> Disclaimer: This content is for educational and reference purposes for software builders only. It does not constitute medical, legal, financial, or regulatory advice. Consult a qualified professional before making decisions based on this content.
Personal Data
Any information relating to an identified or identifiable natural person (the "data subject"). Identifiability may be direct (name, ID number) or indirect (location data, online identifiers, factors specific to physical, physiological, genetic, mental, economic, cultural, or social identity). Pseudonymous data remains personal data if re-identification is reasonably possible. (GDPR Art. 4(1), EUR-Lex 2016/679)
Data Subject
The natural person whose personal data is processed. Data subjects hold the rights defined in Chapter III of GDPR: access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making. Builders must implement technical mechanisms that allow the system to receive, authenticate, and fulfil these requests within statutory deadlines. (GDPR Art. 4(1), EUR-Lex 2016/679)
Controller
The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data. Builders implementing SaaS products for enterprise clients typically find the enterprise is the controller; the SaaS vendor is the processor. Controllers bear the primary compliance obligation. (GDPR Art. 4(7), EUR-Lex 2016/679)
Processor
A natural or legal person that processes personal data on behalf of the controller. Cloud service providers, analytics vendors, and email delivery services are common processors. The controller must bind the processor by a Data Processing Agreement (DPA) specifying the subject matter, duration, nature, purpose, categories of data, and obligations. (GDPR Art. 4(8), EUR-Lex 2016/679)
Sub-processor
A third party engaged by the processor to carry out specific processing activities on behalf of the controller. The processor must inform the controller of intended sub-processor changes and give the controller opportunity to object. DPAs must include a clause flowing down obligations to any sub-processors. (GDPR Art. 28(2), EUR-Lex 2016/679)
Processing
Any operation or set of operations performed on personal data, whether automated or not: collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction. Builders must ensure every processing operation has a documented lawful basis. (GDPR Art. 4(2), EUR-Lex 2016/679)
Lawful Basis
One of the six legal grounds that must exist before personal data may be processed: consent, contract performance, legal obligation, vital interests, public task, or legitimate interests. Controllers must identify and document the lawful basis for each distinct processing activity before processing begins. (GDPR Art. 6(1), EUR-Lex 2016/679)
Consent
Freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they signify agreement to processing. Consent must be distinguishable from other matters, as intelligible and accessible language, and must be as easy to withdraw as to give. Pre-ticked boxes do not constitute consent. (GDPR Art. 4(11), EUR-Lex 2016/679)
Special Category Data
Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership; genetic data; biometric data processed for unique identification; health data; sex life or sexual orientation data. Processing is prohibited unless a specific exemption in Art. 9(2) applies. Builders must implement heightened technical and organisational measures for this data class. (GDPR Art. 9(1), EUR-Lex 2016/679)
Data Protection by Design and by Default
The obligation to implement appropriate technical and organisational measures - both at the time of determining the means of processing and at the time of processing itself - to ensure data protection principles are integrated into processing activities. "By default" means only data necessary for the specific purpose is processed by default. (GDPR Art. 25, EUR-Lex 2016/679)
Data Protection Officer (DPO)
A designated person responsible for informing and advising the controller or processor of their GDPR obligations, monitoring compliance, providing advice on DPIAs, cooperating with the supervisory authority, and acting as contact point. Mandatory for public bodies, and organisations whose core activities involve large-scale systematic monitoring or large-scale processing of special category data. (GDPR Art. 37, EUR-Lex 2016/679)
Data Protection Impact Assessment (DPIA)
A systematic process for identifying and minimising privacy risks of processing activities that are likely to result in high risk to natural persons. Required before commencing processing when new technologies are used, large-scale processing of special category data, systematic monitoring, or when the supervisory authority's list of mandatory DPIA activities is triggered. (GDPR Art. 35, EUR-Lex 2016/679)
Record of Processing Activities (RoPA)
Written records that controllers (with ≥250 employees, or whose processing is not occasional, poses high risk, or involves special category data) must maintain describing: controller identity, processing purposes, data subject categories, data categories, recipient categories, transfers, retention periods, and technical/organisational measures. (GDPR Art. 30, EUR-Lex 2016/679)
Data Breach
A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Breaches must be assessed for risk; likely-harm breaches must be notified to the supervisory authority within 72 hours of becoming aware; breaches likely resulting in high risk to individuals must also be communicated to those individuals. (GDPR Art. 4(12), EUR-Lex 2016/679)
Supervisory Authority
An independent public authority established by each EU member state to monitor GDPR application, handle complaints, conduct investigations, and issue corrective measures including fines. Controllers and processors must cooperate with supervisory authorities and, in cross-border cases, work through the lead supervisory authority under the One-Stop-Shop mechanism. (GDPR Art. 4(21), EUR-Lex 2016/679)
Data Subject Access Request (DSAR)
A formal request by a data subject to obtain confirmation of whether personal data concerning them is being processed, and if so, a copy of that data along with supplementary information. Controllers must respond without undue delay and at the latest within one month, with a possible two-month extension for complex or numerous requests. (GDPR Art. 15, EUR-Lex 2016/679)
Right to Erasure (Right to be Forgotten)
The right of a data subject to obtain erasure of their personal data without undue delay when data is no longer necessary, consent is withdrawn, data was unlawfully processed, or a legal obligation requires erasure. Must be balanced against legal holds, freedom of expression, and other legitimate retention grounds. (GDPR Art. 17, EUR-Lex 2016/679)
Right to Portability
The right of a data subject to receive personal data they provided to a controller in a structured, commonly used, machine-readable format, and to transmit that data to another controller without hindrance. Applies where processing is based on consent or a contract and is carried out by automated means. (GDPR Art. 20, EUR-Lex 2016/679)
Right to Restriction
The right of a data subject to obtain restriction of processing in specific circumstances: contested accuracy pending verification, unlawful processing where the subject opposes erasure, data no longer needed by the controller but required by the subject for legal claims, or objection pending verification of legitimate grounds. (GDPR Art. 18, EUR-Lex 2016/679)
Pseudonymisation
Processing personal data such that it can no longer be attributed to a specific data subject without additional information that is kept separately and subject to technical and organisational measures ensuring non-attribution. Pseudonymised data is still personal data but benefits from relaxed requirements in some areas (research, statistical analysis, profiling safeguards). (GDPR Art. 4(5), EUR-Lex 2016/679)
Anonymisation
The irreversible removal of identifying information such that re-identification is not reasonably possible considering all means likely to be used. Truly anonymised data falls outside GDPR scope. Builders must assess whether anonymisation is genuine given the state of the art in re-identification attacks (e.g., linkage attacks on quasi-identifiers). (GDPR Recital 26, EUR-Lex 2016/679)
Data Minimisation
The principle that personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. Builders must design data collection forms, API payloads, and storage schemas to capture only the minimum fields required, and resist "collect now, decide later" patterns. (GDPR Art. 5(1)(c), EUR-Lex 2016/679)
Purpose Limitation
The principle that personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. Downstream use of collected data (analytics, marketing, ML training) must be compatible with the original purpose or rest on a separate lawful basis. (GDPR Art. 5(1)(b), EUR-Lex 2016/679)
Storage Limitation
The principle that personal data must be kept in a form allowing identification of data subjects for no longer than necessary for the processing purposes. Systems must implement automated data retention schedules and deletion workflows keyed to the documented retention periods for each data category. (GDPR Art. 5(1)(e), EUR-Lex 2016/679)
Accuracy Principle
Personal data must be accurate and, where necessary, kept up to date; inaccurate data must be erased or rectified without delay. Builders must provide mechanisms for data subjects to update their data and for the system to propagate corrections to downstream copies (caches, replicas, backups). (GDPR Art. 5(1)(d), EUR-Lex 2016/679)
Integrity and Confidentiality (Security Principle)
Personal data must be processed in a manner ensuring appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures. This underpins the requirement for encryption, access control, and audit logging. (GDPR Art. 5(1)(f), EUR-Lex 2016/679)
Accountability Principle
The controller is responsible for and must be able to demonstrate compliance with all GDPR principles. Technical implementations of accountability include maintaining RoPA, DPIAs, consent records with audit trails, DPO appointment records, processor agreements, and breach registers. (GDPR Art. 5(2), EUR-Lex 2016/679)
Profiling
Any form of automated processing of personal data to evaluate personal aspects, in particular to analyse or predict aspects related to natural persons' performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements. Profiling used for decisions producing legal or similarly significant effects requires specific safeguards. (GDPR Art. 4(4), EUR-Lex 2016/679)
Automated Individual Decision-Making
Processing that produces decisions based solely on automated processing, including profiling, that significantly affects individuals. Data subjects have the right not to be subject to such decisions unless based on explicit consent, performance of a contract, or authorised by EU/member state law. Controllers must implement human review mechanisms on request. (GDPR Art. 22, EUR-Lex 2016/679)
Legitimate Interests
A lawful basis for processing where the controller or a third party has a genuine and legitimate interest and the processing is necessary for that interest, provided it does not override the interests or rights of the data subject. Builders must document a Legitimate Interests Assessment (LIA) balancing test before relying on this basis. (GDPR Art. 6(1)(f), EUR-Lex 2016/679)
Data Processing Agreement (DPA)
A contract required between controller and processor governing how the processor handles personal data on the controller's behalf. Must specify: subject matter and duration of processing, nature and purpose, type of personal data and categories of data subjects, obligations and rights of the controller. (GDPR Art. 28(3), EUR-Lex 2016/679)
Standard Contractual Clauses (SCCs)
Commission-approved model contract clauses for transferring personal data to third countries lacking an adequacy decision. Updated SCCs (2021) cover C2C, C2P, P2P, and P2C transfer scenarios. Builders must implement the correct module based on the nature of the transfer and may need to conduct a Transfer Impact Assessment. (GDPR Art. 46(2)(c), EUR-Lex 2016/679)
Adequacy Decision
A European Commission decision finding that a third country, territory, sector, or international organisation provides an adequate level of data protection equivalent to the EU. Personal data may flow to adequate countries without additional safeguards. Currently includes UK (post-Brexit), Switzerland, Japan, New Zealand, Israel, Canada (commercial), South Korea. (GDPR Art. 45, EUR-Lex 2016/679)
Binding Corporate Rules (BCRs)
Personal data protection policies approved by a competent supervisory authority for transfers of personal data from an EU controller or processor to controllers, processors, or recipients in the same corporate group in third countries. BCRs require supervisory authority approval and are typically used by large multinationals. (GDPR Art. 46(2)(b), EUR-Lex 2016/679)
Consent Management Platform (CMP)
A technical infrastructure for collecting, recording, and managing user consents. Builders implementing CMPs must ensure: granular per-purpose consent signals, timestamped immutable consent records, withdrawal mechanisms, and propagation of consent state to downstream processing systems. IAB TCF v2.2 is a common framework for consent in the ad-tech context.
Breach Register
An internal log of all personal data breaches, regardless of whether they meet the threshold for supervisory authority notification. Must record: breach description, effects, and remedial action taken. Enables post-incident trend analysis and demonstrates compliance with accountability obligations. (GDPR Art. 33(5), EUR-Lex 2016/679)
Retention Schedule
A documented policy defining the period for which each category of personal data is retained, the legal justification for that period, and the disposal action on expiry (deletion, anonymisation, archiving). Must be reviewed periodically and implemented through automated deletion or flagging workflows in production systems.
Right to Object
The right of a data subject to object, on grounds relating to their particular situation, at any time to processing based on legitimate interests or a public task, including profiling. The controller must cease processing unless it demonstrates compelling legitimate grounds that override the subject's interests. For direct marketing, the right to object is absolute. (GDPR Art. 21, EUR-Lex 2016/679)
Transfer Impact Assessment (TIA)
An evaluation required when transferring personal data to a third country using SCCs, BCRs, or other appropriate safeguards, assessing whether the legal framework in the destination country may prevent the data importer from fulfilling its contractual obligations. Became mandatory following the Schrems II CJEU ruling.
Joint Controllers
Two or more controllers that jointly determine the purposes and means of processing. Must arrange in a transparent manner how they will fulfil their GDPR obligations, particularly regarding data subject rights. The essence of the arrangement must be accessible to data subjects. (GDPR Art. 26, EUR-Lex 2016/679)
Supervisory Authority Lead
In cross-border processing scenarios, the supervisory authority of the controller's or processor's main establishment, which acts as the lead authority through the One-Stop-Shop mechanism. Other concerned authorities may raise objections; unresolved disputes go to the European Data Protection Board. (GDPR Art. 56, EUR-Lex 2016/679)
Data Protection Seal
A certification mechanism to demonstrate GDPR compliance. Seals and marks are granted by accredited certification bodies for a maximum of three years and may be renewed. They do not reduce the controller's or processor's responsibility for compliance but serve as evidence of appropriate technical/organisational measures. (GDPR Art. 42, EUR-Lex 2016/679)
Sensitive Processing
Processing of special category data or criminal conviction/offences data, subject to stricter rules than standard personal data. Builders must implement extra safeguards: explicit consent (Art. 9(2)(a)), necessary for health treatment (Art. 9(2)(h)), employment law obligations (Art. 9(2)(b)), and others. Access control must be role-restricted.
Transparency
The obligation to provide data subjects with clear, concise, transparent, and intelligible information about processing at the time of data collection or first contact. Privacy notices must be layered (short/long form), use plain language, and cover all elements required by Art. 13/14. (GDPR Art. 5(1)(a), EUR-Lex 2016/679)
Erasure Cascade
The technical process of propagating a right-to-erasure request across all systems holding the subject's personal data: primary database, backups, caches, CDN edge copies, search indexes, analytics datasets, and data shared with processors. Builders must design data flows to enable traceable, complete erasure propagation.