Data Privacy Vocabulary

conduct or assist with research conducted in an academic context e.g. within universities

Information about linguistic and speech accents.

conduct or enforce access control

Methods which restrict access to a place or resource

Information about financial account identifier.

Information about acquaintainces in a social network.

to come into possession or control of the data

to modify the data, often rewritten into a new form for a new use

Advertising is a subset of Marketing. Advertising by itself does not indicate 'personalisation' i.e. personalised ads.

Information about age

to adjust the data to be in relation to another data

to change the data without changing it into something else

to study or examine the data in detail

to irreversibly alter personal data in such a way that an unique data subject can no longer be identified directly or indirectly or in combination with other data

Altering personal data irreversibly such that a data subject can no longer be identified directly or indirectly, either by the data controller alone or in collaboration with any other party

Information about apartment(s) owned and its history

Information about associations in a social network with other individuals, groups, or entities e.g. friend of a friend

Information about attitude.

Information about authentication and information used for authenticating

Information about prior authentication and its outcomes such as login attempts or location.

Protocols involving validation of identity i.e. authentication of a person or information

non-technical authorisation procedures: How is it described on an organisational level, who gets access to the data

An authority with the power to create or enforce laws, or determine their compliance.

Processing that involves automated decision making

Information about bank accounts.

Information about behavior or activity

Information about biometrics and biometric characteristics.

Information about blood type.

Information about the web browser which is used as a 'fingerprint'

Information about browsing behavior.

Information about web browsing referrer or referral, which can be based on location, targeted referrals, direct, organic search, social media or actions, campaigns.

Information about the calls that an individual has made.

Information about cars ownership and ownership history.

Certification mechanisms, seals, and marks for the purpose of demonstrating compliance

Certifications, seals, and marks indicating compliance to regulations or practices

Information about character in the public sphere

The legality of age defining a child varies by jurisdiction. In addition, 'child' is distinct from a 'minor'. For example, the legal age drinking alcohol can be 21, which makes a person of age 20 a 'minor' in this context. In other cases, 'minor' and 'child' are used interchangeably to refer to a person below some legally defined age.

A set of rules or procedures outlining the norms and practices for conducting activities

to gather data from someone

to join or merge data

carry out activities with a commercial interest i.e. of profit or benefit to the Controller

conduct research in a commercial setting e.g. in a company

Information communicated from or to an individual

communicate with users via email, phone, sms, chat or push messages regarding your requests.

Information about communication metadata in the public sphere

Information about and including connections in a social network

Consent of the data subject regarding processing of their personal data

to consult or query data

Consultation is a process of receiving feedback, advice, or opinion from an external agency

Consultation with an authority or authoritative entity

Information about contacts or used for contacting e.g. email address or phone number

The 'context' or 'scope' of the purpose, e.g. restriction to a certain business sector

Contractual terms governing data handling within the data controller

to produce an exact reprodution of the data

Information about country e.g. residence, travel.

create and provide personalised recommendations for events

create and provide personalised recommendations

create product recommendations e.g. suggest similar products

Information about reputation with regards to money

Information about credit capacity.

Information about credit card number

Information about credit record.

Information about credit score.

Information about credit standing.

Information about credit worthiness.

Information about criminal activity e.g. criminal convictions or jail time

Information about criminal charges.

Information about criminal convictions.

Information about criminal pardons.

provide assistance for customer complaints and satisfaction

Information about DNA.

Top class: Impact Assessment, and DPIA is sub-class

The terms 'Controller' is usually the more common form of indicating a Data Controller. In ISO/IEC the term 'PII Controller' is used.

A ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

An authority tasked with overseeing legal compliance regarding privacy and data protection laws.

An entity within or authorised by an organisation to monitor internal compliance, inform and advise on data protection obligations and act as a contact point for data subjects and the supervisory authority.

Source is direct point of data collection; 'origin' would indicate the original/others points of where the data originates from

sub-processor' is a commonly used term similar to 'sub-contractor' and does not have a specific legal definition

The term 'data subject' is specific to the GDPR, but is functionally equivalent to the term 'individual' and the ISO/IEC term 'PII Principle'.

Based on use of definitions, the notion of 'Data Subject Right' can be equivalent to 'Individual Right' or 'Right of a Person'

Conversion of identifiable personal data (PII) to un-identifiable personal data

deliver goods and services

Information about demeanor.

Information about demography and demographic characteristics

to create new derivative data from the original data

Derived data is data that is obtained or derived from other data.

A set of rules or guidelines outlining criterias for design

to process data in a way it no longer exists or cannot be repaired

Information about applications or application-like software on a device.

Information about devices

Information about the operating system (OS) or system software that manages hardware or software resources.

Information about software on or related to a device.

Information about linguistic dialects.

carry out direct marketing i.e. marketing communicated directly to the individual

Information about disabilities.

Information about disciplinary actions and its history

to make data known

to disclose data by means of transmission

Information about dislikes or preferences regarding repulsions.

to spread data throughout

Information about divorce(s).

Information about drug test results.

Information about Email address.

Information about the contents of Emails sent or received

Information about employment history

Encryption of data when being stored (persistent encryption)

Encryption of data in transit e.g. when being transferred from one location to another, including sharing

to delete data

Information about ethnic origin

Information about ethnic origins and lineage

Processing that involves evaluation and scoring of individuals

Information about external characteristics that can be observed

Information about family and relationships

Information about family health history.

Information about family and familial structure.

Information about favorites

Information about favorite color.

Information about favorite food.

Information about favorite music.

Information an individual's sexual fetishes

Information about finance including monetary characteristics and transactions

Information about financial accounts.

Information about financial account number

Information about fingerprint used for biometric purposes.

detect and prevent fraud

Information about friends in a social network, including aspects of friendships such as years together or nature of friendship.

Information about location expressed using Global Position System coordinates (GPS)

Information about gender

Information about reputation in the public sphere

Information about location or based on geography (e.g. home address)

Information about groups and memberships included or associated with a social network

Guidelines or Principles regarding processing and operational measures

Information about hair color

Information about health.

Information about health history.

Information about health record.

Information about physical height

Information about historical data related to or relevant regarding history or past events

Information about house(s) owned and ownership history.

Information about the Internet protocol (IP) address of a device

Information that uniquely or semi-uniquely identifies an individual or a group

verify and authorise identity

Calculating or determining the likelihood of impact of an existing or proposed process, which can involve risks or detriments.

improve existing products and services

improve customer-relationship management (CRM) processes

Information about financial income e.g. for individual or household or family

Information about income bracket.

improve the robustness and resilience of services

Information about information health history.

Processing that involves use of innovative and new technologies

Information about intentions

Information about interactions in the public sphere

Information about interests

Informatoin about internal characteristics that cannot be seen or observed

optimise internal resources used by the organisation e.g. resource usage

Information about professional jobs

Information about knowledge and beliefs

Information about language and lingual history.

Processing that takes place at large scales

A legally binding agreement

Legal basis (plural: legal bases) are defined by legislations and regulations, whose applicability is usually restricted to specific jurisdictions.

fulfill obligations or requirements towards achieving compliance with law or regulations.

A human or non-human that constitute as a legally defined entity

Information about personal history regarding events or activities - including their occurrences that might be directly related or have had an influence (e.g. World War, 9/11)

Information about likes or preferences regarding attractions.

Information about the links that an individual has clicked.

Information about loans, whether applied, provided or rejected, and its history

Information about location

Information about the Media Access Control (MAC) address of a device

to transform or publish data to be used

Information about marital status and history

carry out marketing i.e. promoting, selling, and distributing a product or service

Information about marriage(s).

Processing that involves matching and combining of personal data

Information about health, medical conditions or health care

Information about mental health.

to move data from one location to another including deleting the original copy

Non-disclosure Agreements e.g. preserving confidentiality of information

Information about names associated or used as given name or nickname.

conduct research in a non-commercial setting e.g. for a non-profit-organisation (NGO)

to solicit or gather data from someone

Information about an official identifier or identification document

Information about offspring(s).

Information about opinions

optimise activities and services for the consumer or user

optimise activities and services for the Controller

optimise interfaces presented to the user

Organisational measures required/followed when processing data of the declared category

to organize data for arranging or classifying

Information about ownership and history, including renting, borrowing, possessions.

Carrying out an impact assessment regarding privacy risks

Information about Personal identification number (PIN), which is usually used in the process of authenticating the individual as an user accessing a system.

Information about parent(s).

Information about password used in the process of authenticating the individual as an user accessing a system.

process users’ payment transactions.

Information about payment card such as Credit Card, Debit Card.

Information about payment card expiry such as a date.

Information about payment card number.

For a formal legal definition of personal data, see GDPR Art.4-1. An informal definition consists of any data directly or indirectly associated or related to an individual. This definition is equivalent to ISO/IEC definition of Personally Identifiable Information (PII).

A high-level Class to describe 'data handling'. This can consist of personal data being processed for a purpose, involving entities, using technical and organisational measures, applicable risks, rights, and legal basis.

Information about personal possessions.

provide personalised advertising

personalise benefits received by the user

Information about personality (e.g., categorization in terms of the Big Five personality traits)

Information about philosophical beliefs.

Information about physical address.

Information about physical characteristics

Information about physical health.

Information about defining traits or features regarding the body.

Information about visual representation or image e.g. profile photo.

Information about piercings

Information about political affiliation and history

Information about preferences or interests

Information about medical and pharmaceutical prescriptions

Practices regarding selecting appropriate data protection and privacy measures as the 'default' in an activity or service

Practices regarding incorporating data protection and privacy in the design of information and services

Information about privacy preferences

The processing performed on personal data

Information about proclivities in a sexual context

Information about educational or professional career

Information about professional certifications

Information about professional evaluations

Information about professional interviews

to create a profile that describes or represents a person

to replace personal identifiable information by artificial identifiers

PseudoAnonmyization or 'pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

Technical measures consisting of pseudoanonymization and encryption

Information about public life

Information about purchases such as items bought e.g. grocery or clothing

Information about analysis of purchases made and money spent expressed as a habit e.g. monthly shopping trends

The purpose of processing personal data

Information about race or racial history.

A recipient of personal data can be used to indicate any entity that receives personal data. This can be a Third Party, Processor (GDPR), or even a Controller.

to make a record (especially media)

Information about references in the professional context

register, authenticate, and identify in context of a service.

Policy regarding repetition or renewal of existing certification(s)

Information about relationships and relationship history.

Information about religion, religious inclinations, and religious history.

Information about religion and religious beliefs.

to destruct or erase data

A representative of a legal entity

conduct research and development for new methods, products, or services

to apply a restriction on the processsing of specific records

Information about retina and the retinal patterns.

to retrieve data, often in an automated manner

A 'right' is a legal, social, or ethical principle of freedom or entitlement which dictate the norms regarding what is allowed or owed.. Rights as a concept encompass a broad area of norms and entities, and are not specific to Individuals or Data Protection / Privacy. For individual specific rights, see dpv:DataSubjectRight

Risks can be associated with one or more different concepts such as purpose, processing, personal data, technical or organisational measure.

Data Protection Impact Assessments as per GDPR art 35, other Privacy Impact Assessments, threat severity assessment https://www.cnil.fr/en/privacy-impact-assessment-pia

Measures intended to mitigate, minimise, or prevent risk.

Information about location expressed as Room number or similar numbering systems

Information about salary

Information about sales e.g. selling of goods or services

Information about school such as name of school, conduct, or grades obtained.

A seal or a mark indicating proof of certification to some certification or standard

Information about secret text used in the process of authenticating the individual as an user accessing a system, e.g., when recovering a lost password.

There are various sector codes used commonly to indicate the domain of an organisation or business. Examples include NACE (EU), ISIC (UN), SIC and NAICS (USA).

ensure and enforce security e.g. of data

sell data or information to third parties

sell or commercially provide insights obtained from analysis of data

sell products or services

sell or provide targetted advertisements

Information about the consumption of a service, e.g. time and duration of consumption.

optimise service or activity

personalise service or activity