📖 Glossary
Glossary
Privacy & AI governance terms, in plain language.
- Personal data
- Any information relating to an identified or identifiable individual — a name, email, device ID, location, and more.
- Data Principal / Data Subject
- The individual the personal data is about. “Data Principal” is the DPDPA term; “Data Subject” is the GDPR term.
- Data Fiduciary / Controller
- The entity that decides why and how personal data is processed. “Fiduciary” (DPDPA) ≈ “Controller” (GDPR).
- Data Processor
- An entity that processes personal data on behalf of, and on the instructions of, the controller/fiduciary.
- Consent
- A freely given, specific, informed and unambiguous indication of a data principal’s agreement to processing.
- Legal / Lawful basis
- The legal ground that makes processing permissible — e.g. consent, contract, legal obligation or legitimate use.
- Sensitive / Special-category data
- Data needing extra protection — health, biometrics, children’s data, financial, religious or political data.
- DPIA
- Data Protection Impact Assessment — a structured review of privacy risk for high-risk processing.
- RoPA
- Records of Processing Activities — an inventory of what data you process, why, and with whom.
- DPA
- Data Processing Agreement — the contract governing a processor’s handling of personal data (GDPR Art. 28).
- Data principal rights (DSR)
- Rights individuals can exercise — access, correction, erasure, portability and grievance redressal.
- Personal data breach
- A security incident leading to unauthorised access, disclosure, alteration or loss of personal data.
- Cross-border transfer
- Moving personal data outside its origin jurisdiction, which usually needs a valid transfer mechanism.
- DPO
- Data Protection Officer — the person accountable for the organisation’s privacy compliance.
- Purpose limitation
- Personal data may only be used for the specific purposes for which it was collected.
- Data minimisation
- Collect and keep only the personal data you actually need for the stated purpose.
- Retention
- How long personal data is kept — it should be deleted once its purpose is fulfilled.
- NIST CSF
- The NIST Cybersecurity Framework — six functions (Govern, Identify, Protect, Detect, Respond, Recover) for security posture.
- EU AI Act
- The EU regulation governing AI systems by risk tier, from prohibited uses to high-risk obligations.
- CERT-In
- India’s Computer Emergency Response Team — requires reporting certain cyber incidents within 6 hours.
Want this done for you?
PrivacyOS turns these into a live, audit-ready program. See it in a 20-minute demo.
Book a demo
Free assessment