Glossary of GDPR terms

Short definitions of the terms you will meet in Privacyboard. They are summaries, not legal advice.

Consent. A freely given, specific, informed and unambiguous indication of a person's wishes, given by a statement or a clear affirmative action. It must be as easy to withdraw as to give (GDPR Articles 4(11) and 7).

Controller. The organisation that decides why and how personal data is processed.

Cookie. A small file a website stores on a visitor's device. Cookies and similar technologies that are not strictly necessary generally need consent under the ePrivacy rules.

Data Privacy Framework (DPF). The EU–US framework under which certified US companies can receive personal data from the EU.

Data processing agreement (DPA). The contract between a controller and a processor required by Article 28.

Data subject. The person the personal data is about.

Data subject request (DSAR). A person using one of their rights, such as access, erasure or objection. "DSAR" often means an access request.

EEA. The European Economic Area: EU member states plus Iceland, Liechtenstein and Norway.

ePrivacy Directive. The EU rules on confidentiality of communications and on storing or reading information on a device, including cookies.

GDPR. The General Data Protection Regulation (EU) 2016/679.

Joint controllers. Two organisations that decide together why and how data is processed (Article 26).

Legal basis. The reason that makes processing lawful: consent, contract, legal obligation, vital interests, public task or legitimate interests (Article 6).

Personal data. Any information relating to an identified or identifiable person.

Privacy center. A public page where a company shows its privacy documents, vendors and a request form.

Privacy policy. The document in which an organisation tells people how it handles their personal data (Articles 13 and 14).

Processor. An organisation that processes personal data on behalf of a controller.

Processing. Anything done with personal data: collecting, storing, using, sharing or deleting it.

Record of processing activities (ROPA). The internal record described in Article 30.

Retention. How long personal data is kept.

Special categories of data. Sensitive data such as health, beliefs or biometric data, with stricter rules (Article 9).

Standard contractual clauses (SCC). Contract terms approved by the European Commission for transfers of personal data outside the EEA.

Subprocessor. A provider that a processor uses to process personal data.

Transfer. Making personal data available to an organisation in a country outside the EEA (Articles 44 to 49).

#FAQ

#What is the difference between a controller and a processor?

A controller decides why and how data is used. A processor only acts on the controller's documented instructions. The same company can be a controller for some data and a processor for other data.

#What is a legal basis?

The reason that makes your use of personal data lawful, for example performance of a contract or consent. Each processing activity needs one.