accepted
Evaluation and Scoring
Processing that involves evaluation and scoring of individuals
Safeguard for Data Transfer
Represents a safeguard used for data transfer. Can include technical or organisational measures.
Code of Conduct
A set of rules or procedures outlining the norms and practices for conducting activities
Conduct activities and functions for organisation's governance
Organisation Governance
has sector
Indicates the purpose is associated with activities in the indicated (Economic) Sector(s)
to retrieve data, often in an automated manner
Retrieve
Conduct research in a non-commercial setting e.g. for a non-profit-organisation (NGO)
Non-Commercial Research
Large Scale Processing
Processing that takes place at large scales
Policy regarding repetition or renewal of existing certification(s)
Regularity of Re-certification
Manage and analyse interactions with past, current, and potential customers
Customer Relationship Management
to make data known
Disclose
Structure
to arrange data according to a structure
Legitimate Interest Assessment
Indicates an assessment regarding the use of legitimate interest as a lawful basis by the data controller
Specifies the justification for entity withdrawing consent
has withdrawal by justification
This field can be used to proivde a justification why the weithdrawal was done by another DataSubject or legal entity, e.g. declariing the relationship (parent, guardian), in combination with the field withdrawalBy
Communication for Customer Care
Communicate with customers for assisting them, resolving issues, ensuring satisfaction in relation to services provided
Destruct
to process data in a way it no longer exists or cannot be repaired
Technology
Examples (non-exhaustive) include: Algorithm, Process, Method, Skill, Database, Cookies, Server, Device
The technology, technological implementation, or any techniques, skills, methods, and processes used or applied
Technical_Organisational_Measures Concepts
Fulfilment of obligations or requirements towards achieving compliance with law or regulations
Legal Compliance
Vendor Selection Assessment
Manage selection, assessment, and evaluation related to vendors
A group of Data Controllers that jointly determine the purposes and means of processing
Joint Data Controllers
To indicate the membership, hasDataController may be used
has country
Indicates applicability of specified country
Processing that involves matching and combining of personal data
Matching and Combining
Provide assistance, resolve issues, ensure satisfaction in relation to services provided
Customer Care
Improve Internal CRM Processes
Improve customer-relationship management (CRM) processes
Optimize interfaces presented to the user
Optimise User Interface
has policy
Indicates policy applicable or used
Indication of 'primary' or 'main' or 'core' importance
Primary Importance
A political union of two or more countries with an establishment of common authority
SupraNationalUnion
Data Subject
The term 'data subject' is specific to the GDPR, but is functionally equivalent to the term 'individual' and the ISO/IEC term 'PII Principle'.
The individual (or category of individuals) whose personal data is being processed
has data processor
Indiciates inclusion or applicability of a Data Processor
Importance can be used to express importance, desirability, relevance, or significance as a context.
Importance
An indication of 'importance' within a context
Specifies contact details of a legal entity such as phone or email
has contact
Organisation Risk Management
Manage risk for organisation's activities
Optional
Indication of 'optional' or 'voluntary'
Regularity and temporal span of data restoration/backup mechanisms that guarantee that data is preserved
Storage Restoration
Indicates consequences of processing such as those for Data Subjects in relation to automated decision making
Removed plural suffix for consistency
has consequence
Personal data that is considered 'sensitive' in terms of privacy and/or impact, and therefore requires additional considerations and/or protection
Sensitive Personal Data
Sensitivity' is a matter of context, and may be defined within legal frameworks. For GDPR, Special categories of personal data are considered a subset of sensitive data. To illustrate the difference between the two, consider the situation where Location data is collected, and which is considered 'sensitive' but not 'special'. As a probable rule, sensitive data require additional considerations whereas special category data requires additional legal basis / justifications.
has organisational measure
Indicates use or applicability of Organisational measure
A political union of two or more countries based on economic or trade agreements
EconomicUnion
Recipient
Entities that receive personal data
A recipient of personal data can be used to indicate any entity that receives personal data. This can be a Third Party, Processor (GDPR), or even a Controller.
Indicates information about storage condition
has storage
Customer Solvency Monitoring
Monitor solvency of customers for financial diligence
Align
to adjust the data to be in relation to another data
Encryption of data in transit e.g. when being transferred from one location to another, including sharing
Encryption in Transfer
Indicates use or applicability of Technical or Organisational measure
has technical and organisational measure
Processing
The processing performed on personal data
Technical measures consisting of encryption
Encryption
Notice
A notice is an artefact for providing information, choices, or controls
Indicates mitigation of risk(s)
mitigates risk
Indicate a risk is mitigated by specified measure
is mitigated by measure
Manage compliance for organisation in relation to internal policies
Organisation Compliance Management
Indicates Recipient of Personal Data
has recipient
PseudoAnonmyization or 'pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
Pseudo-Anonymization
Region
A region is an area or site that is considered a location
modified
is implemented by entity
The use of 'entity' is inclusive of entities (e.g. Data Processor) as well as 'agent' (e.g. DPO). For indicating technological implementation, the property isImplementedByTechnology should be used.
Indicates implementation details such as entities or agents
Maintain registry of shareholders, members, or partners for governance, administration, and management functions
Members and Partners Management
An entity within or authorised by an organisation to monitor internal compliance, inform and advise on data protection obligations and act as a contact point for data subjects and the supervisory authority.
Data Protection Officer
Conduct or enforce access control
Enforce Access Control
Was previously "Access Control". Prefixed to distinguish from Technical Measure.
Optimize activities and services for provider or controller
Optimisation for Controller
Make Available
to transform or publish data to be used
Conduct or assist with research conducted in an academic context e.g. within universities
Academic Research
Sell Products
Sell products or services
Sell here means exchange, submit, or provide in return for direct or indirect compensation.
to destruct or erase data
Remove
Impact Assessment
Calculating or determining the likelihood of impact of an existing or proposed process, which can involve risks or detriments.
has joint data controllers
Indicates inclusion or applicability of a Joint Data Controller
Legitimate Interest
Legitimate Interests of a Party as justification for specified processing
The term NonPersonalData is provided to distinguish between PersonalData and other data, e.g. for indicating which data is regulated by privacy laws. To specify personal data that has been anonymised, the concept AnonymisedData should be used.
Data that is not Personal Data
Non-Personal Data
Records of personal data processing, whether ex-ante or ex-post
Data Processing Records
Indicates an identifier associated for identification or reference
has identifier
A consortium established and comprising on industry organisations
IndustryConsortium
Manage creation, storage, and use of records relevant to operations, events, and processes e.g. to store logs or access requests
Record Management
to create new derivative data from the original data
Derive
Data Subjects which should be considered 'vulnerable' and therefore would require additional measures and safeguards
Vulnerable Data Subject
Personalise interfaces presented to the user
User Interface Personalisation
to delete data
Erase
Systematic Monitoring
Processing that involves systematic monitoring of individuals
ContractualTerms
Contractual terms governing data handling within or with an entity
Removal of identity or information to reduce identifiability
De-Identification
Processing necessary or authorised through the official authority granted to or vested in the Data Controller
Official Authority of Controller
Automated Decision Making
Processing that involves automated decision making
Manage past, current, and future customers
Customer Management
Improve existing products and services
Improve Existing Products and Services
Direct Marketing
Conduct direct marketing i.e. marketing communicated directly to the individual
Data Subject Right
Based on use of definitions, the notion of 'Data Subject Right' can be equivalent to 'Individual Right' or 'Right of a Person'
The rights applicable or provided to a Data Subject
Payment
Process payment transactions in relation to service
has data source
Indicates the source or origin of data being processed
Privacy by Default
Practices regarding selecting appropriate data protection and privacy measures as the 'default' in an activity or service
The term 'special category' is based on GDPR Art.9, but should not be considered as exlusive to it. DPV considers all Special Categories to also be Sensitive, but whose use is either prohibited or regulated and therefore requires additional legal basis for justification.
Sensitive Personal Data whose use requires specific legal permission or justification
Special Category Personal Data
Communication Management
This purpose by itself does not sufficiently and clearly indicate what the communication is about. As such, it is recommended to combine it with another purpose to indicate the application. For example, Communication of Payment.
Manage communication or provide means for communication e.g. to send an email notifying some information
Data Exporter
An entity that 'exports' data where exporting is considered a form of data transfer
The EU, in particular the EDPB, uses data exporter the context of cross-border data transfers/flows. These concepts are not bound by jurisdictional or geopolitical scopes within DPV and can thus be used for any notion of exporting
Consequence
The consequence(s) possible or arising from indicated plan or action
Alter
to change the data without changing it into something else
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between Controllers within a Joint Controllers relationship
Joint Data Controllers Agreement
A human
Natural Person
Restrict
to apply a restriction on the processsing of specific records
Ensure and enforce security e.g. of data, personnel
Was previous "Security". Prefixed to distinguish from TechOrg measures.
Enforce Security
Use of credentials or processes that enable using one set of credentials to authenticate multiple contexts.
Single Sign On
Indicates the context or application of policy
is policy for
Required
Indication of 'required' or 'necessary'
Detect and prevent fraud
Fraud Prevention and Detection
This definition of personal data encompasses the concepts used in GDPR Art.4-1 for 'personal data' and ISO/IEC 2700 for 'personally identifiable information (PII)'.
Data directly or indirectly associated or related to an individual.
Personal Data
A source of data that is not publicly accessible or available
Non-Public Data Source
has purpose
Indicates association with Purpose
An organisation that aims to achieve profit as its primary goal
ForProfitOrganisation
Policy
A guidance document outlining any of: procedures, plans, principles, decisions, intent, or protocols.
Processing that involves use of innovative and new technologies
Innovative Use of New Technologies
Legitimate Interests of a Third Party in conducting specified processing
Legitimate Interest of Third Party
has legal basis
Indicates use or applicability of a Legal Basis
Sell Insights from Data
Sell here means exchange, submit, or provide in return for direct or indirect compensation. Was subclass of commercial interest, changed to reflect selling something
Sell data or information relevant to insights obtained from analysis of data
to consult or query data
Consult
to produce an exact reprodution of the data
Copy
Third Country
Represents a country outside applicable or compatible jurisdiction as outlined in law
has personal data
Indicates association with Personal Data
Consent of the Data Subject for specified processing
Consent
Indicates association with Processing
has processing
to come into possession or control of the data
Acquire
Third Party
A ‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and people who, under the direct authority of the controller or processor, are authorised to process personal data.
Design Standard
A set of rules or guidelines outlining criterias for design
The frequency or information about periods and repetitions in terms of recurrence.
Frequency
Data Protection Authority
An authority tasked with overseeing legal compliance regarding privacy and data protection laws.
Specifies the entity that provisioned or provided consent
has provision by
Normally this would be the dataSubject, but in some exceptional cases, the consent might be given on behalf by someone else, e.g. parents of minors.
has jurisdiction
Indicates applicability of specified jurisdiction
Indicates association with Data Subject
has data subject
Human Resources Management
HR is a broad concept. Its management includes, amongst others - recruiting employees and intermediaries e.g. brokers, independent representatives; payroll administration, remunerations, commissions, and wages; and application of social legislation.
Manage humans and 'human resources' within the organisation for effective and efficient operations.
Record
to make a record (especially media)
Specifies address of a legal entity such as street address or pin code
has address
has provision time
Specifies the instant in time when consent was given
This term is a blanket purpose category for indicating personalisation of some other purpose, e.g. by creating a subclass of the other concept and Personalisation
Personalisation
Create and provide customisation based on attributes and/or needs of person(s) or context(s).
Manage disputes by natural persons, private bodies, or public authorities relevant to organisation
Dispute Management
has withdrawal time
Specifies the instant in time when consent was withdrawn
Technical and Organisational Measure
The Technical and Organisational measures used.
Encryption in Rest
Encryption of data when being stored (persistent encryption)
The term 'technology' is inclusive of technologies, processes, and methods.
is implemented using technology
Indicates implementation details such as technologies or processes
Legal Obligation
Legal Obligation to conduct the specified processing
Top class: Impact Assessment, and DPIA is sub-class
Data Protection Impact Assessment (DPIA)
A DPIA involves determining the potential and actual impact of processing activities on individuals or groups of individuals
has representative
Specifies representative of the legal entity
Vendor Payment
Manage payment of vendors
Sell Products to Data Subject
Was subclass of commercial interest, changed to reflect selling something
Sell products or services to the user, consumer, or data subjects
Indicates the frequency with which something takes place
has frequency
Consultation
Consultation is a process of receiving feedback, advice, or opinion from an external agency
Data Transfer Impact Assessment
Impact Assessment for conducting data transfers
Access Control Method
Methods which restrict access to a place or resource
GovernmentalOrganisation
An organisation managed or part of government
Processing is necessary or required to protect vital interests of a natural person
Vital Interest of Natural Person
Consultation with an authority or authoritative entity
Consultation with Authority
e.g. regional DPA in DE / US-CA
RegionalAuthority
Delivery of Goods
Deliver goods and services requested or asked by consumer
to replace personal identifiable information by artificial identifiers
Pseudo-Anonymise
to study or examine the data in detail
Analyse
Internal Resource Optimisation
Optimize internal resource availability and usage for organisation
Certification and Seal
Certifications, seals, and marks indicating compliance to regulations or practices
A representative of a legal entity
Representative
Conduct research in a commercial setting or with intention to commercialise e.g. in a company or sponsored by a company
Commercial Research
Manage orders, payment, evaluation, and prospecting related to vendors
Vendor Management
Specifies the notice provided in context of consent
has consent notice
The actual notice that the Data Subject received to consent to, either a text or link to a document, which should be usable to decide whether the form or consent was compliant to legislation, e.g. documenting how the user has been informed about rights and implications (such as, right to data portability,right to recitffy, right to erasure, right to restrict processing, right to object, rights regarding automated decision making or profiling, processors, third parties, sub-processors, outside-EEA transfers, automated decision-making, or other necessary details of the privacy-policy). Can be TextOrDocumentOrURI.
A ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Data Processor
has data exporter
Indiciates inclusion or applicability of a LegalEntity in the role of Data Exporter
to organize data for arranging or classifying
Organise
Human Involvement
Human Involvement here broadly refers to any involvement by a human in the context of carrying out processing. This may include verification of outcomes, providing input data for making decisions, or overseeing activities.
The involvement of humans as a factor or agent in processing
Normally this would be the dataSubject, but in some exceptional cases, the consent might be withdraawn on behalf by someone else, e.g. parents of minors.
Specifies the entity that withdrew consent
has withdrawal by
is authority for
Indicates area, scope, or applicability of an Authority
Data Privacy Vocabulary
The Data Privacy Vocabulary (DPV) provides terms (classes and properties) to represent information about legally compliant personal data handling, which includes purposes, processing, personal data, technical and organisational measures.
Algorithmic Logic
The algorithmic logic applied or used
Algorithmic Logic is intended as a broad concept for explaining the use of algorithms and automated decisions making within Processing. To describe the actual algorithm, see the Algorithm concept.
Move
to move data from one location to another including deleting the original copy
Data Transfer Legal Basis
Specific or special categories and instances of legal basis intended for justifying data transfers
has human involvement
Human involvement is also relevant to 'human in the loop'
Indicates Involvement of humans in processing such as within automated decision making process
Procedures for determining authorisation through permission or authority
Authorisation Procedure
non-technical authorisation procedures: How is it described on an organisational level, who gets access to the data
Create Event Recommendations
Create and provide personalised recommendations for events
Enter Into Contract
Processing necessary to enter into contract
Vendor Records Management
Manage orders related to vendors
Contextually relevant information about purpose not possible to represent through other concepts
Context
Obtain
to solicit or gather data from someone
Storage Duration
Duration or temporal limitation on storage of personal data
Fulfilment or performance of a contract involving specified processing
Contract Performance
Collect
to gather data from someone
Can be used to record information of how consent was provided e.g. by a click to a form, in writing, etc., by logging into a system and confirm per email, or with some additional authentication, etc.
Specifies the method by which consent was provisioned or provided
has provision method
Risk Management Procedure
Risk management refers to a coordinated set of activities and methods that is used to direct an organization and to control the many risks that can affect its ability to achieve objectives. The term risk management also refers to the programme that is used to manage risk. This programme includes risk management principles, a risk management framework, and a risk management process.
Data Protection Impact Assessments as per GDPR art 35, other Privacy Impact Assessments, threat severity assessment https://www.cnil.fr/en/privacy-impact-assessment-pia
Provide service or product or activities
Service Provision
Location
Location may be geographic, physical, or virtual.
A location is a position, site, or area where something is located
Indicates information about duration
has duration
has personal data handling
Indicates association with Personal Data Handling
Data Controller
The individual or organisation that decides (or controls) the purpose(s) of processing personal data.
The terms 'Controller' is usually the more common form of indicating a Data Controller. In ISO/IEC the term 'PII Controller' is used.
A ROPA is a document maintained by Data Controllers detailing processing activities carried out under their responsibility
Register of Processing Activities
Tied to compliance processes and documents, decide how to specify those
The legality of age defining a child varies by jurisdiction. In addition, 'child' is distinct from a 'minor'. For example, the legal age drinking alcohol can be 21, which makes a person of age 20 a 'minor' in this context. In other cases, 'minor' and 'child' are used interchangeably to refer to a person below some legally defined age.
Child
A 'child' is a natural legal person who is below a certain legal age depending on the legal jurisdiction.
Increase Service Robustness
Improve robustness and resilience of services
Derived Personal Data
Derived Data is data that is obtained through processing of existing data, e.g. deriving first name from full name. To indicate data that is derived but which was not present or evident within the source data, InferredPersonalData should be used.
Personal Data that is obtained or derived from other data
Create and provide product recommendations e.g. suggest similar products
Create Product Recommendations
Safeguard
This concept is relevant given the requirement to assert safeguards in cross-border data transfers
A safeguard is a precautionary measure for the protection against or mitigation of negative effects
Manage invoicing, orders, and records in relation to services
Service Order Management
Indicates use or applicability of Technical measure
has technical measure
An organisation not part of or independent from the government
NonGovernmentalOrganisation
Vital Interest of Data Subject
Processing is necessary or required to protect vital interests of a data subject
has name
Specifies name of a legal entity
Vital Interest
Processing is necessary or required to protect vital interests of a data subject or other natural person
SupraNationalAuthority
e.g. EU, EDPB
has context
Indicates a purpose is restricted to the specified context(s)
An indication of 'necessity' within a context
Necessity can be used to express need, essentiality, requirement, or compulsion.
Necessity
Indicates the logic used in processing such as for automated decision making
has algorithmic logic
A legally binding agreement
Legal Agreement
Indicates association with Data Controller
has data controller
Practices regarding incorporating data protection and privacy in the design of information and services
Privacy by Design
Storage Condition
Conditions required or followed regarding storage of data
Indicates applicability of authority for a jurisdiction
has authority
Country
A political entity indicative of a sovereign or non-sovereign territorial state comprising of distinct geographical areas
The definition of country is not intended for political interpretation. DPVCG welcomes alternate definitions based in existing sources with global scope, such as UN or ISO.
The right(s) applicable, provided, or expected.
Right
A 'right' is a legal, social, or ethical principle of freedom or entitlement which dictate the norms regarding what is allowed or owed.. Rights as a concept encompass a broad area of norms and entities, and are not specific to Individuals or Data Protection / Privacy. For individual specific rights, see dpv:DataSubjectRight
Specifies the condition or event that determines the expiry of consent
Can be TextOrDocumentOrURI
has expiry condition
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between a Data Processor and a Data (Sub-)Processor
Sub-Processor Agreement
Create and provide personalised advertising
Personalised Advertising
Indication of 'secondary' or 'minor' or 'auxiliary' importance
Secondary Importance
Advertising
Advertising is a subset of Marketing. Advertising by itself does not indicate 'personalisation' i.e. personalised ads.
Conduct advertising i.e. process or artefact used to call attention to a product, service, etc. through announcements, notices, or other forms of communication
Generic property specifying when or under which condition(s) the consent will expire
has expiry
isInstanceOf
Records of Activities
Records of activities within some context such as maintainence tasks or governance functions
A law is a set of rules created by government or authorities
Law
Legitimate Interest of Controller
Legitimate Interests of a Data Controller in conducting specified processing
Legal Basis
The Legal basis used to justify processing of personal data
Legal basis (plural: legal bases) are defined by legislations and regulations, whose applicability is usually restricted to specific jurisdictions.
A human or non-human 'thing' that constitutes as an entity and which is recognised and defined in law
Legal Entity
Storage Deletion
Deletion or Erasure of data including any deletion guarantees
Authority
An authority with the power to create or enforce laws, or determine their compliance.
to give data (or a portion of it) to others
Share
Identity Verification
Verify or authorize identity
Conduct research and development for new methods, products, or services
Research and Development
An organisation that does not aim to achieve profit as its primary goal
NonProfitOrganisation
Disclose by Transmission
to disclose data by means of transmission
Create Personalized Recommendations
Create and provide personalised recommendations
Altering personal data irreversibly such that a data subject can no longer be identified directly or indirectly, either by the data controller alone or in collaboration with any other party
Complete Anonymisation
Process by which some personal identifiers are removed or identifiability is reduced
Anonymization
has recipient third party
Indiciates inclusion or applicability of a Third Party as a Recipient of persona data
Conduct marketing through social media
Social Media
Sell data or information to third parties
Sell Data to Third Parties
Inferred Personal Data
Personal Data that is obtained through inference from other data
Inferred Data is data that is derived from existing data, but which did not originally exist within it, e.g. inferring demographics from browsing history.
Personal Data that has undergone a partial (incomplete) anonymisation process such that it is still considered Personal Data
Pseudo-anonymised Data
Non-Disclosure Agreement (NDA)
Non-disclosure Agreements e.g. preserving confidentiality of information
Data Processing Agreement
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data
For specific role-based data processing agreements, see concepts for Processors and JointDataController agreements.
Disseminate
to spread data throughout
NationalAuthority
e.g. DPA, but not all "DPA" are national authority e.g. EDPS and EDPB
Indication of neither being required nor optional i.e. not relevant or needed
Not Required
to create a profile that describes or represents a person
Profiling
Organisational measures required/followed when processing data of the declared category
Organisational Measure
Indicates applicability of a Law
has applicable law
Privacy Impact Assessment
Carrying out an impact assessment regarding privacy risks
Practices and policies regarding training of staff members
Staff Training
Personalise services or product or activities
Subclass of ServiceProvision since personalisation is usually considered part of providing services
Service Personalization
Controller-Processor Agreement
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between a Data Controller and a Data Processor
GuidelinesPrinciple
Guidelines or Principles regarding processing and operational measures
Technical Measure
Technical measures required/followed when processing data of the declared category
Marketing
Conduct marketing in relation to organisation or products or services e.g. promoting, selling, and distributing
Was commercial interest, changed to consider Marketing a separate Purpose category by itself
to change the form or nature of data
Transform
Protocols involving validation of identity i.e. authentication of a person or information
Authentication Protocols
Processing is necessary or beneficial for interest of the public or society at large
Public Interest
Indiciates inclusion or applicability of a LegalEntity in the role of Data Importer
has data importer
parent property for controller, processor, data subject, authority, etc.?
Indicates inclusion or applicability of an entity to some concept
has entity
Purpose
The purpose of processing personal data
Represents a notice or document outlining information regarding privacy
Privacy Notice
has expiry time
Specifies the expiry time or duration for consent
This field can be used to proivde a justification why the provision was provided by another DataSubject or legal entity, e.g. declariing the relationship (parent, guardian), in combination with the field provisionBy
has provision by justification
Specifies the justification for entity providing consent
Storage Location
Location or geospatial scope where the data is stored
Manage customer orders
Customer Order Management
Specifies consent is 'explicit'
The conditions for what is considered 'explicit consent' differ by norms and laws.
is explicit
Contract
Creation, completion, fulfilment, or performance of a contract involving specified processing
Indicates use or applicability of Right
has right
Requested Service Provision
Deliver service as requested by user or consumer
The duration or temporal limitation
Duration
Optimise services or activities
Service Optimization
Subclass of ServiceProvision since optimisation is usually considered part of providing services
to join or merge data
Combine
Risk
Risks can be associated with one or more different concepts such as purpose, processing, personal data, technical or organisational measure.
A risk or possibility or uncertainty of negative effects, impacts, or consequences.
Personalised Benefits
Create and provide personalised benefits for a service
The document, plan, or process for assessment or determination towards a purpose e.g. assessment of legality or impact assessments
Assessment
Organisations related to academia or scientific pursuits e.g. Universities, Schools, Research Bodies
AcademicScientificOrganisation
A general term reflecting a company or a business or a group acting as a unit
Organisation
Indicates applicability or relevance of a 'third country'
has third country
Personal Data Handling
A high-level Class to describe 'data handling'. This can consist of personal data being processed for a purpose, involving entities, using technical and organisational measures, applicable risks, rights, and legal basis.
Optimize activities and services for consumer or user
Optimisation for Consumer
has risk
Indicates applicability of Risk
Conduct analysis and reporting related to usage of services or products
Was "UsageAnalytics", prefixed with Service to better reflect scope
Analytics
has location
Indicates information about location
Customer Claims Management
Manage claims, including repayment of monies owed
Personal Data that has been (fully and completely) anonymised so that it is no longer considered Personal Data
It is advised to carefully consider indicating data is fully or completely anonymised by determining whether the data by itself or in combination with other data can identify a person. Failing this condition, the data should be denoted as PseudoAnonymisedData. To indicate data is anonymised only for a specified entity (e.g. within an organisation), the concept AnonymisedDataWithinScope (as subclass of PseudoAnonymisedData) should be used instead of AnonymisedData.
Anonymised Data
Certification
Certification mechanisms, seals, and marks for the purpose of demonstrating compliance
Indicate or restrict scope for interpretation and application of purpose in a domain e.g. Agriculture, Banking
There are various sector codes used commonly to indicate the domain of an organisation or business. Examples include NACE (EU), ISIC (UN), SIC and NAICS (USA).
Sector
A seal or a mark indicating proof of certification to some certification or standard
Seal
Specifries the method by which consent can be/has been withdrawn
Can be used to record information of how to withdraw consent, e.g. by a click to a form, in writing, etc., by logging into a system and confirm per email, or with some additional authentication, etc.
has withdrawal method
to modify the data, often rewritten into a new form for a new use
Adapt
Register, authenticate, and identify users or agents in context of a service
Registration and Authentication
to irreversibly alter personal data in such a way that an unique data subject can no longer be identified directly or indirectly or in combination with other data
Anonymise
Manage and provide technical processes and functions necessary for delivering services
Technical Service Provision
Public Relations
Manage and conduct public relations processes. This includes creating goodwill for the organization.
Create, maintain, and manage accounts for purposes of providing services
Account Management
A 'sub-processor' is a processor engaged by another processor
sub-processor' is a commonly used term similar to 'sub-contractor' and does not have a specific legal definition
Data Sub-Processor
A source of data that is publicly accessible or available
Public Data Source
The term 'Public' is used here in a broad sense. Actual consideration of what is 'Public Data' can vary based on several contextual or jurisdictional factors such as definition of open, methods of access, permissions and licenses.
Indiciates inclusion or applicability of a Data Controller as a Recipient of persona data
has recipient data controller
to send out data
Transmit
Context or conditions within which processing takes place
Processing Context
The source or origin of data
Source' is the direct point of data collection; 'origin' would indicate the original/others points of where the data originates from.
Data Source
Data Importer
The EU, in particular the EDPB, uses data importing the context of cross-border data transfers/flows. These concepts are not bound by jurisdictional or geopolitical scopes within DPV and can thus be used for any notion of importing
An entity that 'imports' data where importing is considered a form of data transfer
Data
A broad concept representing 'data' or 'information'
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between a Data Controller or Processor and a Third Party
Third-Party Agreement
Store
to keep data for future use
to use data
Use
Risk Mitigation Measure
Measures intended to mitigate, minimise, or prevent risk.
Transfer
to move data from one place to another
isSubTypeOf
Relation
Concept