Data Privacy Vocabulary in English

Personal data under GDPR is any information that relates to an identified or identifiable living individual. The definition is intentionally broad and includes obvious identifiers such as name, email address, and national insurance number, but also less obvious ones such as IP addresses, cookie identifiers, location data, and online behavioural profiles that could be used to identify a specific person. Data that is truly anonymous — meaning it is impossible to re-identify the individual from it, even with additional data — falls outside the scope of GDPR. The concept of “identifiable” includes both direct identification (knowing the person’s name) and indirect identification (combining data points that together identify an individual).

A data controller is the organisation or individual who decides why and how personal data is processed. They set the purposes and means of processing and bear primary legal responsibility under GDPR. A data processor is an organisation or individual who processes personal data on behalf of the controller, following the controller’s instructions. For example, a business (the controller) might use a payroll software company (the processor) to process employee data. Both controllers and processors have obligations under GDPR, and the relationship must be governed by a written data processing agreement. Controllers can be held liable for the actions of processors who act outside their instructions.

Under GDPR, consent is one of six lawful bases on which personal data may be processed. For consent to be valid, it must be freely given (without coercion or detriment for refusing), specific (covering a particular purpose), informed (the individual must understand what they are consenting to), and unambiguous (requiring a clear positive action such as ticking a box — pre-ticked boxes do not count). Consent is not always required for processing personal data — organisations can rely on other lawful bases such as contract, legal obligation, or legitimate interests. However, consent is often the most appropriate basis for marketing activities, and individuals must be able to withdraw it at any time as easily as they gave it.

The right to erasure, also known as the “right to be forgotten”, allows individuals to request that an organisation delete their personal data in certain circumstances. These include when the data is no longer needed for the purpose it was collected, when consent has been withdrawn and there is no other lawful basis for processing, when the data has been processed unlawfully, or when erasure is required by law. The right is not absolute — organisations can refuse if they have overriding legitimate grounds to keep the data, for example if it is needed to comply with a legal obligation or to defend a legal claim. Requests must be responded to within one month.

Pseudonymisation replaces identifying information in a dataset with an artificial identifier (a pseudonym), so the data can no longer be linked to a specific individual without access to separate additional information kept securely. Pseudonymised data is still personal data under GDPR because it is possible, in principle, to re-identify the individual. Anonymisation is the irreversible removal of identifying information so that it is no longer possible to identify the individual from the data, even using all available means. Truly anonymised data falls outside GDPR entirely. The distinction matters practically: pseudonymised data can be used to reduce risk while retaining the ability to re-link records if needed (as in clinical research), while anonymised data offers no route back to the individual.

Under GDPR, if a data breach is likely to result in a risk to individuals’ rights and freedoms, the data controller must notify the relevant supervisory authority (in the UK, the Information Commissioner’s Office) within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to individuals, the organisation must also notify the affected individuals without undue delay. The notification must describe the nature of the breach, the categories and approximate number of individuals and data records involved, the likely consequences, and the measures taken or proposed to address the breach. Organisations must also document all breaches, even those that do not require notification.

A Data Protection Impact Assessment (DPIA) is a process required under GDPR before starting a new processing activity that is likely to result in a high risk to individuals’ privacy. It involves systematically identifying and assessing the risks of the proposed processing and documenting measures to reduce those risks to an acceptable level. A DPIA is mandatory for certain types of processing, including large-scale processing of sensitive data, systematic monitoring of publicly accessible areas (such as CCTV), and automated decision-making that significantly affects individuals. It is also good practice to carry one out for any significant new use of personal data, even where not strictly required. If risks cannot be adequately mitigated, the organisation must consult the supervisory authority before proceeding.

Data minimisation is one of the key principles of GDPR, requiring that the personal data collected and processed should be limited to what is strictly necessary for the specified purpose. Organisations should not collect data “just in case” it might be useful later. In practice, this means reviewing registration forms, databases, and processes to ensure they do not gather unnecessary fields, shortening data retention periods, and not reusing data for new purposes without an appropriate lawful basis. Data minimisation reduces privacy risk: the less data an organisation holds, the less damage a breach can cause and the simpler it is to comply with data subject rights requests such as erasure or access.

Data portability is the right under GDPR that allows individuals to receive a copy of their personal data in a structured, commonly used, machine-readable format (such as CSV or JSON), and to transfer that data to another controller without hindrance. The right applies specifically to data that the individual provided to the controller and that is processed on the basis of consent or contract. A practical example is downloading your data from a social media platform and uploading it to a rival service. Data portability promotes competition, individual autonomy, and reduces lock-in to particular service providers. The organisation must respond to portability requests within one month.

Group the words into logical categories: people and roles (data subject, data controller, data processor, Data Protection Officer), legal concepts (GDPR, lawful basis, consent, legitimate interests), individual rights (right of access, right to erasure, data portability), technical concepts (pseudonymisation, anonymisation, encryption), and processes and documents (privacy notice, data breach, impact assessment, data retention). Use Flash Cards to build confident recall, then read real privacy notices, GDPR guidance from the ICO website, or published regulatory decisions. The ICO publishes case studies and guidance in clear English that is an excellent learning resource for this vocabulary in authentic regulatory context.