Learn

GDPR & Privacy Glossary

Clear, practical definitions of key GDPR, privacy, and compliance terms, written for founders, marketers, and SMEs who want straightforward explanations they can actually apply.

Browse A to Z Back to Learn
How to use this glossary

Find terms quickly, browse confidently

This glossary explains key terms used across GDPR, privacy regulation, marketing compliance, and modern data governance. Use the search box to find a specific term, or browse by letter using the A to Z index below.

Search will jump to the first matching glossary term on the page.

Browse by letter
Glossary entries

Key GDPR and privacy terms, explained clearly

Browse the glossary by letter below. Each term is written in plain English to help founders, marketers, and growing businesses understand what matters, what it means, and where it fits in practice.

A Back to A–Z

Anonymisation

The process of altering data so that individuals can no longer be identified, directly or indirectly. Truly anonymised data falls outside the scope of GDPR.

Automated Decision Making

Decision making carried out by automated means without meaningful human involvement. In some cases, GDPR gives individuals specific rights where those decisions have legal or similarly significant effects.

B Back to A–Z

Biometric Data

Personal data resulting from specific technical processing relating to physical, physiological, or behavioural characteristics, such as fingerprints or facial recognition data, used to identify an individual.

Breach

A security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

C Back to A–Z

Confidentiality

The obligation to keep personal data secure and not disclose it to unauthorised people or parties.

Controller

The organisation or person who decides why and how personal data is processed. Under GDPR, this is usually referred to as the data controller.

Children’s Data

Personal data relating to children, which usually requires greater care because children may be less aware of risks, consequences, and their rights.

D Back to A–Z

Data Breach

A personal data breach is a security incident involving personal data, such as loss, unauthorised access, accidental deletion, or disclosure to the wrong recipient.

Data Controller

The party that determines the purposes and means of processing personal data. In practice, this is the organisation deciding what the data is used for and how that use is structured.

Data Mapping

The process of identifying what personal data an organisation holds, where it comes from, where it goes, who can access it, and how long it is kept.

Data Minimisation

A GDPR principle requiring organisations to collect and use only the personal data that is actually needed for the specific purpose.

Data Processor

A person or organisation that processes personal data on behalf of a controller. Processors must follow the controller’s instructions and have their own specific GDPR obligations.

Data Protection Officer

A designated role required in some organisations to advise on data protection obligations, monitor compliance, and act as a contact point for the ICO and data subjects.

DPIA

Short for Data Protection Impact Assessment. A structured assessment used to identify and reduce privacy risks where processing is likely to result in a high risk to individuals’ rights and freedoms.

E Back to A–Z

Encryption

A security measure that converts data into a coded form so it cannot be easily read without the correct key or access method.

Erasure

Sometimes referred to as the right to be forgotten. This gives individuals the right, in certain circumstances, to ask for their personal data to be deleted.

Explicit Consent

A stronger form of consent requiring a clear and express statement of agreement. It is often needed for certain uses of special category data.

F Back to A–Z

Fairness

One of the core data protection principles. Personal data must be processed in a way that people would reasonably expect and that does not have unjustified adverse effects on them.

Filing System

A structured set of personal data, whether electronic or manual, that is organised so specific information about individuals can be accessed.

G Back to A–Z

GDPR

Short for the General Data Protection Regulation. In the UK context, this usually means the UK GDPR, which works alongside the Data Protection Act 2018.

H Back to A–Z

High Risk Processing

Processing likely to create a high risk to individuals’ rights and freedoms, often triggering the need for a DPIA before the activity begins.

I Back to A–Z

Information Commissioner

The head of the ICO, responsible for leading the UK’s independent authority for upholding information rights.

Information Rights

A broad term covering the legal rights and protections connected to personal data, access to information, and privacy.

Integrity and Confidentiality

The GDPR principle requiring personal data to be processed securely, protected against unauthorised access, accidental loss, damage, or disclosure.

J Back to A–Z

Joint Controllers

Two or more organisations that jointly decide why and how personal data is processed. Their responsibilities should be clearly allocated between them.

K Back to A–Z

Kids’ Data

An informal way of referring to children’s personal data. Organisations should usually use the formal concept of children’s data and apply higher privacy standards where relevant.

L Back to A–Z

Lawful Basis

The legal reason an organisation relies on to process personal data under GDPR, such as consent, contract, legal obligation, vital interests, public task, or legitimate interests.

Legitimate Interests

A lawful basis that may apply where processing is necessary for a legitimate interest pursued by the organisation or a third party, provided that interest is not overridden by the individual’s rights and freedoms.

Lawfulness, Fairness and Transparency

The first GDPR principle. Personal data must be processed lawfully, fairly, and in a transparent manner in relation to the individual.

M Back to A–Z

Marketing List

A list of contacts used for promotional communications. Organisations should ensure the source, permissions, lawful basis, and suppression rules are properly understood before use.

Monitoring

Observing or tracking individuals’ behaviour, activity, location, or interactions. Depending on the context, monitoring may increase risk and require additional safeguards.

Mail Suppression List

A record of people who should not receive further marketing communications, usually because they have objected or unsubscribed.

Meaningful Human Involvement

Real human review and judgment in a decision making process, rather than a token or superficial sign off. This matters when assessing whether a decision is truly automated.

N Back to A–Z

Necessity

A concept that appears throughout GDPR. Organisations should be able to explain why a processing activity is genuinely needed for the stated purpose or lawful basis.

Notification

In data protection practice, this often refers to notifying the ICO or affected individuals about a reportable personal data breach.

O Back to A–Z

Objection

The right of an individual to object to certain types of processing, including direct marketing. Where an objection to direct marketing is made, processing for that purpose must stop.

Opt In

A clear positive action showing agreement to receive marketing or permit a processing activity. Silence or pre ticked boxes do not amount to a valid opt in.

Opt Out

A mechanism allowing someone to refuse or stop a specific type of processing, especially marketing communications.

P Back to A–Z

PECR

Short for the Privacy and Electronic Communications Regulations. These rules sit alongside GDPR and cover areas such as email marketing, cookies, electronic communications, and caller identification.

Related articles and updates: Direct Marketing and GDPR • What is PECR? A practical guide to the Privacy and Electronic Communications Regulations • February 2026: DUAA data protection changes commence and ICO guidance updates • March 2026: PECR And Direct Marketing Compliance Under Increased Scrutiny

Personal Data Breach

A breach involving personal data, including accidental disclosure, loss, destruction, alteration, or unauthorised access.

Processor

An organisation or person that processes personal data on behalf of a controller.

Profiling

Automated processing used to evaluate personal aspects relating to an individual, such as preferences, behaviour, location, interests, or performance.

Pseudonymisation

A technique that replaces identifying details with alternative references or codes. The data remains personal data if re identification is still possible.

Purpose Limitation

A GDPR principle requiring personal data to be collected for specified, explicit, and legitimate purposes and not used in a way that is incompatible with those purposes.

Q Back to A–Z

Quasi Identifier

A piece of information that may not identify someone on its own, but could do so when combined with other data, such as postcode, date of birth, or job title.

R Back to A–Z

Recipient

A person, organisation, authority, or other body to which personal data is disclosed.

Records of Processing Activities

Often shortened to ROPA. These are internal records documenting what personal data is processed, why it is processed, who receives it, how long it is retained, and what safeguards apply.

Related article: The Accountability Principle Under UK GDPR Explained

Rectification

The right of an individual to have inaccurate personal data corrected, or incomplete data completed.

Restriction of Processing

The right, in certain situations, to require an organisation to limit how personal data is used rather than erase it entirely.

Retention Period

The length of time personal data is kept before it is deleted, anonymised, or securely destroyed.

S Back to A–Z

Security

The technical and organisational measures used to protect personal data against unauthorised access, misuse, accidental loss, destruction, or damage.

Sensitive Data

A non technical phrase often used to describe data that needs extra care. Under GDPR, the more precise legal concept is usually special category data.

Special Category Data

Particularly sensitive personal data, including information about health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life, sexual orientation, genetic data, and biometric data used for identification.

Storage Limitation

A GDPR principle requiring personal data not to be kept for longer than is necessary for the purposes for which it was collected.

Suppression List

A list of people who should no longer receive marketing or other contact, often because they have opted out or objected.

Supervisory Authority

The independent public authority responsible for monitoring the application of data protection law. In the UK, this is the ICO.

Systematic Monitoring

Regular, organised, or ongoing observation of individuals, often relevant when assessing whether a DPO may be required or whether processing is high risk.

Sub Processor

A secondary processor engaged by a primary processor to carry out specific processing activities on behalf of the controller.

T Back to A–Z

Third Party

A person or organisation other than the data subject, controller, processor, or authorised people acting under their direct authority.

U Back to A–Z

UK GDPR

The UK version of the GDPR, retained in domestic law and read alongside the Data Protection Act 2018.

Unlawful Processing

Processing personal data without a valid legal basis or in a way that breaches data protection law.

V Back to A–Z

Valid Consent

Consent that meets GDPR standards: freely given, specific, informed, unambiguous, and capable of being withdrawn.

Vendor Due Diligence

The process of assessing a supplier’s suitability, security, privacy practices, contractual position, and compliance risk before or during engagement.

Vendor Risk

The privacy, security, legal, or operational risk created by third party suppliers that handle or have access to personal data.

W Back to A–Z

Withdrawal of Consent

The right of an individual to withdraw previously given consent, which must be as easy to do as it was to give.

Whitelisting

A security practice that permits only approved systems, users, apps, or senders. In privacy operations, this can support controlled access and safer workflows.

X Back to A–Z

XML Feed Data

Structured data supplied via XML format. If the feed contains personal data, the same privacy and security obligations still apply.

Y Back to A–Z
Z Back to A–Z

Zero Party Data

Information a person intentionally and proactively shares with an organisation, such as preferences, interests, or communication choices.

Future Implementation Support Waitlist