Published on 4 May 2016, the GDPR (General Data Protection Regulation) requires rules to be implemented within companies and public entities. This regulation, which aims to guarantee the privacy of the data of European Union citizens, is a complex document that becomes legally binding from 25 May 2018.

Below are some of the terms included in the new regulation and what they mean.

GDPR Glossary: General Data Protection Regulation

Accountability

Requires a compliance programme to be implemented that is capable of monitoring compliance across the whole organisation and demonstrating to data protection authorities and data subjects that all this personal information is secure.

Data Subject Consent

Any freely given, specific, informed and explicit indication of wishes by which the data subject agrees, by a statement or by a clear affirmative action, to the processing of their personal data.

Personal Data

Any information, of any nature and regardless of its medium, including sound and image, relating to an identified or identifiable natural person ("data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number or one or more factors specific to their physical, physiological, mental, economic, cultural or social identity.

Recipient

A natural or legal person, public authority, agency or any other body to which personal data is disclosed, whether or not it is a third party.

Data Protection Officer ("DPO")

A person appointed by the organisation who will be involved in all matters relating to the protection of personal data. This role must be assigned whenever processing is carried out by a public authority; where there is regular monitoring of individuals on a large scale; or where sensitive data is processed on a large scale. The main duties of the data protection officer involve informing and advising the company on data protection compliance; advising on data protection impact assessments; monitoring data protection compliance, which includes, for example, training staff and carrying out audits in this area; and cooperating with and acting as the point of contact for data protection authorities.

Restriction of Processing

The marking of stored personal data with the aim of limiting its processing in the future.

Data Minimisation ("Data Minimisation")

Means that the personal data collected must be limited to what is necessary in relation to the purposes for which it is processed.

Objection to Profiling

Data subjects have the right to object to the use of profiling, that is, any automated form of processing of personal information aimed at evaluating and categorising individuals based on their personal data.

Privacy from the design stage ("Privacy by Design")

Means taking privacy risk into account throughout the entire design process of a new product or service, rather than considering privacy issues only afterwards. This means carefully assessing and implementing appropriate technical and organisational measures and procedures from the outset to ensure that processing complies with the GDPR and protects the rights of the data subjects concerned.

Privacy by default ("Privacy by Default")

Means ensuring that mechanisms are put in place within an organisation to guarantee that, by default, only the necessary amount of personal data is collected, used and retained for each task. This obligation applies to the extent of its processing, the retention period and its accessibility. These measures ensure that personal data is not made available, without human intervention, to an indefinite number of natural persons.

Privacy Impact Assessments

Allow the organisation to find problems in the early stages of any project, reducing the associated costs and the reputational damage that could accompany a breach of data protection laws and regulations.

Pseudonymisation

The processing of personal data in such a way that it can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data cannot be attributed to an identified or identifiable natural person.

Personal Data Controller 

The natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Processor ("Data Processor")

The natural or legal person, public authority, agency or any other body that processes personal data on behalf of the controller.

Processing of Personal Data

Any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, as well as restriction, erasure or destruction.

Third Party

A natural or legal person, public authority, agency or any other body other than the data subject, the controller, the processor or any other person under the direct authority of the controller or processor, who is authorised to process the data.

Personal Data Breach

A breach of security leading to the accidental or unlawful destruction, loss, alteration, disclosure of, or unauthorised access to, personal data transmitted, stored or otherwise processed.

Security Breach (Security Incidents)

An event with a real adverse effect on the security of networks and information systems, such as unauthorised access to the info system 

Find out more about the new general data protection regulation with the eBook "GDPR - The Essential Guide".

Written by:
Openlimits

Tell us what you think