A GDPR glossary in plain English.

A decision by the EU that the privacy law of a particular country outside the European Union is substantially equivalent to, and as protective of personal data as, EU law, so that data can move freely from the EU to that country without any additional requirements. Adequacy findings are reviewed every 4 years. 13 countries have so far been approved under an Adequacy finding, the latest being the UK.

Internal rules for multinational groups which, once implemented, guarantee that data transfers within the group are GDPR compliant. To have approved BCRs, an organization must apply for authorization from one of the EU’s Data Protection Authorities (“DPA”). BCRs do not guarantee compliant data transfers outside of the group.

BCRs are one of the three main methods for validly transferring EU data outside the European Economic Area, the others being an Adequacy finding by the EU Commission and the EU Standard Contractual Clauses, aka the “Model Clauses”. The EU-U.S. Privacy Shield Framework belonged in that category for transfers to the U.S., until the Court of Justice of the EU invalidated it in July 2020.

One of the new categories of personal data now expressly listed among the “Special Categories of Data” under the GDPR. Biometric Data refers to identifiable data related to physical, physiological or behavioral traits, including facial scans, fingerprints and retinal scans.

One of the 6 legal bases for processing personal data under the GDPR. To be valid, consent must be freely given, specific, affirmative and informed. For example, if you ask to store and use someone’s personal data, they might need to opt in through clear and separate opt-ins for each instance of data collection.

Consent is not always required: processing may be lawful without it if it falls under one of the other Article 6 categories of lawful processing.

Whoever decides what data is collected, the way it is collected and how it is used. This can include individuals or “legal persons” such as companies or organizations. As a general rule, any organization that operates a website collecting the personal data of EU residents is a data controller. Controllers must make sure that their service providers with access to that data (“data processors” or “processors”) also comply with the GDPR.

Before processing personal data, Controllers must assess the privacy risks of their processing when it is likely to result in a high risk to the rights and freedoms of the data subjects. DPIAs are required where the processing involves:

• profiling data subjects
• large scale processing
• regular and systematic monitoring of publicly accessible areas on a large scale

A DPIA should include

• A description of processing operations
• The purpose of processing
• An assessment of the balance between the purpose and the necessity and proportionality of processing
• An assessment of the risks to the rights and freedoms of data subjects
• Steps to address the risks, including security mechanisms and safeguards

The person formally appointed to be responsible for compliant data processing practices within a company or organization. Under the GDPR, you must appoint a DPO if:

• you are a public authority or body (except for courts acting in their judicial capacity)
• your core activities require large scale, regular and systematic monitoring of individuals
• your core activities consist of large scale processing of special categories of data or data relating to criminal convictions

A person within the EU whose information is being processed. Data subjects covered by the GDPR physically reside in a European Member State while their personal data is being processed.

The 2002 E-Privacy Directive, currently the subject of a draft Regulation meant to replace it, protects internet users’ privacy by requiring websites to obtain user consent and to give users control over when and why cookies track them.

Companies or organizations with no base or physical presence in the EU must appoint a representative physically in the EU, who acts as the point of contact for DPAs and data subjects. Exceptions to appointing a representative include:

• Personal data is only processed occasionally
• Processing doesn’t include large scale processing of special categories of data
• Processing doesn’t include personal data related to criminal convictions
• Processing won’t result in risk to the rights and freedoms of data subjects

The European Economic Area consists of all 28 Member States, plus Liechtenstein, Iceland and Norway.

Before the GDPR, companies with no employees, offices or processing facilities (servers, for example) in the EU were generally not subject to the EU Privacy Directive. The GDPR goes further and covers any organization, anywhere in the world, that either (1) offers “goods or services” to EU users or (2) “monitors the behavior” of EU data subjects.

European legislation that came into effect on May 25, 2018, replacing the EU Privacy Directive (95/46/EC) of 1995, and imposing strict new rules on any organization or business coming in contact with the personal data of EU residents, wherever the organization is located.

Another new category of data, now expressly listed among the “Special Categories of Data” under the GDPR. Genetic Data refers to identifiable data concerning data subjects’ gene sequences.

Large scale processing is not defined by the GDPR. When it applies, the organization must designate a DPO.

One of the 6 lawful bases for processing personal data under the GDPR: very flexible, but also unclear for controllers. A 3-part test decides whether your processing qualifies:

Examples include fraud prevention, ensuring security, or identifying criminal or public security threats. Direct marketing and employee data transfers might be legitimate depending on why and how they are done.

Member States are subject to the GDPR. There are 27:

• Austria
• Belgium
• Bulgaria
• Croatia
• Cyprus
• Czech Republic
• Denmark
• Estonia
• Finland
• France
• Germany
• Greece
• Hungary
• Ireland
• Italy
• Latvia
• Lithuania
• Luxembourg
• Malta
• Netherlands
• Poland
• Portugal
• Romania
• Slovakia
• Slovenia
• Spain
• Sweden

Since the UK’s referendum decision to leave the EU (“Brexit”), the United Kingdom is no longer a Member State.

Some provisions of the GDPR let Member States add to or modify the Regulation as it applies to their residents: more than 50 of them grant Member States the right to set their own rules. Companies with data subjects in several Member States should know those states’ derogations before processing their residents’ data.

Any information that can be used, directly or indirectly (alone or combined with other information), to identify an individual, including:

• Full name
• Home address
• Email address, business email included
• National identification number
• Passport number
• Vehicle registration plate number
• Driver’s license number
• Face, fingerprints or handwriting
• Credit card numbers
• Date of birth
• Birthplace
• Genetic information
• Telephone number
• Login, screen name, nickname or handle
• IP address
• Device IDs, User ID and Cookie ID
• Pseudonymous data

This is distinct from “Personally Identifiable Information”, which has a narrower definition in the U.S.

The EU-U.S. Privacy Shield was a self-certification mechanism designed in 2016 as an approved means of transferring personal data from the EU to the U.S. Until the Court of Justice of the EU invalidated it on July 16, 2020, it was one of three main methods for validly transferring EU data outside the European Economic Area, with BCRs and the Standard Contractual Clauses.

Self-certifying under the Privacy Shield did not make you GDPR compliant: it only addressed the transfer of EU residents’ personal data from the EU to the U.S., which is just one of the GDPR’s requirements.

Anything done to personal data, including collecting, storing, modifying, structuring, sending, using, accessing and deleting. Processing is lawful if it falls into one or more of six categories:

• The data subject gives explicit consent
• It is necessary to perform a contract with the data subject (supplying requested goods or services, for example)
• The controller is legally required to process the data
• It is required to protect the vital interests of the data subject or another person
• It is necessary to perform a task in the public interest (by schools, hospitals or the police, for example)
• The controller has a legitimate interest in processing the data

There are additional requirements depending on the quantity and quality of processing.

Whoever holds or processes data on behalf of a controller, without making decisions about that data. For example, an organization, as controller, may outsource email marketing and engagement tracking to a third party, which becomes the processor.

Automated processing of personal data to classify data subjects, or to make decisions or predictions about them. This includes simple classifications by age, sex or numerical categories (a credit score, for example), whether or not they are used for predictions. Under the Article 22 exceptions, controllers may only use automated processing where:

• The data subject has given explicit consent
• It is necessary to enter into or perform a contract between the controller and the data subject
• It is authorized by Union or Member State law

Data controllers and data processors must keep processing records; controllers have the stricter requirements.

Organizations with fewer than 250 employees don’t have to keep these records unless the processing is likely to result in a risk to data subjects’ rights and freedoms, is not occasional, or includes special categories of data.

An organization that regularly and systematically monitors data subjects, tracking and profiling them in a recurring, organized way, must designate a DPO. Examples:

• Profiling and scoring for risk assessment
• Operating telecommunications networks
• Mobile app location tracking
• Behavioral advertising
• Fitness devices that track health data

Data subjects have the right to know what data is processed about them, including the purpose of processing, the categories of data collected, the third parties it is shared with, how long it will be stored, how to rectify, request or erase it, their right to complain to a supervisory authority, where the data came from if they didn’t provide it, and any profiling and its purpose.

One of the new rights of data subjects under the GDPR: they may request, receive and share any personal data collected on them in an accessible, readable format.

One of the new rights of data subjects under the GDPR: they may ask for the data collected about them to be erased, and controllers must take reasonable steps to have third parties they shared it with erase it too. The right doesn’t apply where processing is necessary to exercise freedom of expression and information, comply with a legal obligation, serve public health, archive or research in the public interest, or establish or defend legal claims.

Controllers and processors should put appropriate technical and organizational security measures around the personal data they process, such as:

• Pseudonymization and encryption of personal data
• Processing systems that stay confidential, available and resilient
• Restoring personal data in a timely manner after an incident
• Regularly testing, assessing and evaluating the security measures

Pseudonymization separates processed data so it can’t be connected to an identifiable person without additional information. Pseudonymized data is still personal data under the GDPR. Encryption translates data into code that can only be read with a key, and is considered one of the most secure data protection methods.

Racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data; data concerning health; and data concerning a person’s sex life or sexual orientation. Processing it is not prohibited if it falls under one of the Article 9 exceptions, such as the data subject’s explicit consent, employment or social security law, vital interests, data the subject made public, legal claims, substantial public interest, health and medical care, or research and statistics in the public interest.

Approved language built into contracts for international data transfers, to provide adequate safeguards for the data and the data subjects. One of the three main methods for validly transferring EU personal data outside the European Economic Area, with BCRs and an Adequacy finding, and the most favored one for a small business.