accepted
Customer Solvency Monitoring
Monitor solvency of customers for financial diligence
The term 'special category' is based on GDPR Art.9, but should not be considered as exlusive to it. DPV considers all Special Categories to also be Sensitive, but whose use is either prohibited or regulated and therefore requires additional legal basis for justification.
modified
Special Category Personal Data
Sensitive Personal Data whose use requires specific legal permission or justification
has identifier
Indicates an identifier associated for identification or reference
to adjust the data to be in relation to another data
Align
Advertising is a subset of Marketing. Advertising by itself does not indicate 'personalisation' i.e. personalised ads.
Conduct advertising i.e. process or artefact used to call attention to a product, service, etc. through announcements, notices, or other forms of communication
Advertising
Records of Activities
Records of activities within some context such as maintainence tasks or governance functions
The algorithmic logic applied or used
Algorithmic Logic
Algorithmic Logic is intended as a broad concept for explaining the use of algorithms and automated decisions making within Processing. To describe the actual algorithm, see the Algorithm concept.
Sell products or services to the user, consumer, or data subjects
Was subclass of commercial interest, changed to reflect selling something
Sell Products to Data Subject
A set of rules or guidelines outlining criterias for design
Design Standard
Right
A 'right' is a legal, social, or ethical principle of freedom or entitlement which dictate the norms regarding what is allowed or owed.. Rights as a concept encompass a broad area of norms and entities, and are not specific to Individuals or Data Protection / Privacy. For individual specific rights, see dpv:DataSubjectRight
The right(s) applicable, provided, or expected.
Optimisation for Consumer
Optimize activities and services for consumer or user
Indicates use or applicability of Technical measure
has technical measure
Account Management
Create, maintain, and manage accounts for purposes of providing services
has withdrawal method
Can be used to record information of how to withdraw consent, e.g. by a click to a form, in writing, etc., by logging into a system and confirm per email, or with some additional authentication, etc.
Specifries the method by which consent can be/has been withdrawn
Data Privacy Vocabulary
The Data Privacy Vocabulary (DPV) provides terms (classes and properties) to represent information about legally compliant personal data handling, which includes purposes, processing, personal data, technical and organisational measures.
Processing that involves systematic monitoring of individuals
Systematic Monitoring
Use of credentials or processes that enable using one set of credentials to authenticate multiple contexts.
Single Sign On
Disclose
to make data known
An organisation managed or part of government
GovernmentalOrganisation
An authority tasked with overseeing legal compliance regarding privacy and data protection laws.
Data Protection Authority
There are various sector codes used commonly to indicate the domain of an organisation or business. Examples include NACE (EU), ISIC (UN), SIC and NAICS (USA).
Indicate or restrict scope for interpretation and application of purpose in a domain e.g. Agriculture, Banking
Sector
Technical_Organisational_Measures Concepts
Generated Personal Data
Generated Data is used to indicate data that is produced and is not derived or inferred from other data
Personal Data that is generated or brought into existence without relation to existing data i.e. it is not derived or inferred from other data
The EU, in particular the EDPB, uses data exporter the context of cross-border data transfers/flows. These concepts are not bound by jurisdictional or geopolitical scopes within DPV and can thus be used for any notion of exporting
An entity that 'exports' data where exporting is considered a form of data transfer
Data Exporter
Disseminate
to spread data throughout
has recipient
Indicates Recipient of Personal Data
Personalised Advertising
Create and provide personalised advertising
A guidance document outlining any of: procedures, plans, principles, decisions, intent, or protocols.
Policy
Anonymise
to irreversibly alter personal data in such a way that an unique data subject can no longer be identified directly or indirectly or in combination with other data
Customer Order Management
Manage customer orders
Manage communication or provide means for communication e.g. to send an email notifying some information
This purpose by itself does not sufficiently and clearly indicate what the communication is about. As such, it is recommended to combine it with another purpose to indicate the application. For example, Communication of Payment.
Communication Management
Certifications, seals, and marks indicating compliance to regulations or practices
Certification and Seal
An organisation not part of or independent from the government
NonGovernmentalOrganisation
Create Product Recommendations
Create and provide product recommendations e.g. suggest similar products
Dispute Management
Manage disputes by natural persons, private bodies, or public authorities relevant to organisation
Technical measures required/followed when processing data of the declared category
Technical Measure
The terms 'Controller' is usually the more common form of indicating a Data Controller. In ISO/IEC the term 'PII Controller' is used.
Data Controller
The individual or organisation that decides (or controls) the purpose(s) of processing personal data.
Privacy Notice
Represents a notice or document outlining information regarding privacy
Fulfilment or performance of a contract involving specified processing
Contract Performance
Benefit
Impact(s) that acts as or causes benefits
Legitimate Interests of a Third Party in conducting specified processing
Legitimate Interest of Third Party
Controller-Processor Agreement
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between a Data Controller and a Data Processor
Indicates the source or origin of data being processed
has data source
Organisational measures required/followed when processing data of the declared category
Organisational Measure
Direct Marketing
Conduct direct marketing i.e. marketing communicated directly to the individual
Indicates use or applicability of Right
has right
Personal Data that has been collected from another source such as the Data Subject
Collected Personal Data
To indicate the source of data, use the DataSource concept with the hasDataSource relation
Joint Data Controllers Agreement
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between Controllers within a Joint Controllers relationship
Public Interest
Processing is necessary or beneficial for interest of the public or society at large
Indication of 'optional' or 'voluntary'
Optional
A region is an area or site that is considered a location
Region
NationalAuthority
An authority tasked with overseeing legal compliance for a nation
Enforce Security
Was previous "Security". Prefixed to distinguish from TechOrg measures.
Ensure and enforce security e.g. of data, personnel
to move data from one place to another
Transfer
Guidelines or Principles regarding processing and operational measures
GuidelinesPrinciple
to create a profile that describes or represents a person
Profiling
Was previously "Access Control". Prefixed to distinguish from Technical Measure.
Enforce Access Control
Conduct or enforce access control
Personalised Benefits
Create and provide personalised benefits for a service
Detect and prevent fraud
Fraud Prevention and Detection
Consent
Consent of the Data Subject for specified processing
The Technical and Organisational measures used.
Technical and Organisational Measure
has technical and organisational measure
Indicates use or applicability of Technical or Organisational measure
A broad concept representing 'data' or 'information'
Data
Necessity
An indication of 'necessity' within a context
Necessity can be used to express need, essentiality, requirement, or compulsion.
Data Importer
An entity that 'imports' data where importing is considered a form of data transfer
The EU, in particular the EDPB, uses data importing the context of cross-border data transfers/flows. These concepts are not bound by jurisdictional or geopolitical scopes within DPV and can thus be used for any notion of importing
Contract
Creation, completion, fulfilment, or performance of a contract involving specified processing
Manage orders related to vendors
Vendor Records Management
Impact that acts as or causes harms
Harm
A source of data that is publicly accessible or available
The term 'Public' is used here in a broad sense. Actual consideration of what is 'Public Data' can vary based on several contextual or jurisdictional factors such as definition of open, methods of access, permissions and licenses.
Public Data Source
Primary Importance
Indication of 'primary' or 'main' or 'core' importance
is implemented by entity
Indicates implementation details such as entities or agents
The use of 'entity' is inclusive of entities (e.g. Data Processor) as well as 'agent' (e.g. DPO). For indicating technological implementation, the property isImplementedByTechnology should be used.
Customer Management
Manage past, current, and future customers
Code of Conduct
A set of rules or procedures outlining the norms and practices for conducting activities
Data Transfer Legal Basis
Specific or special categories and instances of legal basis intended for justifying data transfers
Removed plural suffix for consistency
has consequence
Indicates consenquence(s) possible or arising from specified concept
Specifies name of a legal entity
has name
Delivery of Goods
Deliver goods and services requested or asked by consumer
Indicates association with Personal Data Handling
has personal data handling
Technical Service Provision
Manage and provide technical processes and functions necessary for delivering services
Technical measures consisting of encryption
Encryption
Indiciates inclusion or applicability of a Data Controller as a Recipient of persona data
has recipient data controller
Manage creation, storage, and use of records relevant to operations, events, and processes e.g. to store logs or access requests
Record Management
Transform
to change the form or nature of data
Practices and policies regarding training of staff members
Staff Training
Law
A law is a set of rules created by government or authorities
Targeted Advertising
Create and provide pesonalised advertisement where the personalisation is targeted to a specific individual or group of individuals
sub-processor' is a commonly used term similar to 'sub-contractor' and does not have a specific legal definition
A 'sub-processor' is a processor engaged by another processor
Data Sub-Processor
Personalise interfaces presented to the user
User Interface Personalisation
Legal basis (plural: legal bases) are defined by legislations and regulations, whose applicability is usually restricted to specific jurisdictions.
The Legal basis used to justify processing of personal data
Legal Basis
Personalise services or product or activities
Service Personalization
Subclass of ServiceProvision since personalisation is usually considered part of providing services
Inferred Personal Data
Personal Data that is obtained through inference from other data
Inferred Data is derived data generated from existing data, but which did not originally exist within it, e.g. inferring demographics from browsing history.
to destruct or erase data
Remove
Evaluation and Scoring
Processing that involves evaluation and scoring of individuals
Impact Assessment
Calculating or determining the likelihood of impact of an existing or proposed process, which can involve risks or detriments.
has data protection officer
Specifices an associated data protection officer
Duration
The duration or temporal limitation
Manage compliance for organisation in relation to internal policies
Organisation Compliance Management
has third country
Indicates applicability or relevance of a 'third country'
Use
to use data
Communication for Customer Care
Communicate with customers for assisting them, resolving issues, ensuring satisfaction in relation to services provided
Data Source
Source' is the direct point of data collection; 'origin' would indicate the original/others points of where the data originates from.
The source or origin of data
Protocols involving validation of identity i.e. authentication of a person or information
Authentication Protocols
has contact
Specifies contact details of a legal entity such as phone or email
Based on use of definitions, the notion of 'Data Subject Right' can be equivalent to 'Individual Right' or 'Right of a Person'
The rights applicable or provided to a Data Subject
Data Subject Right
An entity within or authorised by an organisation to monitor internal compliance, inform and advise on data protection obligations and act as a contact point for data subjects and the supervisory authority.
Data Protection Officer
Tied to compliance processes and documents, decide how to specify those
A ROPA is a document maintained by Data Controllers detailing processing activities carried out under their responsibility
Register of Processing Activities
De-Identification
Removal of identity or information to reduce identifiability
to join or merge data
Combine
has address
Specifies address of a legal entity such as street address or pin code
Processing that takes place at large scales
Large Scale Processing
Legitimate Interest of Controller
Legitimate Interests of a Data Controller in conducting specified processing
Data Processing Records
Records of personal data processing, whether ex-ante or ex-post
has data controller
Indicates association with Data Controller
Indicates impact(s) possible or arising as consequences from specified concept
has impact
has provision by justification
This field can be used to proivde a justification why the provision was provided by another DataSubject or legal entity, e.g. declariing the relationship (parent, guardian), in combination with the field provisionBy
Specifies the justification for entity providing consent
Indicates association with Data Subject
has data subject
has data importer
Indiciates inclusion or applicability of a LegalEntity in the role of Data Importer
Increase Service Robustness
Improve robustness and resilience of services
Sensitivity' is a matter of context, and may be defined within legal frameworks. For GDPR, Special categories of personal data are considered a subset of sensitive data. To illustrate the difference between the two, consider the situation where Location data is collected, and which is considered 'sensitive' but not 'special'. As a probable rule, sensitive data require additional considerations whereas special category data requires additional legal basis / justifications.
Sensitive Personal Data
Personal data that is considered 'sensitive' in terms of privacy and/or impact, and therefore requires additional considerations and/or protection
HR is a broad concept. Its management includes, amongst others - recruiting employees and intermediaries e.g. brokers, independent representatives; payroll administration, remunerations, commissions, and wages; and application of social legislation.
Human Resources Management
Manage humans and 'human resources' within the organisation for effective and efficient operations.
A safeguard is a precautionary measure for the protection against or mitigation of negative effects
Safeguard
This concept is relevant given the requirement to assert safeguards in cross-border data transfers
Indicates applicability of authority for a jurisdiction
has authority
Manage and analyse interactions with past, current, and potential customers
Customer Relationship Management
Indicates association with Personal Data
has personal data
Processing is necessary or required to protect vital interests of a natural person
Vital Interest of Natural Person
Indicates area, scope, or applicability of an Authority
is authority for
A consortium established and comprising on industry organisations
IndustryConsortium
Manage selection, assessment, and evaluation related to vendors
Vendor Selection Assessment
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between a Data Processor and a Data (Sub-)Processor
Sub-Processor Agreement
Indicates risks mitigated by this concept
mitigates risk
to send out data
Transmit
Legal Entity
A human or non-human 'thing' that constitutes as an entity and which is recognised and defined in law
Public Relations
Manage and conduct public relations processes. This includes creating goodwill for the organization.
ForProfitOrganisation
An organisation that aims to achieve profit as its primary goal
This concept denote a Data Subject or a group are vulnerable, but not what vulnerability they possess or its context. This information can be provided additionally as comments, or as separate concepts and relations. Proposals for this are welcome.
Vulnerable Data Subject
Data Subjects which should be considered 'vulnerable' and therefore would require additional measures and safeguards
Commercial Research
Conduct research in a commercial setting or with intention to commercialise e.g. in a company or sponsored by a company
Collect
to gather data from someone
Data Protection Impact Assessment (DPIA)
Top class: Impact Assessment, and DPIA is sub-class
A DPIA involves determining the potential and actual impact of processing activities on individuals or groups of individuals
Service Provision
Provide service or product or activities
Indicates association with Purpose
has purpose
Processing
The processing performed on personal data
Requested Service Provision
Deliver service as requested by user or consumer
Encryption in Rest
Encryption of data when being stored (persistent encryption)
Encryption in Transfer
Encryption of data in transit e.g. when being transferred from one location to another, including sharing
RegionalAuthority
An authority tasked with overseeing legal compliance for a region
Policy regarding repetition or renewal of existing certification(s)
Regularity of Re-certification
Normally this would be the dataSubject, but in some exceptional cases, the consent might be withdraawn on behalf by someone else, e.g. parents of minors.
has withdrawal by
Specifies the entity that withdrew consent
Personal Data
This definition of personal data encompasses the concepts used in GDPR Art.4-1 for 'personal data' and ISO/IEC 2700 for 'personally identifiable information (PII)'.
Data directly or indirectly associated or related to an individual.
Personalisation
Create and provide customisation based on attributes and/or needs of person(s) or context(s).
This term is a blanket purpose category for indicating personalisation of some other purpose, e.g. by creating a subclass of the other concept and Personalisation
Indicates use or applicability of a Legal Basis
has legal basis
Contractual terms governing data handling within or with an entity
ContractualTerms
Adult
A natural person that is not a child i.e. has attained some legally specified age of adulthood
The consequence(s) possible or arising from specified context
Consequence
Processing necessary or authorised through the official authority granted to or vested in the Data Controller
Official Authority of Controller
Consequence of Failure
The consequence(s) possible or arising from failure of specified context
is policy for
Indicates the context or application of policy
A source of data that is not publicly accessible or available
Non-Public Data Source
has data exporter
Indiciates inclusion or applicability of a LegalEntity in the role of Data Exporter
Privacy by Default
Practices regarding selecting appropriate data protection and privacy measures as the 'default' in an activity or service
Organisation
A general term reflecting a company or a business or a group acting as a unit
has expiry condition
Can be TextOrDocumentOrURI
Specifies the condition or event that determines the expiry of consent
Personal Data that has been (fully and completely) anonymised so that it is no longer considered Personal Data
It is advised to carefully consider indicating data is fully or completely anonymised by determining whether the data by itself or in combination with other data can identify a person. Failing this condition, the data should be denoted as PseudoAnonymisedData. To indicate data is anonymised only for a specified entity (e.g. within an organisation), the concept AnonymisedDataWithinScope (as subclass of PseudoAnonymisedData) should be used instead of AnonymisedData.
Anonymised Data
has organisational measure
Indicates use or applicability of Organisational measure
Consequence as Side-Effect
The consequence(s) possible or arising as a side-effect of specified context
Contextually relevant information about purpose not possible to represent through other concepts
Context
Pseudo-Anonymise
to replace personal identifiable information by artificial identifiers
Privacy Impact Assessment
Carrying out an impact assessment regarding privacy risks
Vendor Management
Manage orders, payment, evaluation, and prospecting related to vendors
Indicates the thing (e.g. plan, process, or entity) affected by an impact
has impact on
Human involvement is also relevant to 'human in the loop'
Indicates Involvement of humans in processing such as within automated decision making process
has human involvement
Pseudo-Anonymization
PseudoAnonmyization or 'pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
For specific role-based data processing agreements, see concepts for Processors and JointDataController agreements.
Data Processing Agreement
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data
Indicates information about duration
has duration
to change the data without changing it into something else
Alter
Specifies the expiry time or duration for consent
has expiry time
To indicate the membership, hasDataController may be used
Joint Data Controllers
A group of Data Controllers that jointly determine the purposes and means of processing
Sell here means exchange, submit, or provide in return for direct or indirect compensation.
Sell Products
Sell products or services
Damage
Impact that acts as or causes damages
Academic Research
Conduct or assist with research conducted in an academic context e.g. within universities
has frequency
Indicates the frequency with which something takes place
Service Optimization
Subclass of ServiceProvision since optimisation is usually considered part of providing services
Optimise services or activities
Storage Deletion
Deletion or Erasure of data including any deletion guarantees
Optimize internal resource availability and usage for organisation
Internal Resource Optimisation
Risk Management Procedure
Risk management refers to a coordinated set of activities and methods that is used to direct an organization and to control the many risks that can affect its ability to achieve objectives. The term risk management also refers to the programme that is used to manage risk. This programme includes risk management principles, a risk management framework, and a risk management process.
Data Protection Impact Assessments as per GDPR art 35, other Privacy Impact Assessments, threat severity assessment https://www.cnil.fr/en/privacy-impact-assessment-pia
Certification mechanisms, seals, and marks for the purpose of demonstrating compliance
Certification
Indicates the specified concepts is 'after' this concept in some context
is after
has processing
Indicates association with Processing
Indicates the logic used in processing such as for automated decision making
has algorithmic logic
Enter Into Contract
Processing necessary to enter into contract
Customer Claims Management
Manage claims, including repayment of monies owed
Vital Interest of Data Subject
Processing is necessary or required to protect vital interests of a data subject
Destruct
to process data in a way it no longer exists or cannot be repaired
Retrieve
to retrieve data, often in an automated manner
Consultation
Consultation is a process of receiving feedback, advice, or opinion from an external agency
Practices regarding incorporating data protection and privacy in the design of information and services
Privacy by Design
Location
Location may be geographic, physical, or virtual.
A location is a position, site, or area where something is located
Restrict
to apply a restriction on the processsing of specific records
Seal
A seal or a mark indicating proof of certification to some certification or standard
The involvement of humans in specified context
Human Involvement
Human Involvement here broadly refers to any involvement by a human in the context of carrying out processing. This may include verification of outcomes, providing input data for making decisions, or overseeing activities.
Payment
Process payment transactions in relation to service
Relation
EconomicUnion
A political union of two or more countries based on economic or trade agreements
Social Media
Conduct marketing through social media
An organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries
International Organisation
Legal Agreement
A legally binding agreement
Importance can be used to express importance, desirability, relevance, or significance as a context.
An indication of 'importance' within a context
Importance
Sell data or information to third parties
Sell Data to Third Parties
Sell here means exchange, submit, or provide in return for direct or indirect compensation. Was subclass of commercial interest, changed to reflect selling something
Required
Indication of 'required' or 'necessary'
Detriment
Impact that acts as or causes detriments
has policy
Indicates policy applicable or used
has jurisdiction
Indicates applicability of specified jurisdiction
is explicit
Specifies consent is 'explicit'
The conditions for what is considered 'explicit consent' differ by norms and laws.
Legal Obligation to conduct the specified processing
Legal Obligation
Impact
Impact is a stronger notion of consequence in terms of influence, change, or effect on something e.g. for impact assessments
The impact(s) possible or arising as a consequence from specified context
Process by which some personal identifiers are removed or identifiability is reduced
Anonymization
Entities that receive personal data
Recipient
A recipient of personal data can be used to indicate any entity that receives personal data. This can be a Third Party, Processor (GDPR), or even a Controller.
Risk Mitigation Measure
Measures intended to mitigate, minimise, or prevent risk.
Legitimate Interest Assessment
Indicates an assessment regarding the use of legitimate interest as a lawful basis by the data controller
Processing that involves matching and combining of personal data
Matching and Combining
The term 'technology' is inclusive of technologies, processes, and methods.
is implemented using technology
Indicates implementation details such as technologies or processes
Members and Partners Management
Maintain registry of shareholders, members, or partners for governance, administration, and management functions
Data Processor
A ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Indicate a risk is mitigated by specified measure
is mitigated by measure
to move data from one location to another including deleting the original copy
Move
Storage Duration
Duration or temporal limitation on storage of personal data
Improve Existing Products and Services
Improve existing products and services
Specifies the indicated entity is responsible within some context
has responsible entity
Improve Internal CRM Processes
Improve customer-relationship management (CRM) processes
Automated Decision Making
Processing that involves automated decision making
has expiry
Generic property specifying when or under which condition(s) the consent will expire
Indicates the purpose is associated with activities in the indicated (Economic) Sector(s)
has sector
has entity
Indicates inclusion or applicability of an entity to some concept
parent property for controller, processor, data subject, authority, etc.?
Methods which restrict access to a place or resource
Access Control Method
Vital Interest
Processing is necessary or required to protect vital interests of a data subject or other natural person
has provision by
Normally this would be the dataSubject, but in some exceptional cases, the consent might be given on behalf by someone else, e.g. parents of minors.
Specifies the entity that provisioned or provided consent
Record
to make a record (especially media)
to give data (or a portion of it) to others
Share
Innovative Use of New Technologies
Processing that involves use of innovative and new technologies
has representative
Specifies representative of the legal entity
Purpose
The purpose of processing personal data
has context
Indicates a purpose is restricted to the specified context(s)
A ‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and people who, under the direct authority of the controller or processor, are authorised to process personal data.
Third Party
Location or geospatial scope where the data is stored
Storage Location
The actual notice that the Data Subject received to consent to, either a text or link to a document, which should be usable to decide whether the form or consent was compliant to legislation, e.g. documenting how the user has been informed about rights and implications (such as, right to data portability,right to recitffy, right to erasure, right to restrict processing, right to object, rights regarding automated decision making or profiling, processors, third parties, sub-processors, outside-EEA transfers, automated decision-making, or other necessary details of the privacy-policy). Can be TextOrDocumentOrURI.
has consent notice
Specifies the notice provided in context of consent
The legality of age defining a child varies by jurisdiction. In addition, 'child' is distinct from a 'minor'. For example, the legal age for consumption of alcohol can be 21, which makes a person of age 20 a 'minor' in this context. In other cases, 'minor' and 'child' are used interchangeably to refer to a person below some legally defined age.
A 'child' is a natural legal person who is below a certain legal age depending on the legal jurisdiction.
Child
Verify or authorize identity
Identity Verification
non-technical authorisation procedures: How is it described on an organisational level, who gets access to the data
Procedures for determining authorisation through permission or authority
Authorisation Procedure
to organize data for arranging or classifying
Organise
to create new derivative data from the original data
Derive
to delete data
Erase
Organisational Unit
Entity within an organisation that does not constitute as a separate legal entity
A political union of two or more countries with an establishment of common authority
SupraNationalUnion
Data Transfer Impact Assessment
Impact Assessment for conducting data transfers
Can be used to record information of how consent was provided e.g. by a click to a form, in writing, etc., by logging into a system and confirm per email, or with some additional authentication, etc.
has provision method
Specifies the method by which consent was provisioned or provided
to disclose data by means of transmission
Disclose by Transmission
Risks can be associated with one or more different concepts such as purpose, processing, personal data, technical or organisational measure.
Risk
A risk or possibility or uncertainty of negative effects, impacts, or consequences.
Non-disclosure Agreements e.g. preserving confidentiality of information
Non-Disclosure Agreement (NDA)
Storage Condition
Conditions required or followed regarding storage of data
Manage invoicing, orders, and records in relation to services
Service Order Management
This field can be used to proivde a justification why the weithdrawal was done by another DataSubject or legal entity, e.g. declariing the relationship (parent, guardian), in combination with the field withdrawalBy
Specifies the justification for entity withdrawing consent
has withdrawal by justification
Optimise User Interface
Optimize interfaces presented to the user
Create Personalized Recommendations
Create and provide personalised recommendations
Indiciates inclusion or applicability of a Third Party as a Recipient of persona data
has recipient third party
has storage
Indicates information about storage condition
Conduct research in a non-commercial setting e.g. for a non-profit-organisation (NGO)
Non-Commercial Research
Indication of 'secondary' or 'minor' or 'auxiliary' importance
Secondary Importance
Management of personnel associated with the organisation e.g. evaluation and management of employees and intermediaries
Personnel Management
Register, authenticate, and identify users or agents in context of a service
Registration and Authentication
to modify the data, often rewritten into a new form for a new use
Adapt
Provide assistance, resolve issues, ensure satisfaction in relation to services provided
Customer Care
Conduct analysis and reporting related to usage of services or products
Analytics
Was "UsageAnalytics", prefixed with Service to better reflect scope
The frequency or information about periods and repetitions in terms of recurrence.
Frequency
An authority with the power to create or enforce laws, or determine their compliance.
Authority
Optimize activities and services for provider or controller
Optimisation for Controller
The individual (or category of individuals) whose personal data is being processed
The term 'data subject' is specific to the GDPR, but is functionally equivalent to the term 'individual' and the ISO/IEC term 'PII Principle'.
Data Subject
to arrange data according to a structure
Structure
Non-Material Damage
Impact that acts as or causes non-material damages
Indicates information about location
has location
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between a Data Controller or Processor and a Third Party
Third-Party Agreement
Non-Personal Data
Data that is not Personal Data
The term NonPersonalData is provided to distinguish between PersonalData and other data, e.g. for indicating which data is regulated by privacy laws. To specify personal data that has been anonymised, the concept AnonymisedData should be used.
Sell data or information relevant to insights obtained from analysis of data
Sell Insights from Data
Country
The definition of country is not intended for political interpretation. DPVCG welcomes alternate definitions based in existing sources with global scope, such as UN or ISO.
A political entity indicative of a sovereign or non-sovereign territorial state comprising of distinct geographical areas
NonProfitOrganisation
An organisation that does not aim to achieve profit as its primary goal
Storage Restoration
Regularity and temporal span of data restoration/backup mechanisms that guarantee that data is preserved
Organisation Governance
Conduct activities and functions for organisation's governance
Legal Compliance
Fulfilment of obligations or requirements towards achieving compliance with law or regulations
has joint data controllers
Indicates inclusion or applicability of a Joint Data Controller
Organisations related to academia or scientific pursuits e.g. Universities, Schools, Research Bodies
AcademicScientificOrganisation
Was commercial interest, changed to consider Marketing a separate Purpose category by itself
Conduct marketing in relation to organisation or products or services e.g. promoting, selling, and distributing
Marketing
Indicates applicability of Risk
Indicates applicability of Risk for this concept
has risk
has data processor
Indiciates inclusion or applicability of a Data Processor
Notice
A notice is an artefact for providing information, choices, or controls
Indication of neither being required nor optional i.e. not relevant or needed
Not Required
Specifies the instant in time when consent was given
has provision time
has withdrawal time
Specifies the instant in time when consent was withdrawn
Consultation with Authority
Consultation with an authority or authoritative entity
Consequence of Success
The consequence(s) possible or arising from success of specified context
Make Available
to transform or publish data to be used
Create and provide personalised recommendations for events
Create Event Recommendations
Altering personal data irreversibly such that a data subject can no longer be identified directly or indirectly, either by the data controller alone or in collaboration with any other party
Complete Anonymisation
Obtain
to solicit or gather data from someone
Safeguard for Data Transfer
Represents a safeguard used for data transfer. Can include technical or organisational measures.
Derived Data is data that is obtained through processing of existing data, e.g. deriving first name from full name. To indicate data that is derived but which was not present or evident within the source data, InferredPersonalData should be used.
Personal Data that is obtained or derived from other data
Derived Personal Data
Entity
A human or non-human 'thing' that constitutes as an entity
Personal Data that has undergone a partial (incomplete) anonymisation process such that it is still considered Personal Data
Pseudo-anonymised Data
has country
Indicates applicability of specified country
to study or examine the data in detail
Analyse
Legitimate Interests of a Party as justification for specified processing
Legitimate Interest
SupraNationalAuthority
An authority tasked with overseeing legal compliance for a supra-national union e.g. EU
to produce an exact reprodution of the data
Copy
has applicable law
Indicates applicability of a Law
Material Damage
Impact that acts as or causes material damages
Representative
A representative of a legal entity
Assessment
The document, plan, or process for assessment or determination towards a purpose e.g. assessment of legality or impact assessments
Manage payment of vendors
Vendor Payment
Personal Data Handling
A high-level Class to describe 'data handling'. This can consist of personal data being processed for a purpose, involving entities, using technical and organisational measures, applicable risks, rights, and legal basis.
to consult or query data
Consult
Research and Development
Conduct research and development for new methods, products, or services
Indicates the specified concepts is 'before' this concept in some context
is before
to come into possession or control of the data
Acquire
Natural Person
A human
Context or conditions within which processing takes place
Processing Context
The technology, technological implementation, or any techniques, skills, methods, and processes used or applied
Technology
Examples (non-exhaustive) include: Algorithm, Process, Method, Skill, Database, Cookies, Server, Device
to keep data for future use
Store
Organisation Risk Management
Manage risk for organisation's activities
Third Country
Represents a country outside applicable or compatible jurisdiction as outlined in law
isSubTypeOf
isInstanceOf
Concept