Accountability
The GDPR principle requiring organisations not only to comply with data protection law, but to be able to demonstrate that compliance through records, policies, decisions, and governance measures.
Clear explanations of common GDPR, PECR and data protection terms, written to help small and growing businesses understand the language used in guidance, policies, contracts and everyday compliance work.
This glossary explains common terms used across UK GDPR, PECR and data protection. Search for a specific term or browse the A to Z index to find a clear explanation and understand where it fits in practice.
Search will jump to the first matching glossary term on the page.
Browse the glossary by letter below. Each term is written in plain English to help small and growing businesses understand what it means and where it fits in practice.
The GDPR principle requiring organisations not only to comply with data protection law, but to be able to demonstrate that compliance through records, policies, decisions, and governance measures.
UK regulations that allow certain restricted transfers of personal data to specified countries, territories, sectors, or international organisations because the UK has assessed their level of protection as not materially lower than in the UK.
The process of altering data so that individuals can no longer be identified, directly or indirectly. Truly anonymised data falls outside the scope of GDPR.
Decision making carried out by automated means without meaningful human involvement. In some cases, GDPR gives individuals specific rights where those decisions have legal or similarly significant effects.
Personal data resulting from specific technical processing relating to physical, physiological, or behavioural characteristics, such as fingerprints or facial recognition data, used to identify an individual.
Internal rules used by multinational groups to permit certain international transfers of personal data within the same corporate group, subject to regulatory approval.
A security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
Software used to present and manage choices about cookies, tracking technologies, and similar website permissions. A CMP can help record and apply user choices, but using one does not by itself guarantee compliance.
A small piece of information stored on or accessed from a user’s device by a website or online service. PECR rules may require clear information and consent unless an applicable exception applies.
A PECR term for a subscriber that is a corporate body with separate legal status, such as a company or limited liability partnership. Some electronic marketing rules differ between corporate and individual subscribers.
Usually shortened to CTPS. A register used by corporate subscribers to indicate that they do not want unsolicited live marketing calls to registered telephone numbers, subject to limited exceptions such as valid consent.
Personal data relating to criminal convictions, offences, allegations, investigations, proceedings, or related security measures. The UK GDPR and Data Protection Act 2018 impose additional conditions and safeguards on its use.
The obligation to keep personal data secure and not disclose it to unauthorised people or parties.
A lawful basis under GDPR that must be freely given, specific, informed, and unambiguous. In some situations, such as certain marketing activities or special category processing, consent must meet a higher standard.
The organisation or person who decides why and how personal data is processed. Under GDPR, this is usually referred to as the data controller.
Permission requested from users before placing certain cookies or similar tracking technologies on their devices. In the UK, this sits closely alongside PECR and GDPR standards for valid consent.
Personal data relating to children, which usually requires greater care because children may be less aware of risks, consequences, and their rights.
Usually shortened to DUAA. A UK Act that amended parts of the UK GDPR, Data Protection Act 2018, PECR, and other information laws. Its data protection provisions are now in force and have changed areas such as lawful bases, subject access, complaints, and international transfers.
A common name for the written controller-processor contract required when a controller uses a processor to handle personal data. Article 28 of the UK GDPR sets out minimum terms that must be included. The abbreviation DPA can also mean Data Protection Act, so context matters.
UK legislation that works alongside the UK GDPR and contains additional rules, conditions, exemptions, enforcement provisions, and separate regimes for areas such as law enforcement processing.
A complaint from an individual about an organisation’s handling of personal data or data protection rights. Since June 2026, organisations have specific duties to provide a clear complaints route, acknowledge complaints within 30 days, investigate them appropriately, and communicate the outcome.
An annual fee that many controllers must pay to the ICO under the Data Protection (Charges and Information) Regulations 2018. Some organisations and processing activities are exempt, so businesses should check whether the fee applies to them.
A documented timetable setting out how long different categories of information should be kept and what should happen when each retention period ends, such as deletion, anonymisation, or secure destruction.
A document that records how organisations intend to share personal data, including the purpose, roles, lawful basis, information involved, security, retention, and responsibilities. It is not required for every sharing arrangement but can be an important accountability measure.
A personal data breach is a security incident involving personal data, such as loss, unauthorised access, accidental deletion, or disclosure to the wrong recipient.
The party that determines the purposes and means of processing personal data. In practice, this is the organisation deciding what the data is used for and how that use is structured.
The process of identifying what personal data an organisation holds, where it comes from, where it goes, who can access it, and how long it is kept.
A GDPR principle requiring organisations to collect and use only the personal data that is actually needed for the specific purpose.
A person or organisation that processes personal data on behalf of a controller. Processors must follow the controller’s instructions and have their own specific GDPR obligations.
A designated role required in some organisations to advise on data protection obligations, monitor compliance, and act as a contact point for the ICO and data subjects.
The identified or identifiable individual whose personal data is being processed.
Short for Data Protection Impact Assessment. A structured assessment used to identify and reduce privacy risks where processing is likely to result in a high risk to individuals’ rights and freedoms.
Communication sent to individuals to promote goods, services, aims, or ideas. This includes many email, text, telephone, and postal marketing activities.
A PECR term covering messages sent over an electronic communications network that can be stored until collected by the recipient. It includes emails and text messages and can also cover other stored electronic messages.
A security measure that converts data into a coded form so it cannot be easily read without the correct key or access method.
Sometimes referred to as the right to be forgotten. This gives individuals the right, in certain circumstances, to ask for their personal data to be deleted.
A stronger form of consent requiring a clear and express statement of agreement. It is often needed for certain uses of special category data.
One of the core data protection principles. Personal data must be processed in a way that people would reasonably expect and that does not have unjustified adverse effects on them.
A structured set of personal data, whether electronic or manual, that is organised so specific information about individuals can be accessed.
Short for the General Data Protection Regulation. In the UK context, this usually means the UK GDPR, which works alongside the Data Protection Act 2018.
The policies, roles, controls, reporting lines, and decision making structures used to manage data protection effectively across an organisation.
Processing likely to create a high risk to individuals’ rights and freedoms, often triggering the need for a DPIA before the activity begins.
The Information Commissioner’s Office, the UK regulator responsible for data protection, freedom of information, and certain electronic marketing rules.
A PECR term covering individual customers, including sole traders, and certain partnerships or other unincorporated bodies. Individual subscribers receive greater protection than corporate subscribers under some electronic marketing rules.
The head of the ICO, responsible for leading the UK’s independent authority for upholding information rights.
A broad term covering the legal rights and protections connected to personal data, access to information, and privacy.
The GDPR principle requiring personal data to be processed securely, protected against unauthorised access, accidental loss, damage, or disclosure.
Usually shortened to IDTA. Standard data protection clauses issued by the ICO that organisations can use as a safeguard for certain restricted transfers of personal data from the UK. When relying on this safeguard, organisations must also complete the relevant transfer risk assessment or data protection test.
A transfer of personal data to a country outside the UK, which may require a recognised transfer mechanism and transfer risk assessment.
Two or more organisations that jointly decide why and how personal data is processed. Their responsibilities should be clearly allocated between them.
An informal way of referring to children’s personal data. Organisations should usually use the formal concept of children’s data and apply higher privacy standards where relevant.
The legal reason an organisation relies on to process personal data under the UK GDPR. There are seven lawful bases: consent, contract, legal obligation, vital interests, public task, recognised legitimate interest, and legitimate interests.
Usually shortened to LIA. A documented assessment used when relying on the legitimate interests lawful basis. It considers the legitimate purpose, whether the processing is necessary, and whether the individual’s interests, rights, or freedoms override that interest.
A lawful basis that may apply where processing is necessary for a legitimate interest pursued by the organisation or a third party, provided that interest is not overridden by the individual’s rights and freedoms.
The first GDPR principle. Personal data must be processed lawfully, fairly, and in a transparent manner in relation to the individual.
A list of contacts used for promotional communications. Organisations should ensure the source, permissions, lawful basis, and suppression rules are properly understood before use.
Observing or tracking individuals’ behaviour, activity, location, or interactions. Depending on the context, monitoring may increase risk and require additional safeguards.
A record of people who should not receive further marketing communications, usually because they have objected or unsubscribed.
Real human review and judgment in a decision making process, rather than a token or superficial sign off. This matters when assessing whether a decision is truly automated.
A concept that appears throughout GDPR. Organisations should be able to explain why a processing activity is genuinely needed for the stated purpose or lawful basis.
In data protection practice, this often refers to notifying the ICO or affected individuals about a reportable personal data breach.
The right of an individual to object to certain types of processing, including direct marketing. Where an objection to direct marketing is made, processing for that purpose must stop.
A clear positive action showing agreement to receive marketing or permit a processing activity. Silence or pre ticked boxes do not amount to a valid opt in.
A mechanism allowing someone to refuse or stop a specific type of processing, especially marketing communications.
Short for the Privacy and Electronic Communications Regulations. These rules sit alongside GDPR and cover areas such as email marketing, cookies, electronic communications, and caller identification.
Any information relating to an identified or identifiable individual. This can include names, contact details, IDs, online identifiers, and information that can be linked back to a person.
A plain-language term commonly used to mean information about an identifiable person. The UK GDPR generally uses the legal term personal data, so that is the more precise term when discussing statutory obligations.
A breach involving personal data, including accidental disclosure, loss, destruction, alteration, or unauthorised access.
An approach that builds privacy and data protection considerations into systems, processes, products, and services from the start, rather than as an afterthought.
The information an organisation must give people about how and why their personal data is used, including matters such as purposes, lawful bases, recipients, retention, rights, and contact details. It is often provided through a privacy notice and may be layered across different points of collection.
A statement explaining how an organisation collects, uses, shares, and stores personal data, and what rights individuals have.
An organisation or person that processes personal data on behalf of a controller.
A written contract or other binding legal arrangement required when a controller appoints a processor. It must cover the processing and include the minimum controller-processor terms required by Article 28 of the UK GDPR.
Automated processing used to evaluate personal aspects relating to an individual, such as preferences, behaviour, location, interests, or performance.
A technique that replaces identifying details with alternative references or codes. The data remains personal data if re identification is still possible.
A GDPR principle requiring personal data to be collected for specified, explicit, and legitimate purposes and not used in a way that is incompatible with those purposes.
A piece of information that may not identify someone on its own, but could do so when combined with other data, such as postcode, date of birth, or job title.
The standard organisations must apply when searching for information in response to a subject access request. They must make reasonable efforts to find and retrieve the requested personal data, but are not required to carry out searches that are unreasonable or disproportionate to the importance of the information.
One of the seven UK GDPR lawful bases. It applies only to specified public-interest purposes set out in law, including certain crime prevention, safeguarding, emergency, security, defence, and public-task disclosure situations. A balancing test is not required, but the processing must still be necessary and comply with the rest of data protection law.
A person, organisation, authority, or other body to which personal data is disclosed.
Often shortened to ROPA. These are internal records documenting what personal data is processed, why it is processed, who receives it, how long it is retained, and what safeguards apply.
The right of an individual to have inaccurate personal data corrected, or incomplete data completed.
The right, in certain situations, to require an organisation to limit how personal data is used rather than erase it entirely.
The length of time personal data is kept before it is deleted, anonymised, or securely destroyed.
A right that applies in certain circumstances where processing is automated and based on consent or contract. It allows individuals to receive personal data they provided to a controller in a structured, commonly used, machine-readable format and to ask for it to be transferred to another controller where technically feasible.
A structured review of possible harms, impacts, vulnerabilities, and controls relevant to a processing activity, supplier, transfer, or system.
Short for Subject Access Request. This is a request made by an individual asking for a copy of the personal data an organisation holds about them, along with related information.
The technical and organisational measures used to protect personal data against unauthorised access, misuse, accidental loss, destruction, or damage.
A non technical phrase often used to describe data that needs extra care. Under GDPR, the more precise legal concept is usually special category data.
A PECR rule that may allow certain email or text marketing to existing customers without full prior consent, provided specific conditions are met.
Particularly sensitive personal data, including information about health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life, sexual orientation, genetic data, and biometric data used for identification.
Standard legal clauses used to support certain international data transfers where no adequacy decision applies.
A GDPR principle requiring personal data not to be kept for longer than is necessary for the purposes for which it was collected.
A list of people who should no longer receive marketing or other contact, often because they have opted out or objected.
The independent public authority responsible for monitoring the application of data protection law. In the UK, this is the ICO.
Regular, organised, or ongoing observation of individuals, often relevant when assessing whether a DPO may be required or whether processing is high risk.
A secondary processor engaged by a primary processor to carry out specific processing activities on behalf of the controller.
Usually shortened to TPS. A register that allows individual subscribers, including many sole traders, to indicate that they do not want unsolicited live marketing calls. Marketers must screen relevant calling lists and respect registrations unless an applicable exception applies.
Often shortened to TOMs. These are the safeguards, controls, policies, and security arrangements used to protect personal data and support compliance.
A person or organisation other than the data subject, controller, processor, or authorised people acting under their direct authority.
A small piece of code or embedded resource used to record information about user activity, such as page views, email opens, conversions, or interactions. Depending on how it operates, PECR and UK GDPR requirements may apply.
Tools such as cookies, pixels, scripts, SDKs, or similar technologies used to monitor user behaviour, activity, or preferences.
An assessment used when transferring personal data outside the UK to consider whether the destination and safeguards provide sufficient protection in practice.
The requirement to be open and clear with people about how their personal data is collected, used, shared, and stored.
A legal method for supporting certain international transfers of personal data, such as adequacy regulations, standard contractual clauses, or binding corporate rules.
Promotional calls made to individuals or businesses, subject to specific rules under PECR and data protection law.
Short for the International Data Transfer Addendum to the EU Standard Contractual Clauses. It allows organisations to use the EU SCCs as a safeguard for certain restricted transfers under the UK GDPR.
Common shorthand for the ICO’s International Data Transfer Agreement, a set of standard data protection clauses that can be used as a safeguard for certain restricted transfers from the UK.
The UK version of the GDPR, retained in domestic law and read alongside the Data Protection Act 2018.
Processing personal data without a valid legal basis or in a way that breaches data protection law.
Consent that meets GDPR standards: freely given, specific, informed, unambiguous, and capable of being withdrawn.
The process of assessing a supplier’s suitability, security, privacy practices, contractual position, and compliance risk before or during engagement.
The privacy, security, legal, or operational risk created by third party suppliers that handle or have access to personal data.
The right of an individual to withdraw previously given consent, which must be as easy to do as it was to give.
A security practice that permits only approved systems, users, apps, or senders. In privacy operations, this can support controlled access and safer workflows.
Structured data supplied via XML format. If the feed contains personal data, the same privacy and security obligations still apply.
A plain English way of referring to the rights individuals have under GDPR, such as access, rectification, erasure, objection, restriction, portability, and complaint rights.
Information a person intentionally and proactively shares with an organisation, such as preferences, interests, or communication choices.