Privacy and GDPR glossary: 40+ terms in plain English

By the Privacyboard teamPublished 16 October 2026Updated 4 November 202610 min read

Short answer

This glossary defines over 40 privacy terms in one or two sentences each, with the GDPR article or source where it applies. It covers roles (controller, processor), legal bases, rights, transfers, cookies and consent tools, and US terms such as CCPA, sale and sharing, and GPC.

Privacy law has its own vocabulary, and several terms have two meanings. "DPA" can be a contract or an authority, and "personal data" is not the same as "PII". This glossary explains the terms you will meet in the GDPR, the ePrivacy rules and US privacy laws, in plain English and in alphabetical order.

The definitions are summaries to help you read the law, not legal advice. Where a term comes from a specific article, the article is named, so you can check the exact wording. For a shorter list of the terms used in the Privacyboard product, see the documentation glossary.

#A–D

Adequacy decision. A decision by the European Commission that a non-EU country, territory or sector ensures an adequate level of data protection, so personal data can be sent there without further safeguards (GDPR Article 45). See international data transfers.

Anonymisation. Processing data so that the person is not, or is no longer, identifiable. Truly anonymous information is outside the GDPR (Recital 26), but identifiability is judged by all the means reasonably likely to be used, so removing a name is often not enough.

Automated decision-making. A decision taken only by automated means, including profiling, that has legal effects on a person or similarly significantly affects them. People have the right not to be subject to it, with exceptions and safeguards such as human review (Article 22).

Binding corporate rules (BCRs). Internal data protection rules, approved by a supervisory authority, that let a group of companies transfer personal data outside the EEA within the group (Articles 46(2)(b) and 47).

CCPA and CPRA. The California Consumer Privacy Act, as amended by the California Privacy Rights Act (Proposition 24, approved in November 2020, in effect from 1 January 2023). It gives California residents rights to know, delete, correct, opt out of the sale or sharing of their data and limit the use of sensitive data. See GDPR vs CCPA/CPRA.

Consent. A freely given, specific, informed and unambiguous indication of a person's wishes, by a statement or a clear affirmative action (Article 4(11)). You must be able to prove it and withdrawing must be as easy as giving it (Article 7). See cookie consent requirements.

Consent Mode. A Google feature that passes a visitor's consent choices to Google tags so they adjust their behaviour. Version 2 added the ad_user_data and ad_personalization signals next to ad_storage and analytics_storage. It does not store the choice itself. See Consent Mode v2 explained.

Consent management platform (CMP). The tool that shows the cookie banner, records the visitor's choices and tells your site and tags what is allowed to run.

Controller. The organisation that, alone or with others, decides why and how personal data is processed (Article 4(7)). Controllers carry most of the GDPR's obligations. See the checklist for small businesses.

Cookie. A small file that a website stores on a visitor's device. Under Article 5(3) of the ePrivacy Directive, cookies and similar technologies need consent unless they are strictly necessary for a service the user requested. See how to find every cookie on your site.

Data minimisation. The principle that personal data must be adequate, relevant and limited to what is necessary for the purposes (Article 5(1)(c)).

Data Privacy Framework (DPF). The EU–US framework under which certified US companies can receive personal data from the EU. The Commission adopted its adequacy decision on 10 July 2023. Its validity has been challenged in court, so check its current status before relying on it.

Data processing agreement (DPA). The contract between a controller and a processor required by Article 28(3). It sets the subject matter, duration, type of data, instructions, security, sub-processor rules, assistance and deletion or return of data. See data processing agreements explained.

Data protection authority (DPA). Another name for a supervisory authority. Context tells you whether "DPA" means this or the contract above.

Data protection by design and by default. Building data protection into systems from the start, for example through pseudonymisation and data minimisation (Article 25(1)), and making sure that by default only the data necessary for each purpose is processed (Article 25(2)). Often called privacy by design and by default.

Data protection impact assessment (DPIA). A written assessment of the risks of a planned processing, required before processing likely to result in a high risk, such as large-scale processing of sensitive data (Article 35).

Data protection officer (DPO). A person who advises the organisation on data protection. Appointing one is mandatory for public bodies, for large-scale regular and systematic monitoring, and for large-scale processing of sensitive or criminal-offence data (Article 37(1)). Other organisations may appoint one voluntarily.

Data subject. The person the personal data is about.

Data subject access request (DSAR). A request by a person to access their personal data, based on Article 15. People also use "DSAR" for requests under other rights. See how to respond to a DSAR.

#E–L

EEA. The European Economic Area: the EU member states plus Iceland, Liechtenstein and Norway. The GDPR applies across it.

ePrivacy Directive. Directive 2002/58/EC, which covers the confidentiality of electronic communications and, in Article 5(3), the storing of or access to information on a user's device, which is the basis of cookie consent rules.

Erasure, right to. The right to have personal data deleted without undue delay when, for example, it is no longer needed, consent is withdrawn or the data was processed unlawfully (Article 17). Exceptions include a legal obligation to keep the data and legal claims (Article 17(3)).

Global Privacy Control (GPC). A browser signal, sent as the Sec-GPC: 1 header and readable as navigator.globalPrivacyControl, that tells websites a user wants to opt out of the sale or sharing of their data. The specification is a W3C Working Draft, and California treats the signal as a valid opt-out request. See Global Privacy Control explained.

Joint controllers. Two or more controllers that jointly decide the purposes and means of processing. They must set out their respective responsibilities in an arrangement, and people can exercise their rights against each of them (Article 26).

Lawful basis (legal basis). The reason that makes processing lawful. Article 6(1) lists six: consent, contract, legal obligation, vital interests, public task and legitimate interests. You need at least one for each purpose, and you must tell people which. See what to include in a privacy policy.

Legitimate interests. A lawful basis for processing that serves your or a third party's legitimate interests, unless those are overridden by the person's interests or rights, especially a child's (Article 6(1)(f)). It requires a balancing test, and public authorities cannot use it for their tasks.

#M–R

Objection, right to. The right to object at any time to processing based on public interest or legitimate interests (Article 21(1)), and the right to object to direct marketing, which you must then stop (Article 21(2) and (3)).

One-stop-shop. The mechanism by which a company with cross-border processing in the EU deals mainly with one lead supervisory authority, that of its main establishment, which is its sole interlocutor for that processing (Article 56).

Personal data. Any information relating to an identified or identifiable natural person, such as a name, an identification number, location data or an online identifier (Article 4(1)).

Personal data breach. A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Article 4(12)). See the 72-hour rule.

Personally identifiable information (PII). A US term whose meaning varies between laws and agencies, often focused on direct identifiers such as name or Social Security number. "Personal data" under the GDPR is broader and includes online identifiers.

Portability, right to. The right to receive the personal data you provided in a structured, commonly used and machine-readable format and to transmit it to another controller. It applies when processing is based on consent or a contract and is automated (Article 20).

Processing. Any operation on personal data, whether automated or not: collecting, recording, storing, using, sharing, restricting, deleting (Article 4(2)).

Processor. An organisation that processes personal data on behalf of a controller (Article 4(8)). It must act only on documented instructions and be bound by a contract (Article 28).

Profiling. Automated processing of personal data to evaluate personal aspects, such as work performance, finances, health, preferences, behaviour or location (Article 4(4)).

Pseudonymisation. Processing personal data so it can no longer be attributed to a person without additional information that is kept separately and protected (Article 4(5)). Pseudonymised data is still personal data, unlike anonymised data (Recital 26).

Rectification, right to. The right to have inaccurate personal data corrected and incomplete data completed (Article 16).

Record of processing activities (ROPA). The internal record of your processing described in Article 30: purposes, categories of data and people, recipients, transfers, retention and security. Organisations with fewer than 250 people are exempt unless the processing is risky, not occasional or includes sensitive data (Article 30(5)). See the ROPA guide.

Restriction of processing, right to. The right to have stored data marked so that it is only stored and not otherwise used, for example while its accuracy is contested (Article 18).

Right of access. The right to confirmation of whether your data is processed, a copy of it and the information listed in Article 15, such as purposes, recipients, retention and source.

#S–Z

Sale and sharing of personal information. Two CCPA terms. "Selling" is disclosing personal information to a third party for monetary or other valuable consideration. "Sharing" is disclosing it for cross-context behavioural advertising, whether or not money changes hands (California Civil Code 1798.140). Consumers can opt out of both.

Special category data. Sensitive data subject to stricter rules: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, health data and data about sex life or sexual orientation (Article 9(1)).

Standard contractual clauses (SCCs). Standard data protection clauses adopted by the European Commission that, when signed, provide appropriate safeguards for transfers of personal data outside the EEA (Article 46(2)(c)). See SCCs and the Data Privacy Framework.

Storage limitation. The principle that personal data must be kept in identifiable form no longer than necessary for the purposes (Article 5(1)(e)).

Sub-processor. A provider engaged by a processor to carry out part of the processing. The processor needs the controller's prior authorisation, specific or general, and must pass on the same obligations by contract (Article 28(2) and (4)).

Supervisory authority. The independent public authority that each EU member state sets up to monitor the GDPR, such as the CNIL in France (Articles 4(21) and 51). People have the right to complain to it.

Third country. A country outside the EEA. Sending personal data there is a transfer that needs an adequacy decision, safeguards or another basis (Articles 44 to 49).

Tracking pixel. A tiny image or request embedded in a page or email that reports a visit or an open to another company. The EDPB confirms that tracking pixels fall under Article 5(3) of the ePrivacy Directive.

Transfer. Making personal data available to an organisation in a third country. Transfers are regulated by Articles 44 to 49.

#FAQ

#What is the difference between a controller and a processor?

A controller decides why and how personal data is used. A processor handles it on the controller's behalf and only on its documented instructions. The same company can be a controller for some data and a processor for other data, and a contract under Article 28 must govern the relationship.

#Is "PII" the same as "personal data"?

No. PII is a US term whose meaning varies between laws, while "personal data" is the GDPR's broader concept covering any information relating to an identifiable person, including online identifiers. Data can be personal data under the GDPR without being PII under a US law.

#Is pseudonymised data still personal data?

Yes. Pseudonymised data can be linked back to a person with additional information, so the GDPR still applies to it (Recital 26). Only data that is truly anonymous, where the person is not or no longer identifiable, falls outside the GDPR.

#What does DPA stand for?

It has two common meanings. A data processing agreement is the contract between a controller and a processor under Article 28. A data protection authority is a supervisory authority, the public body that enforces the law. The context usually makes clear which one is meant.

Only in the cases listed in Article 37(1): public bodies, large-scale regular and systematic monitoring, and large-scale processing of sensitive or criminal-offence data. Most small businesses are not required to appoint one.

#Sources

Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to antoine@unmake.io.