accepted
Conduct or assist with research conducted in an academic context e.g. within universities
Academic Research
Organisations related to academia or scientific pursuits e.g. Universities, Schools, Research Bodies
AcademicScientificOrganisation
Methods which restrict access to a place or resource
Access Control Method
Create, maintain, and manage accounts for purposes of providing services
Account Management
to come into possession or control of the data
Acquire
to modify the data, often rewritten into a new form for a new use
Adapt
Conduct advertising i.e. process or artefact used to call attention to a product, service, etc. through announcements, notices, or other forms of communication
Advertising is a subset of Marketing. Advertising by itself does not indicate 'personalisation' i.e. personalised ads.
Advertising
The algorithmic logic applied or used
Algorithmic Logic is intended as a broad concept for explaining the use of algorithms and automated decisions making within Processing. To describe the actual algorithm, see the Algorithm concept.
Algorithmic Logic
to adjust the data to be in relation to another data
Align
to change the data without changing it into something else
Alter
to study or examine the data in detail
Analyse
to irreversibly alter personal data in such a way that an unique data subject can no longer be identified directly or indirectly or in combination with other data
Anonymise
Personal Data that has been (fully and completely) anonymised so that it is no longer considered Personal Data
It is advised to carefully consider indicating data is fully or completely anonymised by determining whether the data by itself or in combination with other data can identify a person. Failing this condition, the data should be denoted as PseudoAnonymisedData. To indicate data is anonymised only for a specified entity (e.g. within an organisation), the concept AnonymisedDataWithinScope (as subclass of PseudoAnonymisedData) should be used instead of AnonymisedData.
Anonymised Data
Process by which some personal identifiers are removed or identifiability is reduced
Anonymization
The document, plan, or process for assessment or determination towards a purpose e.g. assessment of legality or impact assessments
Assessment
Protocols involving validation of identity i.e. authentication of a person or information
Authentication Protocols
Procedures for determining authorisation through permission or authority
non-technical authorisation procedures: How is it described on an organisational level, who gets access to the data
Authorisation Procedure
An authority with the power to create or enforce laws, or determine their compliance.
Authority
Processing that involves automated decision making
Automated Decision Making
Certification mechanisms, seals, and marks for the purpose of demonstrating compliance
Certification
Certifications, seals, and marks indicating compliance to regulations or practices
Certification and Seal
A 'child' is a natural legal person who is below a certain legal age depending on the legal jurisdiction.
The legality of age defining a child varies by jurisdiction. In addition, 'child' is distinct from a 'minor'. For example, the legal age drinking alcohol can be 21, which makes a person of age 20 a 'minor' in this context. In other cases, 'minor' and 'child' are used interchangeably to refer to a person below some legally defined age.
Child
A set of rules or procedures outlining the norms and practices for conducting activities
Code of Conduct
to gather data from someone
Collect
to join or merge data
Combine
Conduct research in a commercial setting or with intention to commercialise e.g. in a company or sponsored by a company
Commercial Research
Communicate with customers for assisting them, resolving issues, ensuring satisfaction in relation to services provided
Communication for Customer Care
Manage communication or provide means for communication e.g. to send an email notifying some information
This purpose by itself does not sufficiently and clearly indicate what the communication is about. As such, it is recommended to combine it with another purpose to indicate the application. For example, Communication of Payment.
Communication Management
Altering personal data irreversibly such that a data subject can no longer be identified directly or indirectly, either by the data controller alone or in collaboration with any other party
Complete Anonymisation
Concept
Consent of the Data Subject for specified processing
Consent
The consequence(s) possible or arising from indicated plan or action
Consequence
to consult or query data
Consult
Consultation is a process of receiving feedback, advice, or opinion from an external agency
Consultation
Consultation with an authority or authoritative entity
Consultation with Authority
Contextually relevant information about purpose not possible to represent through other concepts
Context
Creation, completion, fulfilment, or performance of a contract involving specified processing
Contract
Fulfilment or performance of a contract involving specified processing
Contract Performance
Contractual terms governing data handling within or with an entity
ContractualTerms
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between a Data Controller and a Data Processor
Controller-Processor Agreement
to produce an exact reprodution of the data
Copy
A political entity indicative of a sovereign or non-sovereign territorial state comprising of distinct geographical areas
The definition of country is not intended for political interpretation. DPVCG welcomes alternate definitions based in existing sources with global scope, such as UN or ISO.
Country
Create and provide personalised recommendations for events
Create Event Recommendations
Create and provide personalised recommendations
Create Personalized Recommendations
Create and provide product recommendations e.g. suggest similar products
Create Product Recommendations
Provide assistance, resolve issues, ensure satisfaction in relation to services provided
Customer Care
Manage claims, including repayment of monies owed
Customer Claims Management
Manage past, current, and future customers
Customer Management
Manage customer orders
Customer Order Management
Manage and analyse interactions with past, current, and potential customers
Customer Relationship Management
Monitor solvency of customers for financial diligence
Customer Solvency Monitoring
A DPIA involves determining the potential and actual impact of processing activities on individuals or groups of individuals
Top class: Impact Assessment, and DPIA is sub-class
Data Protection Impact Assessment (DPIA)
A broad concept representing 'data' or 'information'
Data
The individual or organisation that decides (or controls) the purpose(s) of processing personal data.
The terms 'Controller' is usually the more common form of indicating a Data Controller. In ISO/IEC the term 'PII Controller' is used.
Data Controller
An entity that 'exports' data where exporting is considered a form of data transfer
The EU, in particular the EDPB, uses data exporter the context of cross-border data transfers/flows. These concepts are not bound by jurisdictional or geopolitical scopes within DPV and can thus be used for any notion of exporting
Data Exporter
An entity that 'imports' data where importing is considered a form of data transfer
The EU, in particular the EDPB, uses data importing the context of cross-border data transfers/flows. These concepts are not bound by jurisdictional or geopolitical scopes within DPV and can thus be used for any notion of importing
Data Importer
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data
For specific role-based data processing agreements, see concepts for Processors and JointDataController agreements.
Data Processing Agreement
Records of personal data processing, whether ex-ante or ex-post
Data Processing Records
A ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Data Processor
An authority tasked with overseeing legal compliance regarding privacy and data protection laws.
Data Protection Authority
modified
An entity within or authorised by an organisation to monitor internal compliance, inform and advise on data protection obligations and act as a contact point for data subjects and the supervisory authority.
Data Protection Officer
The source or origin of data
Source' is the direct point of data collection; 'origin' would indicate the original/others points of where the data originates from.
Data Source
A 'sub-processor' is a processor engaged by another processor
sub-processor' is a commonly used term similar to 'sub-contractor' and does not have a specific legal definition
Data Sub-Processor
The individual (or category of individuals) whose personal data is being processed
The term 'data subject' is specific to the GDPR, but is functionally equivalent to the term 'individual' and the ISO/IEC term 'PII Principle'.
Data Subject
The rights applicable or provided to a Data Subject
Based on use of definitions, the notion of 'Data Subject Right' can be equivalent to 'Individual Right' or 'Right of a Person'
Data Subject Right
Impact Assessment for conducting data transfers
Data Transfer Impact Assessment
Specific or special categories and instances of legal basis intended for justifying data transfers
Data Transfer Legal Basis
Removal of identity or information to reduce identifiability
De-Identification
Deliver goods and services requested or asked by consumer
Delivery of Goods
to create new derivative data from the original data
Derive
Personal Data that is obtained or derived from other data
Derived Data is data that is obtained through processing of existing data, e.g. deriving first name from full name. To indicate data that is derived but which was not present or evident within the source data, InferredPersonalData should be used.
Derived Personal Data
A set of rules or guidelines outlining criterias for design
Design Standard
to process data in a way it no longer exists or cannot be repaired
Destruct
Conduct direct marketing i.e. marketing communicated directly to the individual
Direct Marketing
to make data known
Disclose
to disclose data by means of transmission
Disclose by Transmission
Manage disputes by natural persons, private bodies, or public authorities relevant to organisation
Dispute Management
to spread data throughout
Disseminate
The duration or temporal limitation
Duration
A political union of two or more countries based on economic or trade agreements
EconomicUnion
Technical measures consisting of encryption
Encryption
Encryption of data when being stored (persistent encryption)
Encryption in Rest
Encryption of data in transit e.g. when being transferred from one location to another, including sharing
Encryption in Transfer
Conduct or enforce access control
Was previously "Access Control". Prefixed to distinguish from Technical Measure.
Enforce Access Control
Ensure and enforce security e.g. of data, personnel
Was previous "Security". Prefixed to distinguish from TechOrg measures.
Enforce Security
Processing necessary to enter into contract
Enter Into Contract
to delete data
Erase
Processing that involves evaluation and scoring of individuals
Evaluation and Scoring
An organisation that aims to achieve profit as its primary goal
ForProfitOrganisation
Detect and prevent fraud
Fraud Prevention and Detection
The frequency or information about periods and repetitions in terms of recurrence.
Frequency
An organisation managed or part of government
GovernmentalOrganisation
Guidelines or Principles regarding processing and operational measures
GuidelinesPrinciple
The involvement of humans as a factor or agent in processing
Human Involvement here broadly refers to any involvement by a human in the context of carrying out processing. This may include verification of outcomes, providing input data for making decisions, or overseeing activities.
Human Involvement
Manage humans and 'human resources' within the organisation for effective and efficient operations.
HR is a broad concept. Its management includes, amongst others - recruiting employees and intermediaries e.g. brokers, independent representatives; payroll administration, remunerations, commissions, and wages; and application of social legislation.
Human Resources Management
Verify or authorize identity
Identity Verification
Calculating or determining the likelihood of impact of an existing or proposed process, which can involve risks or detriments.
Impact Assessment
An indication of 'importance' within a context
Importance can be used to express importance, desirability, relevance, or significance as a context.
Importance
Improve existing products and services
Improve Existing Products and Services
Improve customer-relationship management (CRM) processes
Improve Internal CRM Processes
Improve robustness and resilience of services
Increase Service Robustness
A consortium established and comprising on industry organisations
IndustryConsortium
Personal Data that is obtained through inference from other data
Inferred Data is data that is derived from existing data, but which did not originally exist within it, e.g. inferring demographics from browsing history.
Inferred Personal Data
Processing that involves use of innovative and new technologies
Innovative Use of New Technologies
Optimize internal resource availability and usage for organisation
Internal Resource Optimisation
A group of Data Controllers that jointly determine the purposes and means of processing
To indicate the membership, hasDataController may be used
Joint Data Controllers
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between Controllers within a Joint Controllers relationship
Joint Data Controllers Agreement
Processing that takes place at large scales
Large Scale Processing
A law is a set of rules created by government or authorities
Law
A legally binding agreement
Legal Agreement
The Legal basis used to justify processing of personal data
Legal basis (plural: legal bases) are defined by legislations and regulations, whose applicability is usually restricted to specific jurisdictions.
Legal Basis
Fulfilment of obligations or requirements towards achieving compliance with law or regulations
Legal Compliance
A human or non-human 'thing' that constitutes as an entity and which is recognised and defined in law
Legal Entity
Legal Obligation to conduct the specified processing
Legal Obligation
Legitimate Interests of a Party as justification for specified processing
Legitimate Interest
Indicates an assessment regarding the use of legitimate interest as a lawful basis by the data controller
Legitimate Interest Assessment
Legitimate Interests of a Data Controller in conducting specified processing
Legitimate Interest of Controller
Legitimate Interests of a Third Party in conducting specified processing
Legitimate Interest of Third Party
A location is a position, site, or area where something is located
Location may be geographic, physical, or virtual.
Location
to transform or publish data to be used
Make Available
Conduct marketing in relation to organisation or products or services e.g. promoting, selling, and distributing
Was commercial interest, changed to consider Marketing a separate Purpose category by itself
Marketing
Processing that involves matching and combining of personal data
Matching and Combining
Maintain registry of shareholders, members, or partners for governance, administration, and management functions
Members and Partners Management
to move data from one location to another including deleting the original copy
Move
Non-disclosure Agreements e.g. preserving confidentiality of information
Non-Disclosure Agreement (NDA)
e.g. DPA, but not all "DPA" are national authority e.g. EDPS and EDPB
NationalAuthority
A human
Natural Person
An indication of 'necessity' within a context
Necessity can be used to express need, essentiality, requirement, or compulsion.
Necessity
Conduct research in a non-commercial setting e.g. for a non-profit-organisation (NGO)
Non-Commercial Research
An organisation not part of or independent from the government
NonGovernmentalOrganisation
Data that is not Personal Data
The term NonPersonalData is provided to distinguish between PersonalData and other data, e.g. for indicating which data is regulated by privacy laws. To specify personal data that has been anonymised, the concept AnonymisedData should be used.
Non-Personal Data
An organisation that does not aim to achieve profit as its primary goal
NonProfitOrganisation
A source of data that is not publicly accessible or available
Non-Public Data Source
Indication of neither being required nor optional i.e. not relevant or needed
Not Required
A notice is an artefact for providing information, choices, or controls
Notice
to solicit or gather data from someone
Obtain
Processing necessary or authorised through the official authority granted to or vested in the Data Controller
Official Authority of Controller
Optimize activities and services for consumer or user
Optimisation for Consumer
Optimize activities and services for provider or controller
Optimisation for Controller
Optimize interfaces presented to the user
Optimise User Interface
Indication of 'optional' or 'voluntary'
Optional
A general term reflecting a company or a business or a group acting as a unit
Organisation
Manage compliance for organisation in relation to internal policies
Organisation Compliance Management
Conduct activities and functions for organisation's governance
Organisation Governance
Manage risk for organisation's activities
Organisation Risk Management
Organisational measures required/followed when processing data of the declared category
Organisational Measure
to organize data for arranging or classifying
Organise
Carrying out an impact assessment regarding privacy risks
Privacy Impact Assessment
Process payment transactions in relation to service
Payment
Data directly or indirectly associated or related to an individual.
This definition of personal data encompasses the concepts used in GDPR Art.4-1 for 'personal data' and ISO/IEC 2700 for 'personally identifiable information (PII)'.
Personal Data
A high-level Class to describe 'data handling'. This can consist of personal data being processed for a purpose, involving entities, using technical and organisational measures, applicable risks, rights, and legal basis.
Personal Data Handling
Create and provide customisation based on attributes and/or needs of person(s) or context(s).
This term is a blanket purpose category for indicating personalisation of some other purpose, e.g. by creating a subclass of the other concept and Personalisation
Personalisation
Create and provide personalised advertising
Personalised Advertising
Create and provide personalised benefits for a service
Personalised Benefits
A guidance document outlining any of: procedures, plans, principles, decisions, intent, or protocols.
Policy
Indication of 'primary' or 'main' or 'core' importance
Primary Importance
Practices regarding selecting appropriate data protection and privacy measures as the 'default' in an activity or service
Privacy by Default
Practices regarding incorporating data protection and privacy in the design of information and services
Privacy by Design
Represents a notice or document outlining information regarding privacy
Privacy Notice
The processing performed on personal data
Processing
Context or conditions within which processing takes place
Processing Context
to create a profile that describes or represents a person
Profiling
to replace personal identifiable information by artificial identifiers
Pseudo-Anonymise
Personal Data that has undergone a partial (incomplete) anonymisation process such that it is still considered Personal Data
Pseudo-anonymised Data
PseudoAnonmyization or 'pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
Pseudo-Anonymization
A source of data that is publicly accessible or available
The term 'Public' is used here in a broad sense. Actual consideration of what is 'Public Data' can vary based on several contextual or jurisdictional factors such as definition of open, methods of access, permissions and licenses.
Public Data Source
Processing is necessary or beneficial for interest of the public or society at large
Public Interest
Manage and conduct public relations processes. This includes creating goodwill for the organization.
Public Relations
The purpose of processing personal data
Purpose
Entities that receive personal data
A recipient of personal data can be used to indicate any entity that receives personal data. This can be a Third Party, Processor (GDPR), or even a Controller.
Recipient
to make a record (especially media)
Record
Manage creation, storage, and use of records relevant to operations, events, and processes e.g. to store logs or access requests
Record Management
Records of activities within some context such as maintainence tasks or governance functions
Records of Activities
A region is an area or site that is considered a location
Region
e.g. regional DPA in DE / US-CA
RegionalAuthority
A ROPA is a document maintained by Data Controllers detailing processing activities carried out under their responsibility
Tied to compliance processes and documents, decide how to specify those
Register of Processing Activities
Register, authenticate, and identify users or agents in context of a service
Registration and Authentication
Policy regarding repetition or renewal of existing certification(s)
Regularity of Re-certification
Relation
to destruct or erase data
Remove
A representative of a legal entity
Representative
Deliver service as requested by user or consumer
Requested Service Provision
Indication of 'required' or 'necessary'
Required
Conduct research and development for new methods, products, or services
Research and Development
to apply a restriction on the processsing of specific records
Restrict
to retrieve data, often in an automated manner
Retrieve
The right(s) applicable, provided, or expected.
A 'right' is a legal, social, or ethical principle of freedom or entitlement which dictate the norms regarding what is allowed or owed.. Rights as a concept encompass a broad area of norms and entities, and are not specific to Individuals or Data Protection / Privacy. For individual specific rights, see dpv:DataSubjectRight
Right
A risk or possibility or uncertainty of negative effects, impacts, or consequences.
Risks can be associated with one or more different concepts such as purpose, processing, personal data, technical or organisational measure.
Risk
Risk management refers to a coordinated set of activities and methods that is used to direct an organization and to control the many risks that can affect its ability to achieve objectives. The term risk management also refers to the programme that is used to manage risk. This programme includes risk management principles, a risk management framework, and a risk management process.
Data Protection Impact Assessments as per GDPR art 35, other Privacy Impact Assessments, threat severity assessment https://www.cnil.fr/en/privacy-impact-assessment-pia
Risk Management Procedure
Measures intended to mitigate, minimise, or prevent risk.
Risk Mitigation Measure
A safeguard is a precautionary measure for the protection against or mitigation of negative effects
This concept is relevant given the requirement to assert safeguards in cross-border data transfers
Safeguard
Represents a safeguard used for data transfer. Can include technical or organisational measures.
Safeguard for Data Transfer
A seal or a mark indicating proof of certification to some certification or standard
Seal
Indication of 'secondary' or 'minor' or 'auxiliary' importance
Secondary Importance
Indicate or restrict scope for interpretation and application of purpose in a domain e.g. Agriculture, Banking
There are various sector codes used commonly to indicate the domain of an organisation or business. Examples include NACE (EU), ISIC (UN), SIC and NAICS (USA).
Sector
Sell data or information to third parties
Sell here means exchange, submit, or provide in return for direct or indirect compensation. Was subclass of commercial interest, changed to reflect selling something
Sell Data to Third Parties
Sell data or information relevant to insights obtained from analysis of data
Sell Insights from Data
Sell products or services
Sell here means exchange, submit, or provide in return for direct or indirect compensation.
Sell Products
Sell products or services to the user, consumer, or data subjects
Was subclass of commercial interest, changed to reflect selling something
Sell Products to Data Subject
Personal data that is considered 'sensitive' in terms of privacy and/or impact, and therefore requires additional considerations and/or protection
Sensitivity' is a matter of context, and may be defined within legal frameworks. For GDPR, Special categories of personal data are considered a subset of sensitive data. To illustrate the difference between the two, consider the situation where Location data is collected, and which is considered 'sensitive' but not 'special'. As a probable rule, sensitive data require additional considerations whereas special category data requires additional legal basis / justifications.
Sensitive Personal Data
Optimise services or activities
Subclass of ServiceProvision since optimisation is usually considered part of providing services
Service Optimization
Personalise services or product or activities
Subclass of ServiceProvision since personalisation is usually considered part of providing services
Service Personalization
Provide service or product or activities
Service Provision
Manage invoicing, orders, and records in relation to services
Service Order Management
Conduct analysis and reporting related to usage of services or products
Was "UsageAnalytics", prefixed with Service to better reflect scope
Analytics
to give data (or a portion of it) to others
Share
Use of credentials or processes that enable using one set of credentials to authenticate multiple contexts.
Single Sign On
Conduct marketing through social media
Social Media
Sensitive Personal Data whose use requires specific legal permission or justification
The term 'special category' is based on GDPR Art.9, but should not be considered as exlusive to it. DPV considers all Special Categories to also be Sensitive, but whose use is either prohibited or regulated and therefore requires additional legal basis for justification.
Special Category Personal Data
Practices and policies regarding training of staff members
Staff Training
Conditions required or followed regarding storage of data
Storage Condition
Deletion or Erasure of data including any deletion guarantees
Storage Deletion
Duration or temporal limitation on storage of personal data
Storage Duration
Location or geospatial scope where the data is stored
Storage Location
Regularity and temporal span of data restoration/backup mechanisms that guarantee that data is preserved
Storage Restoration
to keep data for future use
Store
to arrange data according to a structure
Structure
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between a Data Processor and a Data (Sub-)Processor
Sub-Processor Agreement
e.g. EU, EDPB
SupraNationalAuthority
A political union of two or more countries with an establishment of common authority
SupraNationalUnion
Processing that involves systematic monitoring of individuals
Systematic Monitoring
Technical measures required/followed when processing data of the declared category
Technical Measure
The Technical and Organisational measures used.
Technical and Organisational Measure
Manage and provide technical processes and functions necessary for delivering services
Technical Service Provision
Technical_Organisational_Measures Concepts
The technology, technological implementation, or any techniques, skills, methods, and processes used or applied
Examples (non-exhaustive) include: Algorithm, Process, Method, Skill, Database, Cookies, Server, Device
Technology
Represents a country outside applicable or compatible jurisdiction as outlined in law
Third Country
A ‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and people who, under the direct authority of the controller or processor, are authorised to process personal data.
Third Party
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between a Data Controller or Processor and a Third Party
Third-Party Agreement
to move data from one place to another
Transfer
to change the form or nature of data
Transform
to send out data
Transmit
to use data
Use
Personalise interfaces presented to the user
User Interface Personalisation
Manage orders, payment, evaluation, and prospecting related to vendors
Vendor Management
Manage payment of vendors
Vendor Payment
Manage orders related to vendors
Vendor Records Management
Manage selection, assessment, and evaluation related to vendors
Vendor Selection Assessment
Processing is necessary or required to protect vital interests of a data subject or other natural person
Vital Interest
Processing is necessary or required to protect vital interests of a data subject
Vital Interest of Data Subject
Processing is necessary or required to protect vital interests of a natural person
Vital Interest of Natural Person
Data Subjects which should be considered 'vulnerable' and therefore would require additional measures and safeguards
Vulnerable Data Subject
Specifies address of a legal entity such as street address or pin code
has address
Indicates the logic used in processing such as for automated decision making
has algorithmic logic
Indicates applicability of a Law
has applicable law
Indicates applicability of authority for a jurisdiction
has authority
Specifies the notice provided in context of consent
The actual notice that the Data Subject received to consent to, either a text or link to a document, which should be usable to decide whether the form or consent was compliant to legislation, e.g. documenting how the user has been informed about rights and implications (such as, right to data portability,right to recitffy, right to erasure, right to restrict processing, right to object, rights regarding automated decision making or profiling, processors, third parties, sub-processors, outside-EEA transfers, automated decision-making, or other necessary details of the privacy-policy). Can be TextOrDocumentOrURI.
has consent notice
Indicates consequences of processing such as those for Data Subjects in relation to automated decision making
Removed plural suffix for consistency
has consequence
Specifies contact details of a legal entity such as phone or email
has contact
Indicates a purpose is restricted to the specified context(s)
has context
Indicates applicability of specified country
has country
Indicates association with Data Controller
has data controller
Indiciates inclusion or applicability of a LegalEntity in the role of Data Exporter
has data exporter
Indiciates inclusion or applicability of a LegalEntity in the role of Data Importer
has data importer
Indiciates inclusion or applicability of a Data Processor
has data processor
Indicates the source or origin of data being processed
has data source
Indicates association with Data Subject
has data subject
Indicates information about duration
has duration
Indicates inclusion or applicability of an entity to some concept
parent property for controller, processor, data subject, authority, etc.?
has entity
Generic property specifying when or under which condition(s) the consent will expire
has expiry
Specifies the condition or event that determines the expiry of consent
Can be TextOrDocumentOrURI
has expiry condition
Specifies the expiry time or duration for consent
has expiry time
Indicates the frequency with which something takes place
has frequency
Indicates Involvement of humans in processing such as within automated decision making process
Human involvement is also relevant to 'human in the loop'
has human involvement
Indicates an identifier associated for identification or reference
has identifier
Indicates inclusion or applicability of a Joint Data Controller
has joint data controllers
Indicates applicability of specified jurisdiction
has jurisdiction
Indicates use or applicability of a Legal Basis
has legal basis
Indicates information about location
has location
Specifies name of a legal entity
has name
Indicates use or applicability of Organisational measure
has organisational measure
Indicates association with Personal Data
has personal data
Indicates association with Personal Data Handling
has personal data handling
Indicates policy applicable or used
has policy
Indicates association with Processing
has processing
Specifies the entity that provisioned or provided consent
Normally this would be the dataSubject, but in some exceptional cases, the consent might be given on behalf by someone else, e.g. parents of minors.
has provision by
Specifies the justification for entity providing consent
This field can be used to proivde a justification why the provision was provided by another DataSubject or legal entity, e.g. declariing the relationship (parent, guardian), in combination with the field provisionBy
has provision by justification
Specifies the method by which consent was provisioned or provided
Can be used to record information of how consent was provided e.g. by a click to a form, in writing, etc., by logging into a system and confirm per email, or with some additional authentication, etc.
has provision method
Specifies the instant in time when consent was given
has provision time
Indicates association with Purpose
has purpose
Indicates Recipient of Personal Data
has recipient
Indiciates inclusion or applicability of a Data Controller as a Recipient of persona data
has recipient data controller
Indiciates inclusion or applicability of a Third Party as a Recipient of persona data
has recipient third party
Specifies representative of the legal entity
has representative
Indicates use or applicability of Right
has right
Indicates applicability of Risk
has risk
Indicates the purpose is associated with activities in the indicated (Economic) Sector(s)
has sector
Indicates information about storage condition
has storage
Indicates use or applicability of Technical measure
has technical measure
Indicates use or applicability of Technical or Organisational measure
has technical and organisational measure
Indicates applicability or relevance of a 'third country'
has third country
Specifies the entity that withdrew consent
Normally this would be the dataSubject, but in some exceptional cases, the consent might be withdraawn on behalf by someone else, e.g. parents of minors.
has withdrawal by
Specifies the justification for entity withdrawing consent
This field can be used to proivde a justification why the weithdrawal was done by another DataSubject or legal entity, e.g. declariing the relationship (parent, guardian), in combination with the field withdrawalBy
has withdrawal by justification
Specifries the method by which consent can be/has been withdrawn
Can be used to record information of how to withdraw consent, e.g. by a click to a form, in writing, etc., by logging into a system and confirm per email, or with some additional authentication, etc.
has withdrawal method
Specifies the instant in time when consent was withdrawn
has withdrawal time
Indicates area, scope, or applicability of an Authority
is authority for
Specifies consent is 'explicit'
The conditions for what is considered 'explicit consent' differ by norms and laws.
is explicit
Indicates implementation details such as entities or agents
The use of 'entity' is inclusive of entities (e.g. Data Processor) as well as 'agent' (e.g. DPO). For indicating technological implementation, the property isImplementedByTechnology should be used.
is implemented by entity
Indicates implementation details such as technologies or processes
The term 'technology' is inclusive of technologies, processes, and methods.
is implemented using technology
isInstanceOf
Indicate a risk is mitigated by specified measure
is mitigated by measure
Indicates the context or application of policy
is policy for
isSubTypeOf
Indicates mitigation of risk(s)
mitigates risk
The GDPR extension to Data Privacy Vocabulary provides terms (classes and properties) related to EU General Data Protection Regulation.
DPV-GDPR: GDPR Extension for DPV