General Data Protection Regulation: The General Data Protection Regulation (GDPR) (Regulation (EU)
2016/679) is a regulation by which the European Parliament, the Council of the European Union and the European Commission intend to strengthen and unify data protection for all individuals within the European Union (EU). It also addresses the export of personal data outside the EU.
Data Controller: the entity that determines the purposes, conditions and means of the processing of personal data.
Data Processor: the entity that processes data on behalf of the Data Controller.
Data Protection Authority: national authorities tasked with the protection of data and privacy as well as monitoring and enforcement of the data protection regulations within the Union.
Data Protection Officer (DPO): an expert on data privacy who works independently to ensure that an entity is adhering to the policies and procedures set forth in the GDPR.
Data subject: a natural person whose personal data is processed by a controller or processor.
Personal data: any information related to a natural person or ‘data subject’, that can be used to directly or indirectly identify the person.
Privacy Impact Assessment: a tool used to identify and reduce the privacy risks of entities by analysing the personal data that are processed and the policies in place to protect the data.
Processing: any operation performed on personal data, whether or not by automated means, including collection, use, recording, etc.
Profiling: any automated processing of personal data intended to evaluate, analyse, or predict data subject behaviour.
Regulation: a binding legislative act that must be applied in its entirety across the Union.
Subject Access Right: also known as the Right to Access, it entitles the data subject to have access to and information about the personal data that a controller has concerning them.