, and privacy.

Personal data that receives additional protection under the EU GDPR because of its sensitive nature, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, health data, and data concerning a person’s sex life or sexual orientation.

Standardised, pre-approved contractual clauses used under the GDPR to provide safeguards for certain personal data transfers to countries outside the European Economic Area, helping ensure that data protection continues when personal data is transferred internationally.

The process of replacing sensitive data with a randomly generated token that has no meaningful value on its own, while the original data is securely stored separately and can be retrieved when authorised.

An assessment used to evaluate whether transferring personal data to another country could affect the level of protection required under applicable data protection law, and whether additional safeguards are needed. Under the GDPR, it is particularly relevant when using transfer mechanisms such as Standard Contractual Clauses.

The principle of providing individuals with clear, accessible, and understandable information about how their personal data is collected, used, shared, and otherwise processed.

The ability to demonstrate that an organisation meets applicable privacy and security requirements through documented controls, records, evidence, and traceable processes.

A security approach based on the principle that no user, device, application, or system should be trusted by default, with access continuously evaluated and granted based on verified identity, context, and required permissions.