Your Handy Guide to GDPR Jargon – Demystified - Privacy law & cybersecurity trainer

Navigating the labyrinthine language of the GDPR can seem like a Herculean task. Don’t worry, I’m here to lend a hand. In this post, I’ll simplify, and translate into layman’s language, some of the most used GDPR terms.

1. Binding Corporate Rules (BCR)

Picture a multinational company, its offices dotting the globe. Binding Corporate Rules are like a company’s promise to itself – a set of guidelines that govern how personal data is moved within the company, especially to branches in countries with less stringent data protection laws.

2. Consent

This is a straightforward one. Consent means you’ve given your clear and informed permission for your personal data to be used. Picture ticking a checkbox on a website, agreeing to their terms – that’s you giving your consent.

3. Cross-border Data Transfers

This term refers to the action of moving personal data from one country to another. Under the GDPR, this is a tightly monitored process. It’s akin to moving physical goods through customs.

4. Data Breach

A data breach is a digital equivalent of a break-in. It’s when personal data gets accessed, disclosed, altered or destroyed without authorisation, whether accidentally or intentionally.

5. Data Controller

Picture a puppet master controlling the strings. A Data Controller is the entity pulling the strings – deciding how and why personal data is processed.

6. Data Processor

The data processor, on the other hand, is the entity that does the actual processing of the data, at the direction of the controller. Think of a company you’ve given consent to, using your data as per the guidelines.

7. Data Protection Impact Assessment (DPIA)

This is essentially a risk assessment carried out before processing personal data. It aims to identify and minimise any risks to individuals’ rights and freedoms resulting from data processing.

8. Data Protection Officer (DPO)

The DPO is like a school principal but for data protection within a company. They ensure the organisation stays in line with GDPR rules.

9. Data Subject

In simple terms, a Data Subject is you or I. It’s any individual whose personal data is being processed.

10. Lawfulness, Fairness, and Transparency

This GDPR principle demands that any processing of personal data should be lawful, fair, and transparent. It’s about treating people’s data with respect and openness.

11. Legitimate Interest

This is a reason used to justify the processing of personal data. It’s like saying, “We need to process this data for reasons X, Y and Z, and these reasons don’t harm your rights or freedoms”.

12. Personal Data

This is any information that can be used to identify a person – your name, email address, phone number and so forth.

13. Privacy by Design

This is the idea of incorporating privacy considerations into a service or process right from the design stage. It’s like designing a house with locks on the doors and curtains on the windows for privacy.

14. Privacy Impact Assessment (PIA)

This is an analysis of how an organisation collects, uses, shares, and maintains personally identifiable information. It’s a bit like a privacy audit.

15. Profiling

Profiling involves using automated processes to analyse or predict aspects of an individual’s life, such as work performance or personal preferences. It’s a bit like a digital crystal ball.

16. Pseudonymisation

This is about replacing identifiable data with pseudonyms or artificial identifiers to protect people’s privacy. Think of it as giving everyone a code name to hide their real identity.

17. Purpose Limitation

This principle says personal data should be collected for specific and legitimate reasons and should not be used in a way that is incompatible with these purposes. It’s like being given a tool for a specific job and using it only for that job.

18. Right to Erasure

Also known as the ‘Right to be Forgotten’, it gives individuals the right to request the deletion of their personal data under certain conditions. It’s like asking for your digital slate to be wiped clean.

19. Supervisory Authority

This is a public body set up by each Member State under Article 51 of the GDPR. It’s the data protection equivalent of a watchdog.

20. Sensitive Personal Data

These are categories of personal data that are seen as particularly private or sensitive, such as racial or ethnic origin, political opinions, health data, and data concerning a person’s sex life or sexual orientation.

Your Handy Guide to GDPR Jargon – Demystified