> Disclaimer: This content is for educational and reference purposes for software builders only. It does not constitute medical, legal, financial, or regulatory advice. Consult a qualified professional before making decisions based on this content.

General Data Protection Regulation - Regulation (EU) 2016/679 of the European Parliament and of the Council, applicable from 25 May 2018. The primary EU legal framework governing collection, processing, and transfer of personal data of individuals in the EU/EEA. (EUR-Lex 2016/679)

DPO

Data Protection Officer - a designated expert responsible for advising on GDPR compliance, monitoring adherence, conducting or overseeing DPIAs, and serving as the contact point for supervisory authorities and data subjects. Mandatory for certain controllers and processors. (GDPR Art. 37, EUR-Lex 2016/679)

DPIA

Data Protection Impact Assessment - a systematic analysis performed before high-risk processing operations to identify and mitigate privacy risks. Required when using new technologies, processing special category data at scale, or systematically monitoring publicly accessible areas. (GDPR Art. 35, EUR-Lex 2016/679)

DSAR

Data Subject Access Request - a formal request by an individual to exercise their right of access under GDPR Art. 15. Builders must implement workflows to authenticate the requester, compile responsive data, and deliver a response within one month.

RoPA

Record of Processing Activities - the mandatory written register of all personal data processing activities maintained by controllers (Art. 30(1)) and processors (Art. 30(2)). Typically implemented as a spreadsheet, database, or dedicated compliance tool.

DPA

Data Processing Agreement - the contractual instrument required by GDPR Art. 28 between a controller and any processor it engages. Also used as abbreviation for Data Protection Authority (supervisory authority) in some jurisdictions.

SCC

Standard Contractual Clauses - Commission-approved model clauses for international data transfers. The 2021 SCCs replaced the older 2001/2004/2010 sets and cover four transfer modules (C2C, C2P, P2P, P2C). (GDPR Art. 46(2)(c), EUR-Lex 2016/679)

BCR

Binding Corporate Rules - group-wide data protection policies approved by a lead supervisory authority for intra-group transfers to third countries. Require detailed submission to supervisory authorities and typically take 18–36 months to obtain approval. (GDPR Art. 47, EUR-Lex 2016/679)

EEA

European Economic Area - comprising the 27 EU member states plus Iceland, Liechtenstein, and Norway. GDPR applies throughout the EEA. Free flow of personal data within the EEA is guaranteed. (GDPR Art. 1(3), EUR-Lex 2016/679)

TIA

Transfer Impact Assessment - a document evaluating whether the law and practices of a third country destination undermine the data protection guarantees of the chosen transfer mechanism (SCC, BCR, etc.). Mandatory post-Schrems II (CJEU C-311/18).

CMP

Consent Management Platform - technical infrastructure for capturing, storing, updating, and propagating user consent signals. Must produce immutable, timestamped consent records that can be retrieved on demand for compliance audits.

IAB TCF

Interactive Advertising Bureau Transparency and Consent Framework - an industry-standard protocol for capturing and propagating consent signals in the digital advertising supply chain. TCF v2.2 is the current version; compliance is commonly required for publishers and ad-tech vendors.

PbD

Privacy by Design - the engineering practice of building data protection principles (minimisation, purpose limitation, security) directly into system architecture and data flows from the start, rather than as an afterthought. Codified as a legal obligation in GDPR Art. 25.

PbDf

Privacy by Default - the obligation that by default only personal data necessary for each specific purpose is processed (pre-ticked consent boxes violate this principle; marketing opt-ins must be unchecked by default). Part of the Art. 25 Privacy by Design and Default obligation.

LIA

Legitimate Interests Assessment - a three-part balancing test documenting: (1) the legitimate interest pursued; (2) necessity of the processing; (3) balance against data subjects' interests, rights, and freedoms. Required before relying on legitimate interests as a lawful basis. Not a substitute for consent when the subject would not reasonably expect the processing.

SAR

Subject Access Request - another term for DSAR. Some organisations distinguish SAR (internal/HR contexts) from DSAR (external/customer contexts) but the GDPR right is the same.

PHI

Protected Health Information - a US HIPAA term. In GDPR contexts, health data is classified as special category data under Art. 9. Builders integrating US and EU health data systems must handle both regimes simultaneously.

EDPB

European Data Protection Board - the independent EU body comprising heads of all national supervisory authorities and the European Data Protection Supervisor. Issues binding decisions in cross-border disputes and non-binding guidelines, recommendations, and best practice documents. (GDPR Art. 68, EUR-Lex 2016/679)

EDPS

European Data Protection Supervisor - the independent supervisory authority for EU institutions, bodies, offices, and agencies. Also has an advisory role on legislative proposals and participates in the EDPB.

OBA

Online Behavioural Advertising - targeted advertising based on profiles built from tracking user behaviour. Requires valid consent under GDPR (and ePrivacy Directive for cookie placement). Builders implementing ad-tech must wire consent signals through to the DSP/SSP chain.

DSR

Data Subject Request - generic term covering the full set of data subject rights requests: access (SAR), erasure, rectification, restriction, portability, objection, and rights related to automated decision-making.

The right to erasure article ("right to be forgotten") - specifies the six grounds on which erasure must be carried out, plus the three exceptions (freedom of expression, legal obligation, public health, archiving/research/statistics, legal claims). (EUR-Lex 2016/679)

The administrative fines article. Tier 1: up to €10 million or 2% of global annual turnover (whichever is higher) for processor obligations, DPO obligations, certification bodies. Tier 2: up to €20 million or 4% of global annual turnover for core principles violations, data subject rights, international transfers. (EUR-Lex 2016/679)

The security of processing article, requiring controllers and processors to implement appropriate technical and organisational measures (TOMs) considering state of the art, cost, nature, scope, context, purposes, and risks. Lists encryption, pseudonymisation, confidentiality/integrity/availability/resilience, backup/restoration ability, and regular testing as exemplar measures. (EUR-Lex 2016/679)

OSS / One-Stop-Shop

The One-Stop-Shop mechanism - the principle that a controller or processor with establishments in multiple EU member states deals primarily with the lead supervisory authority in the member state of its main establishment. Simplifies cross-border compliance by centralising enforcement. Supervisory authorities of other concerned member states remain involved as "concerned authorities". (GDPR Art. 56, EUR-Lex 2016/679)

GDPR

DPO