Glossary
Working definitions for orientation. Where a term is defined in law, the instrument page is the authority — the statutory definition governs, and it is often narrower than the everyday sense of the word.
A
- Adequacy decision
- A finding that a country protects data essentially as well as the EU (or UK), so transfers flow without further safeguards. Defined in: GDPR Art 45; UK GDPR Art 45 (as amended by DUAA 2025); DPA 2018
- Annulled
- Set aside by a court, so it no longer has legal effect. A penalty can be annulled while the underlying finding of infringement stands — as happened to the Amazon fine in Luxembourg.
B
- Binding corporate rules (BCRs)
- Regulator-approved internal rules letting a multinational group move data inside the group across borders. Defined in: GDPR Art 47; UK GDPR Art 47; DPA 2018
- Breach notification
- The duty to report qualifying security breaches to the regulator — 72 hours in GDPR-family laws — and often to affected people. Defined in: GDPR Arts 33-34; UK GDPR Arts 33-34; DPA 2018; PECR reg 5A (ECS providers)
C
- Commencement
- The date a provision actually takes legal effect, which is often later than the date the Act passed — and different provisions of one Act frequently commence on different dates.
- Controller
- Decides why and how personal data is processed. Carries most of the duties — and the fines. Defined in: GDPR Art 4(7); UK GDPR Art 4(7); DPA 2018 s.6
- Criminal liability
- Prosecution in the criminal courts, separate from a regulator's fine. Different prosecutor, different standard of proof, and it can attach to an individual rather than the organisation.
- Cure period
- A window in which a business can fix a violation after notice and avoid enforcement. Common in US state privacy acts, and several states have now let theirs expire.
D
- Data localisation
- Genuinely jargon in the EU/UK context — the GDPR does not use or define "data localisation"; it is a policy term for requirements (found in e.g. Russia's 152-FZ, China's PIPL/DSL, Kazakhstan, India sectoral rules) to store/process data within national borders. definedIn left empty deliberately. Defined in: Not defined in the GDPR/UK GDPR
- Data protection officer (DPO)
- A statutorily protected adviser who monitors compliance and liaises with the regulator; mandatory in defined cases. Defined in: GDPR Arts 37-39; UK GDPR Arts 37-39
- Derogation
- A permitted departure from a rule. The GDPR's opening clauses let member states legislate nationally in defined areas, so national acts are derogations from a shared text rather than independent statutes.
- Determines the purposes
- The test that separates a controller from a processor: who decides WHY the processing happens. Not who holds the data, who is larger, or what the contract calls them.
- DPIA
- A structured risk assessment required before high-risk processing — new technologies, large-scale monitoring, sensitive data at scale. Defined in: GDPR Art 35; UK GDPR Art 35
I
- Indictable offence
- A more serious offence triable in the higher courts, usually carrying higher maximum penalties than a summary offence.
L
- Legitimate interests
- Update: DUAA 2025 introduced a "recognised legitimate interests" list in UK law (in force 2026-02-05) that removes the balancing test for specified purposes; the general Art 6(1)(f) balancing basis is otherwise unchanged. Defined in: GDPR Art 6(1)(f); UK GDPR Art 6(1)(f) — plus new "recognised legitimate interests" under DUAA 2025
- Lex specialis
- A specific rule that prevails over a general one on the same subject. PECR is lex specialis to the UK GDPR for marketing and cookies: where both could apply, the specific one governs.
M
- Mens rea
- The mental element an offence requires — intention, knowledge, recklessness or negligence. An offence with no mens rea is one you can commit without meaning to. Defined in: General criminal law, not data protection statutes
N
- Necessity test
- Whether the purpose could reasonably be achieved by a less intrusive route. Not whether the processing is useful, cheaper, or standard practice — those are different questions.
O
- One-stop-shop
- The EU mechanism routing cross-border cases through a lead authority — the reason Ireland’s DPC decides so many Big Tech cases. Defined in: GDPR Arts 56 and 60 (lead supervisory authority mechanism)
- Onshoring
- Converting retained EU law into domestic law after Brexit, with amendments to make it work outside the EU framework. The UK GDPR is the onshored GDPR.
P
- Personal data
- Any information relating to an identified or identifiable person: names, IDs, location, online identifiers, and combinations that single someone out. Defined in: GDPR Art 4(1); UK GDPR Art 4(1); DPA 2018 s.3(2)
- Pre-emption
- Where a higher law displaces a lower one. In US federal privacy law it matters which model applies: a FLOOR lets stricter state law survive (HIPAA, GLBA); EXPRESS pre-emption displaces inconsistent state law (COPPA).
- Prejudice test
- A conditional exemption that applies only to the extent that complying would be likely to harm a stated purpose. Assessed case by case — it is never a blanket carve-out.
- Private right of action
- The ability of an individual to sue directly under a statute, rather than relying on a regulator to act. Most US federal privacy statutes have none; the FCRA is the notable exception.
- Processor
- Processes on the controller’s instructions — cloud hosts, payroll bureaus — with its own security and breach duties. Defined in: GDPR Art 4(8); UK GDPR Art 4(8)
- Profiling
- Update: UK automated-decision rules moved from an Art 22 prohibition to a safeguards regime (Arts 22A-22D) in force 2026-02-05. Defined in: GDPR Art 4(4); UK GDPR Art 4(4); see also Art 22 (UK: new Arts 22A-22D under DUAA 2025)
- Pseudonymisation
- Replacing identifiers so data cannot be attributed to a person without a separately held key. Still personal data — unlike anonymisation. Defined in: GDPR Art 4(5); UK GDPR Art 4(5)
R
- Recital
- The numbered explanatory paragraphs before an EU instrument's articles. Not binding in themselves, but courts and regulators use them to interpret the articles — Recital 47 on reasonable expectations is the standard example.
- Regulatory enforcement
- Action by the supervisory authority — notices, audits, administrative fines. Runs entirely separately from any criminal prosecution over the same facts.
- Remitted
- Sent back to a lower body to decide again, usually applying corrected reasoning. The original decision is not replaced by the appeal court's own — it is reconsidered.
S
- Special category data
- Health, biometrics, racial or ethnic origin, beliefs, sexual orientation, trade-union membership — processing needs an extra condition. Defined in: GDPR Art 9(1); UK GDPR Art 9(1); DPA 2018 ss.10-11 and Sch 1
- Standard contractual clauses (SCCs)
- Commission-approved contract terms carrying transfer safeguards where no adequacy exists; a transfer risk assessment rides along. Defined in: GDPR Art 46(2)(c)-(d); UK GDPR Art 46; EU set = Decision (EU) 2021/914
- Subject access request (SAR)
- Not a defined term as such; it is the exercise of the right of access in Art 15. "SAR" is practitioner shorthand, not a statutory phrase. Defined in: GDPR Art 15; UK GDPR Art 15; DPA 2018 s.45 (law enforcement)
V
- Vacated
- Cancelled by a court, with the rule or decision treated as having no effect. A US rule vacated nationwide binds nobody, anywhere.