Data Privacy Vocabulary

Conduct or assist with research conducted in an academic context e.g. within universities

Information about linguistic and speech accents.

Methods which restrict access to a place or resource

Information about financial account identifier.

Create, maintain, and manage accounts for purposes of providing services

Information about acquaintainces in a social network.

to come into possession or control of the data

to modify the data, often rewritten into a new form for a new use

Advertising is a subset of Marketing. Advertising by itself does not indicate 'personalisation' i.e. personalised ads.

Information about age

to adjust the data to be in relation to another data

to change the data without changing it into something else

to study or examine the data in detail

to irreversibly alter personal data in such a way that an unique data subject can no longer be identified directly or indirectly or in combination with other data

Altering personal data irreversibly such that a data subject can no longer be identified directly or indirectly, either by the data controller alone or in collaboration with any other party

Information about apartment(s) owned and its history

The document, plan, or process for assessment or determination towards a purpose e.g. assessment of legality or impact assessments

Information about associations in a social network with other individuals, groups, or entities e.g. friend of a friend

Information about attitude.

Information about authentication and information used for authenticating

Information about prior authentication and its outcomes such as login attempts or location.

Protocols involving validation of identity i.e. authentication of a person or information

non-technical authorisation procedures: How is it described on an organisational level, who gets access to the data

An authority with the power to create or enforce laws, or determine their compliance.

Processing that involves automated decision making

Information about bank accounts.

Information about behavior or activity

Information about biometrics and biometric characteristics.

Information about blood type.

Information about the web browser which is used as a 'fingerprint'

Information about browsing behavior.

Information about web browsing referrer or referral, which can be based on location, targeted referrals, direct, organic search, social media or actions, campaigns.

Information about the calls that an individual has made.

Information about cars ownership and ownership history.

Certification mechanisms, seals, and marks for the purpose of demonstrating compliance

Certifications, seals, and marks indicating compliance to regulations or practices

Information about character in the public sphere

The legality of age defining a child varies by jurisdiction. In addition, 'child' is distinct from a 'minor'. For example, the legal age drinking alcohol can be 21, which makes a person of age 20 a 'minor' in this context. In other cases, 'minor' and 'child' are used interchangeably to refer to a person below some legally defined age.

A set of rules or procedures outlining the norms and practices for conducting activities

to gather data from someone

to join or merge data

Conduct research in a commercial setting or with intention to commercialise e.g. in a company or sponsored by a company

Information communicated from or to an individual

Communicate with customers for assisting them, resolving issues, ensuring satisfaction in relation to services provided

This purpose by itself does not sufficiently and clearly indicate what the communication is about. As such, it is recommended to combine it with another purpose to indicate the application. For example, Communication of Payment.

Information about communication metadata in the public sphere

Information about and including connections in a social network

Consent of the Data Subject for specified processing

to consult or query data

Consultation is a process of receiving feedback, advice, or opinion from an external agency

Consultation with an authority or authoritative entity

Information about contacts or used for contacting e.g. email address or phone number

Contextually relevant information about purpose not possible to represent through other concepts

Creation, completion, fulfilment, or performance of a contract involving specified processing

Fulfilment or performance of a contract involving specified processing

Contractual terms governing data handling within the data controller

to produce an exact reprodution of the data

Information about country e.g. residence, travel.

Create and provide personalised recommendations for events

Create and provide personalised recommendations

Create and provide product recommendations e.g. suggest similar products

Information about reputation with regards to money

Information about credit capacity.

Information about credit card number

Information about credit record.

Information about credit score.

Information about credit standing.

Information about credit worthiness.

Information about criminal activity e.g. criminal convictions or jail time

Information about criminal charges.

Information about criminal convictions.

Information about criminal pardons.

Provide assistance, resolve issues, ensure satisfaction in relation to services provided

Manage claims, including repayment of monies owed

Manage past, current, and future customers

Manage customer orders

Manage and analyse interactions with past, current, and potential customers

Monitor solvency of customers for financial diligence

Information about DNA.

Top class: Impact Assessment, and DPIA is sub-class

The terms 'Controller' is usually the more common form of indicating a Data Controller. In ISO/IEC the term 'PII Controller' is used.

The EU, in particular the EDPB, uses data exporter the context of cross-border data transfers/flows. These concepts are not bound by jurisdictional or geopolitical scopes within DPV and can thus be used for any notion of exporting

The EU, in particular the EDPB, uses data importing the context of cross-border data transfers/flows. These concepts are not bound by jurisdictional or geopolitical scopes within DPV and can thus be used for any notion of importing

Records of personal data processing, whether ex-ante or ex-post

A ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

An authority tasked with overseeing legal compliance regarding privacy and data protection laws.

An entity within or authorised by an organisation to monitor internal compliance, inform and advise on data protection obligations and act as a contact point for data subjects and the supervisory authority.

Source is direct point of data collection; 'origin' would indicate the original/others points of where the data originates from

sub-processor' is a commonly used term similar to 'sub-contractor' and does not have a specific legal definition

The term 'data subject' is specific to the GDPR, but is functionally equivalent to the term 'individual' and the ISO/IEC term 'PII Principle'.

Based on use of definitions, the notion of 'Data Subject Right' can be equivalent to 'Individual Right' or 'Right of a Person'

Impact Assessment for conducting data transfers

Specific or special categories and instances of legal basis intended for justifying data transfers

Conversion of identifiable personal data (PII) to un-identifiable personal data

Deliver goods and services requested or asked by consumer

Information about demeanor.

Information about demography and demographic characteristics

to create new derivative data from the original data

Derived data is data that is obtained or derived from other data.

A set of rules or guidelines outlining criterias for design

to process data in a way it no longer exists or cannot be repaired

Information about applications or application-like software on a device.

Information about devices

Information about the operating system (OS) or system software that manages hardware or software resources.

Information about software on or related to a device.

Information about linguistic dialects.

Conduct direct marketing i.e. marketing communicated directly to the individual

Information about disabilities.

Information about disciplinary actions and its history

to make data known

to disclose data by means of transmission

Information about dislikes or preferences regarding repulsions.

Manage disputes by natural persons, private bodies, or public authorities relevant to organisation

to spread data throughout

Information about divorce(s).

Information about drug test results.

Information about Email address.

Information about the contents of Emails sent or received

Information about employment history

Encryption of data when being stored (persistent encryption)

Encryption of data in transit e.g. when being transferred from one location to another, including sharing

Was previously "Access Control". Prefixed to distinguish from Technical Measure.

Was previous "Security". Prefixed to distinguish from TechOrg measures.

Processing necessary to enter into contract

to delete data

Information about ethnic origin

Information about ethnic origins and lineage

Processing that involves evaluation and scoring of individuals

Information about external characteristics that can be observed

Information about family and relationships

Information about family health history.

Information about family and familial structure.

Information about favorites

Information about favorite color.

Information about favorite food.

Information about favorite music.

Information an individual's sexual fetishes

Information about finance including monetary characteristics and transactions

Information about financial accounts.

Information about financial account number

Information about fingerprint used for biometric purposes.

Detect and prevent fraud

Information about friends in a social network, including aspects of friendships such as years together or nature of friendship.

Information about location expressed using Global Position System coordinates (GPS)

Information about gender

Information about reputation in the public sphere

Information about location or based on geography (e.g. home address)

Information about groups and memberships included or associated with a social network

Guidelines or Principles regarding processing and operational measures

Information about hair color

Information about health.

Information about health history.

Information about health record.

Information about physical height

Information about historical data related to or relevant regarding history or past events

Information about house(s) owned and ownership history.

HR is a broad concept. Its management includes, amongst others - recruiting employees and intermediaries e.g. brokers, independent representatives; payroll administration, remunerations, commissions, and wages; and application of social legislation.

Information about the Internet protocol (IP) address of a device

Information that uniquely or semi-uniquely identifies an individual or a group

Verify or authorize identity

Calculating or determining the likelihood of impact of an existing or proposed process, which can involve risks or detriments.

Improve existing products and services

Improve customer-relationship management (CRM) processes

Information about financial income e.g. for individual or household or family

Information about income bracket.

Improve robustness and resilience of services

Information about information health history.

Processing that involves use of innovative and new technologies

Information about intentions

Information about interactions in the public sphere

Information about interests

Informatoin about internal characteristics that cannot be seen or observed

Optimize internal resource availability and usage for organisation

Information about professional jobs

Information about knowledge and beliefs

Information about language and lingual history.

Processing that takes place at large scales

A legally binding agreement

Legal basis (plural: legal bases) are defined by legislations and regulations, whose applicability is usually restricted to specific jurisdictions.

Fulfilment of obligations or requirements towards achieving compliance with law or regulations

A human or non-human that constitute as a legally defined entity

Legal Obligation to conduct the specified processing

Legitimate Interests of a Party as justification for specified processing

Indicates an assessment regarding the use of legitimate interest as a lawful basis by the data controller

Legitimate Interests of a Data Controller in conducting specified processing

Legitimate Interests of a Third Party in conducting specified processing

Information about personal history regarding events or activities - including their occurrences that might be directly related or have had an influence (e.g. World War, 9/11)

Information about likes or preferences regarding attractions.

Information about the links that an individual has clicked.

Information about loans, whether applied, provided or rejected, and its history

Information about location

Information about the Media Access Control (MAC) address of a device

to transform or publish data to be used

Information about marital status and history

Was commercial interest, changed to consider Marketing a separate Purpose category by itself

Information about marriage(s).

Processing that involves matching and combining of personal data

Information about health, medical conditions or health care

Maintain registry of shareholders, members, or partners for governance, administration, and management functions

Information about mental health.

to move data from one location to another including deleting the original copy

Non-disclosure Agreements e.g. preserving confidentiality of information

Information about names associated or used as given name or nickname.

Conduct research in a non-commercial setting e.g. for a non-profit-organisation (NGO)

A notice is an artefact for providing information, choices, or controls

to solicit or gather data from someone

Processing necessary or authorised through the official authority granted to or vested in the Data Controller

Information about an official identifier or identification document

Information about offspring(s).

Information about opinions

Optimize activities and services for consumer or user

Optimize activities and services for provider or controller

Optimize interfaces presented to the user

Manage compliance for organisation in relation to internal policies

Conduct activities and functions for organisation's governance

Manage risk for organisation's activities

Organisational measures required/followed when processing data of the declared category

to organize data for arranging or classifying

Information about ownership and history, including renting, borrowing, possessions.

Carrying out an impact assessment regarding privacy risks

Information about Personal identification number (PIN), which is usually used in the process of authenticating the individual as an user accessing a system.

Information about parent(s).

Information about password used in the process of authenticating the individual as an user accessing a system.

Process payment transactions in relation to service

Information about payment card such as Credit Card, Debit Card.

Information about payment card expiry such as a date.

Information about payment card number.

For a formal legal definition of personal data, see GDPR Art.4-1. An informal definition consists of any data directly or indirectly associated or related to an individual. This definition is equivalent to ISO/IEC definition of Personally Identifiable Information (PII).

A high-level Class to describe 'data handling'. This can consist of personal data being processed for a purpose, involving entities, using technical and organisational measures, applicable risks, rights, and legal basis.

Information about personal possessions.

This term is a blanket purpose category for indicating personalisation of some other purpose, e.g. by creating a subclass of the other concept and Personalisation

Create and provide personalised advertising

Create and provide personalised benefits for a service

Information about personality (e.g., categorization in terms of the Big Five personality traits)

Information about philosophical beliefs.

Information about physical address.

Information about physical characteristics

Information about physical health.

Information about defining traits or features regarding the body.

Information about visual representation or image e.g. profile photo.

Information about piercings

A guidance document outlining any of: procedures, plans, principles, decisions, intent, or protocols.

Information about political affiliation and history

Information about preferences or interests

Information about medical and pharmaceutical prescriptions

Practices regarding selecting appropriate data protection and privacy measures as the 'default' in an activity or service

Practices regarding incorporating data protection and privacy in the design of information and services

Represents a notice or document outlining information regarding privacy

Information about privacy preferences

The processing performed on personal data

Information about proclivities in a sexual context

Information about educational or professional career

Information about professional certifications

Information about professional evaluations

Information about professional interviews

to create a profile that describes or represents a person

to replace personal identifiable information by artificial identifiers

PseudoAnonmyization or 'pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

Technical measures consisting of pseudoanonymization and encryption

Processing is necessary or beneficial for interest of the public or society at large

Information about public life