The Data Privacy Vocabulary (DPV) provides terms (classes and properties) to represent information about legally compliant personal data handling, which includes purposes, processing, personal data, technical and organisational measures.
Data Privacy Vocabulary
accepted
Conduct or assist with research conducted in an academic context e.g. within universities
Academic Research
modified
Organisations related to academia or scientific pursuits e.g. Universities, Schools, Research Bodies
AcademicScientificOrganisation
to access data
Access
Methods which restrict access to a place or resource
Access Control Method
Create, maintain, and manage accounts for purposes of providing services
Account Management
to come into possession or control of the data
Acquire
The right(s) applicable, provided, or expected that need to be (actively) exercised
Active Right
State of an activity that has completed i.e. is fully in the past
Activity Completed
State of an activity that was occuring in the past, and has been halted or paused or stoped
Activity Halted
Monitoring of activities including assessing whether they have been successfully initiated and completed
Activity Monitoring
State of an activity occuring in continuation i.e. currently ongoing
Activity Ongoing
State of an activity being proposed or planned i.e. yet to occur
Activity Proposed
Status associated with activity operations and lifecycles
Activity Status
to modify the data, often rewritten into a new form for a new use
Adapt
A natural person that is not a child i.e. has attained some legally specified age of adulthood
Adult
Conduct advertising i.e. process or artefact used to call attention to a product, service, etc. through announcements, notices, or other forms of communication
Advertising is a subset of Marketing. Advertising by itself does not indicate 'personalisation' i.e. personalised ads.
Advertising
The algorithmic logic applied or used
Algorithmic Logic is intended as a broad concept for explaining the use of algorithms and automated decisions making within Processing. To describe the actual algorithm, see the Algorithm concept.
Algorithmic Logic
to adjust the data to be in relation to another data
Align
to change the data without changing it into something else
Alter
to study or examine the data in detail
Analyse
Altering personal data irreversibly such that a data subject can no longer be identified directly or indirectly, either by the data controller alone or in collaboration with any other party
Anonymisation
to irreversibly alter personal data in such a way that an unique data subject can no longer be identified directly or indirectly or in combination with other data
Anonymise
Personal Data that has been (fully and completely) anonymised so that it is no longer considered Personal Data
It is advised to carefully consider indicating data is fully or completely anonymised by determining whether the data by itself or in combination with other data can identify a person. Failing this condition, the data should be denoted as PseudonymisedData. To indicate data is anonymised only for a specified entity (e.g. within an organisation), the concept AnonymisedDataWithinScope (as subclass of PseudonymisedData) should be used instead of AnonymisedData.
Anonymised Data
Detect, prevent, mitigate, or otherwise act on anti-terrorism activities
Anti-Terrorism Operations
Data subjects that are applicants in some context
Applicant
to assess data for some criteria
Assess
The document, plan, or process for assessment or determination towards a purpose e.g. assessment of legality or impact assessments
Assessment
Procedures related to management of assets
Asset Management Procedures
Data subjects that are asylum seekers
Asylum Seeker
Use of public-key cryptography or asymmetric cryptography involving a public and private pair of keys
Asymmetric Cryptography
Use of asymmetric cryptography to encrypt data
Asymmetric Encryption
State of being approved through the audit
Audit Approved
State of being conditionally approved through the audit
A "conditional approval" is intended to reflect states where the audit has identified further changes which must be implemented before considering the audit has been 'passed', without requiring another audit to validate them. This is distinct from the case where an audit has state 'rejected', which means changes must be made and submitted for review. The requirements of a 'conditional acceptance' are expected to be minor or not significant enough to warrant another audit to review them.
Audit Conditionally Approved
State where an audit is determined as not being required
Audit Not Required
State of not being approved or being rejected through the audit
Audit Rejected
State of an audit being requested whose outcome is not yet known
Audit Requested
State where an audit is determined as being required but has not been conducted
Audit Required
Status associated with Auditing or Investigation
Audit Status
Use of Attribute Based Credentials (ABC) to perform and manage authentication
Authentication using ABC
Use of Privacy-enhacing Attribute Based Credentials (ABC) to perform and manage authentication
Authentication using PABC
Protocols involving validation of identity i.e. authentication of a person or information
Authentication Protocols
Procedures for determining authorisation through permission or authority
non-technical authorisation procedures: How is it described on an organisational level, who gets access to the data
Authorisation Procedure
Protocols involving authorisation of roles or profiles to determine permission, rights, or privileges
Authorisation Protocols
An authority with the power to create or enforce laws, or determine their compliance.
Authority
Processing that involves automated decision making
Automated decision making can be defined as “the ability to make decisions by technological means without human involvement.” (“Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 (wp251rev.01)”, 2018, p. 8)
Automated Decision Making
Processing that is automated and involves inputs by Humans
For example, an algorithm that takes inputs from humans and performs operations based on them
Automated Processing with Human Input
Processing that is automated and involves oversight by Humans
For example, a human watching metrics to ensure correctness of procedural values and outputs as processing takes place
Automated Processing with Human Oversight
Processing that is automated and involves review by Humans
For example, a human verifying outputs of an algorithm for correctness or impact to individuals
Automated Processing with Human Review
Contextual information about the degree of automation and human involvement associated with Processing
It is difficult to provide a formal definition of automation since any and all processing may be considered automation. This concept instead is intended to explicitly signal the utilisation of automation and its extent towards some context - such as decision making, and to indicate the involvement of humans.
Automation of Processing
Procedure where the background of an entity is assessed to identity vulnerabilities and threats due to their current or intended role
Background Checks
Impact(s) that acts as or causes benefits
Benefit
Use of biometric data for authentication
Biometric Authentication
Certification mechanisms, seals, and marks for the purpose of demonstrating compliance
Certification
Certifications, seals, and marks indicating compliance to regulations or practices
Certification and Seal
changed
A 'child' is a natural legal person who is below a certain legal age depending on the legal jurisdiction.
The legality of age defining a child varies by jurisdiction. In addition, 'child' is distinct from a 'minor'. For example, the legal age for consumption of alcohol can be 21, which makes a person of age 20 a 'minor' in this context. In other cases, 'minor' and 'child' are used interchangeably to refer to a person below some legally defined age.
Child
Data subjects that are citizens (for a jurisdiction)
Citizen
A region consisting of urban population and commerce
City
Data subjects that are clients or recipients of services
Client
Location that is in the 'cloud' i.e. a logical location operated over the internet
Cloud Location
A set of rules or procedures outlining the norms and practices for conducting activities
Code of Conduct
to gather data from someone
Collect
Personal Data that has been collected from another source such as the Data Subject
To indicate the source of data, use the DataSource concept with the hasDataSource relation
Collected Personal Data
to join or merge data
Combine
Conduct research in a commercial setting or with intention to commercialise e.g. in a company or sponsored by a company
Commercial Research
Communicate with customers for assisting them, resolving issues, ensuring satisfaction in relation to services provided
Communication for Customer Care
Manage communication or provide means for communication e.g. to send an email notifying some information
This purpose by itself does not sufficiently and clearly indicate what the communication is about. As such, it is recommended to combine it with another purpose to indicate the application. For example, Communication of Payment.
Communication Management
Processing that is completely un-automated or fully manual
For example, a human performing some processing operation
Completely Manual Processing
State where the status of compliance has not been fully assessed, evaluated, or determined
Compliance Indeterminate
Monitoring of compliance (e.g. internal policy, regulations)
Compliance Monitoring
Status associated with Compliance with some norms, objectives, or requirements
Compliance Status
State where the status of compliance is unknown
Compliance Unknown
State where compliance cannot be achieved due to requirements being violated
Changed from "violation of compliance" for consistency with other terms
Compliance Violation
State of being fully compliant
Compliant
Concept
Status associated with conformance to a standard, guideline, code, or recommendation
Conformance Status
State of being conformant
Conformant
Consent of the Data Subject for specified processing
Consent
The state where the temporal or contextual validity of consent has 'expired'
An example of this state is when the obtained consent has been assigned a duration - which has lapsed or 'expired', making it invalid to be used further for processing data
Consent Expired
The state where consent has been given
An example of this state is when the individual clicks on a button, ticks a checkbox, verbally agrees - or any other form that communicates their decision agreeing to the processing of data
Consent Given
The state where consent has been deemed to be invalid
An example of this state is where an investigating authority or a court finds the collected consent did not meet requirements, and 'invalidates' both prior and future uses of it to carry out processing
Consent Invalidated
A Notice for information provision associated with Consent
Consent Notice
A Record of Consent or Consent related activities
Consent Record
The state where consent has been refused
An example of this state is when the individual clicks on a 'disagree' or 'reject' or 'refuse' button, or leaves a checkbox unticked
Consent Refused
State where a request for consent has been deferred without a decision
An example of this state is when the individual closes or dismisses a notice without making a decision. This state is intended for making the distinction between a notice being provided (as a consent request) and the individual interacting with the notice without making a decision - where the 'ignoring of a notice' is taken as consent being neither given nor refused
Consent Request Deferred
State where a request for consent has been made and is awaiting a decision
An example of this state is when a notice has been presented to the individual but they have not made a decision
Consent Requested
The state where the consent is revoked by an entity other than the data subject and which prevents it from being further used as a valid state
An example of this state is when a Data Controller stops utilising previously obtaining consent, such as when that service no longer exists
Consent Revoked
The state or status of 'consent' that provides information reflecting its operational status and validity for processing data
States are useful as information artefacts to implement them in controlling processing, and to reflect the process and flow of obtaining and maintaining consent. For example, a database table that stores consent states for specific processing and can be queried to obtain them in an efficient manner. States are also useful in investigations to determine the use and validity of consenting practices
Consent Status
States of consent that cannot be used as valid justifications for processing data
This identifies the stages associated with consent that should not be used to process data
Consent Status Invalid for Processing
States of consent that can be used as valid justifications for processing data
Practically, given consent is the only valid state for processing
Consent Status Valid for Processing
State where information about consent is not available or is unknown
Consent states can be unknown, for example, when information is not available, or cannot be trusted, or is known to be inaccurate
Consent Unknown
The state where the consent is withdrawn or revoked specifically by the data subject and which prevents it from being further used as a valid state
This state can be considered a form of 'revocation' of consent, where the revocation can only be performed by the data subject. Therefore we suggest using ConsentRevoked when it is a non-data-subject entity, and ConsentWithdrawn when it is the data subject
Consent Withdrawn
The consequence(s) possible or arising from specified context
Consequence
The consequence(s) possible or arising as a side-effect of specified context
Consequence as Side-Effect
The consequence(s) possible or arising from failure of specified context
Consequence of Failure
The consequence(s) possible or arising from success of specified context
Consequence of Success
to consult or query data
Consult
Consultation is a process of receiving feedback, advice, or opinion from an external agency
Consultation
Consultation with an authority or authoritative entity
Consultation with Authority
Consultation with Data Protection Officer(s)
Consultation with DPO
Consultation with data subject(s) or their representative(s)
Consultation with Data Subject
Consultation with representative of data subject(s)
Consultation with Data Subject Representative
Data subjects that consume goods or services for direct use
Consumer
Contextually relevant information not possible to represent through other core concepts
Context
Frequency where occurences are continous
Continous Frequency
Creation, completion, fulfilment, or performance of a contract involving specified processing
Contract
Fulfilment or performance of a contract involving specified processing
Contract Performance
Contractual terms governing data handling within or with an entity
Contractual Terms
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between a Data Controller and a Data Processor
Controller-Processor Agreement
to produce an exact reprodution of the data
Copy
Detect and prevent or mitigate money laundering
Counter Money Laundering
A political entity indicative of a sovereign or non-sovereign territorial state comprising of distinct geographical areas
The definition of country is not intended for political interpretation. DPVCG welcomes alternate definitions based in existing sources with global scope, such as UN or ISO.
Country
Create and provide personalised recommendations for events
Create Event Recommendations
Create and provide personalised recommendations
Create Personalised Recommendations
Create and provide product recommendations e.g. suggest similar products
Create Product Recommendations
Management of credentials and their use in authorisations
Credential Management
Monitor, perform, or assess credit worthiness or solvency
Credit Checking
Use of crytography for authentication
Cryptographic Authentication
Management of crytographic keys, including their generation, storage, assessment, and safekeeping
Cryptographic Key Management
Use of cryptographic methods to perform tasks
Cryptographic Methods
Data subjects that purchase goods or services
note: for B2B relations where customers are organisations, this concept only applies for data subjects
Customer
Provide assistance, resolve issues, ensure satisfaction in relation to services provided
Customer Care
Manage claims, including repayment of monies owed
Customer Claims Management
Manage past, current, and future customers
Customer Management
Manage customer orders
Customer Order Management
Manage and analyse interactions with past, current, and potential customers
Customer Relationship Management
Monitor solvency of customers for financial diligence
Customer Solvency Monitoring
Assessment of cybersecurity capabilities in terms of vulnerabilities and effectiveness of controls
Cybersecurity Assessments
Training methods related to cybersecurity
Cybersecurity Training
A DPIA involves determining the potential and actual impact of processing activities on individuals or groups of individuals
Top class: Impact Assessment, and DPIA is sub-class
Data Protection Impact Assessment (DPIA)
Impact that acts as or causes damages
Damage
A broad concept representing 'data' or 'information'
Data
Use of anonymisation techniques that reduce the identifiability in data
Data Anonymisation Technique
Protocols or plans for backing up of data
Data Backup Protocols
The individual or organisation that decides (or controls) the purpose(s) of processing personal data.
The terms 'Controller' is usually the more common form of indicating a Data Controller. In ISO/IEC the term 'PII Controller' is used.
Data Controller
An entity that 'exports' data where exporting is considered a form of data transfer
The EU, in particular the EDPB, uses data exporter the context of cross-border data transfers/flows. These concepts are not bound by jurisdictional or geopolitical scopes within DPV and can thus be used for any notion of exporting
Data Exporter
An entity that 'imports' data where importing is considered a form of data transfer
The EU, in particular the EDPB, uses data importing the context of cross-border data transfers/flows. These concepts are not bound by jurisdictional or geopolitical scopes within DPV and can thus be used for any notion of importing
Data Importer
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data
For specific role-based data processing agreements, see concepts for Processors and JointDataController agreements.
Data Processing Agreement
Records of personal data processing, whether ex-ante or ex-post
Data Processing Records
A ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Data Processor
An authority tasked with overseeing legal compliance regarding privacy and data protection laws.
Data Protection Authority
An entity within or authorised by an organisation to monitor internal compliance, inform and advise on data protection obligations and act as a contact point for data subjects and the supervisory authority.
Data Protection Officer
Training intended to increase knowledge regarding data protection
Data Protection Training
Data is published by the data subject
This refers to where that data was made publicly available by the data subject. An example of this would be a social media profile that the data subject has made publicly accessible.
Data published by Data Subject
Removal of sensitive information from a data or document
Data Redaction
Cleaning or any removal or re-organisation of elements in data based on selective criteria
Data Sanitisation Technique
The source or origin of data
Source' is the direct point of data collection; 'origin' would indicate the original/others points of where the data originates from.
Data Source
A 'sub-processor' is a processor engaged by another processor
sub-processor' is a commonly used term similar to 'sub-contractor' and does not have a specific legal definition
Data Sub-Processor
The individual (or category of individuals) whose personal data is being processed
The term 'data subject' is specific to the GDPR, but is functionally equivalent to the term 'individual' and the ISO/IEC term 'PII Principle'.
Data Subject
The rights applicable or provided to a Data Subject
Based on use of definitions, the notion of 'Data Subject Right' can be equivalent to 'Individual Right' or 'Right of a Person'
Data Subject Right
Scale of Data Subject(s)
Data Subject Scale
Impact Assessment for conducting data transfers
Data Transfer Impact Assessment
Specific or special categories and instances of legal basis intended for justifying data transfers
Data Transfer Legal Basis
Volume or Scale of Data
Data Volume
Location that is spread across multiple separate areas with no distinction between their importance
Decentralised Locations
Processing that involves decision making
Decision Making
Removal of identity or information to reduce identifiability
De-Identification
Deliver goods and services requested or asked by consumer
Delivery of Goods
to create new derivative data from the original data
Derive indicates data is present or obtainable from existing data. For data that is created without such existence, see Infer.
Derive
Personal Data that is obtained or derived from other data
Derived Data is data that is obtained through processing of existing data, e.g. deriving first name from full name. To indicate data that is derived but which was not present or evident within the source data, InferredPersonalData should be used.
Derived Personal Data
A set of rules or guidelines outlining criterias for design
Design Standard
to process data in a way it no longer exists or cannot be repaired
Destruct
Pseudonymisation achieved through a deterministic function
Deterministic Pseudonymisation
Impact that acts as or causes detriments
Detriment
Utilisation of differential privacy where information is shared as patterns or groups to withold individual elements
Differential Privacy
Management of access, use, and other operations associated with digital content
Digital Rights Management
Expression and authentication of identity through digital information containing cryptographic signatures
Digital Signatures
Conduct direct marketing i.e. marketing communicated directly to the individual
Direct Marketing
Procedures related to management of disasters and recovery
Disaster Recovery Procedures
to make data known
Disclose
to disclose data by means of transmission
Disclose by Transmission
Manage disputes by natural persons, private bodies, or public authorities relevant to organisation
Dispute Management
to spread data throughout
Disseminate
Security implementations provided using or over a distributed system
Distributed System Security
Use of randomised pseudonymisation where the same elements are assigned different values in the same document or database
Document Randomised Pseudonymisation
Security measures enacted over documents to protect against tampering or restrict access
Document Security
The duration or temporal limitation
Duration
A political union of two or more countries based on economic or trade agreements
EconomicUnion
Training methods that are intended to provide education on topic(s)
Educational Training
Procedures intended to determine effectiveness of other measures
Effectiveness Determination Procedures
Data subjects that are considered elderly (i.e. based on age)
Elderly Data Subject
Data subjects that are employees
Employee
Technical measures consisting of encryption
Encryption
Encryption of data when being stored (persistent encryption)
Encryption at Rest
Encryption of data in transit e.g. when being transferred from one location to another, including sharing
Encryption in Transfer
Encryption of data when it is being used
Encryption in Use
Encrypted communications where data is encrypted by the sender and decrypted by the intended receiver to prevent access to any third party
End-to-End Encryption (E2EE)
Duration that is (known or intended to be) open ended or without an end
Endless Duration
Conduct or enforce access control
Was previously "Access Control". Prefixed to distinguish from Technical Measure.
Enforce Access Control
Ensure and enforce security e.g. of data, personnel
Was previous "Security". Prefixed to distinguish from TechOrg measures.
Enforce Security
Processing necessary to enter into contract
Enter Into Contract
A human or non-human 'thing' that constitutes as an entity
Entity
to delete data
Erase
Processing that involves evaluation of individuals
Evaluation of Individuals
Processing that involves evaluation and scoring of individuals
Evaluation and Scoring
Consent that is expressed through an explicit action solely conveying a consenting decision
Explicitly expressed consent is a more specific form of Expressed consent where the action taken must 'explicitly' relate to only the consent decision. Expressed consent where the consenting is part of other matters therefore cannot satisfy the requirements of explicitly expressed consent. An example of explicit action expressing the consenting decision is a button on a web form where the form only relates to consent, or it is accompanied with suitable text that reiterates what the consenting decision is about
Explicitly Expressed Consent
Consent that is expressed through an action intended to convey a consenting decision
Expressed consent requires the individual take a specific and unambigious action that directly indicates their consent. This action may be a part of other processes such as setting preferences, or agreeing to a contract, or other matters not relating to consent. An example of expressed consent is interacting with a checkbox within a dashboard or clicking a button on a web form
Expressed Consent
Location that is federated across multiple separate areas with designation of a primary or central location
Federated Locations
Security implemented over a file system
File System Security
to filter or keep data for some criteria
Filter
Location that is fixed i.e. known to occur at a specific place
Fixed Location
Location that is fixed with multiple places e.g. multiple cities
Fixed Multiple Locations
Duration that takes place a fixed number of times e.g. 3 times
Fixed Occurences Duration
Location that is fixed at a specific place e.g. a city
Fixed Singular Location
An organisation that aims to achieve profit as its primary goal
ForProfitOrganisation
Detect and prevent fraud
Fraud Prevention and Detection
The frequency or information about periods and repetitions in terms of recurrence.
Frequency
Processing that is fully automated
Fully Automated Processing
Use of randomised pseudonymisation where the same elements are assigned different values each time they occur
Fully Randomised Pseudonymisation
to generate or create data
Generate
Personal Data that is generated or brought into existence without relation to existing data i.e. it is not derived or inferred from other data
Generated Data is used to indicate data that is produced and is not derived or inferred from other data
Generated Personal Data
Indicate of scale in terms of geographic coverage
Geographic Coverage
Geographic coverage spanning the entire globe
GlobalScale
Procedures related to governance (e.g. organisation, unit, team, process, system)
Governance Procedures
An organisation managed or part of government
GovernmentalOrganisation
Guardian(s) of data subjects such as children
Guardian(s) of Data Subject
Guidelines or Principles regarding processing and operational measures
GuidelinesPrinciple
Security protocols implemented at or within hardware
Hardware Security Protocols
Impact that acts as or causes harms
Harm
Use of hash functions to map information or to retrieve a prior categorisation
Hash Functions
Use of HMAC where message authentication code (MAC) utilise a cryptographic hash function and a secret cryptographic key
Hash-based Message Authentication Code (HMAC)
Use of Homomorphic encryption that permits computations on encrypted data without decrypting it
Homomorphic Encryption
Data volume that is considered huge or more than large within the context
HugeDataVolume
Scale of data subjects considered huge or more than large within the context
HugeScaleOfDataSubjects
The involvement of humans in specified context
Human Involvement here broadly refers to any involvement by a human in the context of carrying out processing. This may include verification of outcomes, providing input data for making decisions, or overseeing activities.
Human Involvement
Human involvement for the purposes of providing inputs
Human Involvement for Input
Human involvement for the purposes of having oversight over a system, its operations, inputs, or outputs
Human Involvement for Oversight
Human involvement for the purposes of verification of a system, its operations, inputs, or outputs
Human Involvement for Verification
Manage humans and 'human resources' within the organisation for effective and efficient operations.
HR is a broad concept. Its management includes, amongst others - recruiting employees and intermediaries e.g. brokers, independent representatives; payroll administration, remunerations, commissions, and wages; and application of social legislation.
Human Resources Management
Identify, rectify, or otherwise under take activities intended to fix or repair impairments to existing functionalities
An example of identifying and rectifying impairments is the process of finding and fixing errors in products, commonly referred to as debugging
Identify and Repair Impairments
Management of identity and identity-based processes
Identity Management Method
Verify or authorize identity
Identity Verification
Data subjects that are immigrants (for a jurisdiction)
Immigrant
The impact(s) possible or arising as a consequence from specified context
Impact is a stronger notion of consequence in terms of influence, change, or effect on something e.g. for impact assessments
Impact
Calculating or determining the likelihood of impact of an existing or proposed process, which can involve risks or detriments.
Impact Assessment
Consent that is implied indirectly through an action not associated solely with conveying a consenting decision
Implied consent is expected to also be Informed Consent. An example is a CCTV notice outside a monitored area that informs the individuals that by walking in they would be consenting to the use of camera for surveillance.
Implied Consent
An indication of 'importance' within a context
Importance can be used to express importance, desirability, relevance, or significance as a context.
Importance
Improve existing products and services
Improve Existing Products and Services
Improve customer-relationship management (CRM) processes
Improve Internal CRM Processes
Procedures related to management of incidents
Incident Management Procedures
Procedures related to management of incident reporting
Incident Reporting Communication
Improve robustness and resilience of services
Increase Service Robustness
A consortium established and comprising on industry organisations
IndustryConsortium
to infer data from existing data
Infer indicates data that is derived without it being present or obtainable from existing data. For data that is presented, and is 'extracted' or 'obtained' from existing data, see Derive.
Infer
Personal Data that is obtained through inference from other data
Inferred Data is derived data generated from existing data, but which did not originally exist within it, e.g. inferring demographics from browsing history.
Inferred Personal Data
Use of measures to control information flows
Information Flow Control
Policy regarding security of information
Information Security Policy
Consent that is informed i.e. with the requirement to provide sufficient information to make a consenting decision
The specifics for what information should be provided or made available will depend on the context, use-case, or relevant legal requirements
Informed Consent
Processing that involves use of innovative and new technologies
Innovative Use of New Technologies
Optimize internal resource availability and usage for organisation
Internal Resource Optimisation
An organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries
International Organisation
Use of measures to detect intrusions and other unauthorised attempts to gain access to a system
Intrusion Detection System
Data subjects that apply for jobs or employments
JobApplicant
A group of Data Controllers that jointly determine the purposes and means of processing
To indicate the membership, hasDataController may be used
Joint Data Controllers
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between Controllers within a Joint Controllers relationship
Joint Data Controllers Agreement
A form of documentation providing reaosns, explanations, or justifications
Justification
Data volume that is considered large within the context
LargeDataVolume
Scale of data subjects considered large within the context
LargeScaleOfDataSubjects
Processing that takes place at large scales (as specified by some criteria)
The exact definition of what constitutes "large scale" depends on use of jurisdictional, domain-specific, or other forms of externally defined criterias. Where possible, this should be reflected by extending this term with the appropriate context.
Large Scale Processing
A law is a set of rules created by government or authorities
Law
State of being lawful or legally compliant
Lawful
Status associated with being lawful
Lawfulness (alt title: LegalComplianceStatus)
State of the lawfulness not being known
Lawfulness Unknown
A legally binding agreement
Legal Agreement
The Legal basis used to justify processing of personal data
Legal basis (plural: legal bases) are defined by legislations and regulations, whose applicability is usually restricted to specific jurisdictions.
Legal Basis
Fulfilment of obligations or requirements towards achieving compliance with law or regulations
Legal Compliance
A human or non-human 'thing' that constitutes as an entity and which is recognised and defined in law
Legal Entity
Legal Obligation to conduct the specified processing
Legal Obligation
Legitimate Interests of a Party as justification for specified processing
Legitimate Interest
Indicates an assessment regarding the use of legitimate interest as a lawful basis by the data controller
Legitimate Interest Assessment
Legitimate Interests of a Data Controller in conducting specified processing
Legitimate Interest of Controller
Legitimate Interests of the Data Subject in conducting specified processing
Legitimate Interest of Data Subject
Legitimate Interests of a Third Party in conducting specified processing
Legitimate Interest of Third Party
The likelihood or probability or chance of something taking place or occuring
Likelihood can be expressed in a subjective manner, such as 'Unlikely', or in a quantitative manner such as "Twice in a Day" (frequency per period). The suggestion is to use quantitative values, or to associate them with subjective terms used so as to enable accurate interpretations and interoperability. See the concepts related to Frequency and Duration for possible uses as a combination to express Likelihood.
Likelihood
Geographic coverage spanning a specific environment within the locality
For example, geographic scale of an event take place in a specific building or room
LocalEnvironmentScale
Location is local
Local Location
Geographic coverage spanning a specific locality
For example, geographic scale of a city or an area within a city
LocalityScale
A location is a position, site, or area where something is located
Location may be geographic, physical, or virtual.
Location
The fixture of location refers to whether the location is fixed
Location Fixture
Locality refers to whether the specified location is local within some context, e.g. for the user
Location Locality
Policy for logging of information
Logging Policies
Maintain Credit Checking Database
MaintainCreditCheckingDatabase
Maintain Credit Rating Database
MaintainCreditRatingDatabase
Maintain Fraud Database
MaintainFraudDatabase
to transform or publish data to be used
Make Available
Conduct marketing in relation to organisation or products or services e.g. promoting, selling, and distributing
Was commercial interest, changed to consider Marketing a separate Purpose category by itself
Marketing
to combine, compare, or match data from different sources
Match
Impact that acts as or causes material damages
Material Damage
Data volume that is considered medium i.e. neither large nor small within the context
MediumDataVolume
Scale of data subjects considered medium i.e. neither large nor small within the context
MediumScaleOfDataSubjects
Processing that takes place at medium scales (as specified by some criteria)
Medium Scale Processing
Data subjects that are members of a group, organisation, or other collectives
Member
Maintain registry of shareholders, members, or partners for governance, administration, and management functions
Members and Partners Management
Data subjects that are considered mentally vulnerable
Mentally Vulnerable Data Subject
Use of cryptographic methods to authenticate messages
Message Authentication Codes (MAC)
Security implemented over a mobile platform
Mobile Platform Security
to modify or change data
Modify
to monitor data for some criteria
Monitor
Policy for monitoring (e.g. progress, performance)
Monitoring Policies
A simple pseudonymisation method where identifiers are substituted by a number chosen by a monotonic counter
Monotonic Counter Pseudonymisation
to move data from one location to another including deleting the original copy
Move
An authentication system that uses two or more methods to authenticate
Multi-Factor Authentication (MFA)
Geographic coverage spanning multiple nations
MultiNationalScale
Non-disclosure Agreements e.g. preserving confidentiality of information
Non-Disclosure Agreement (NDA)
An authority tasked with overseeing legal compliance for a nation
NationalAuthority
Geographic coverage spanning a nation
NationalScale
A human
Natural Person
Geographic coverage nearly spanning the entire globe
NearlyGlobalScale
An indication of 'necessity' within a context
Necessity can be used to express need, essentiality, requirement, or compulsion.
Necessity
Use of network routing using proxy
Network Proxy Routing
Security implemented at or over networks protocols
Network Security Protocols
Data subjects that are not citizens (for a jurisdiction)
NonCitizen
Conduct research in a non-commercial setting e.g. for a non-profit-organisation (NGO)
Non-Commercial Research
State of non-compliance where objectives have not been met, but have not been violated
Changed from not compliant for consistency in commonly used terms
Non Compliant
State of being non-conformant
NonConformant
An organisation not part of or independent from the government
NonGovernmentalOrganisation
Impact that acts as or causes non-material damages
Non-Material Damage
Data that is not Personal Data
The term NonPersonalData is provided to distinguish between PersonalData and other data, e.g. for indicating which data is regulated by privacy laws. To specify personal data that has been anonymised, the concept AnonymisedData should be used.
Non-Personal Data
An organisation that does not aim to achieve profit as its primary goal
NonProfitOrganisation
A source of data that is not publicly accessible or available
Non-Public Data Source
Indication of neither being required nor optional i.e. not relevant or needed
Not Required
A notice is an artefact for providing information, choices, or controls
Notice
A rule describing an obligation for performing an activity
Obligation
to obtain data through observation
Observe
Personal Data that has been collected through observation of the Data Subject(s)
Observed Personal Data
to solicit or gather data from someone
Obtain
Processing necessary or authorised through the official authority granted to or vested in the Data Controller
Official Authority of Controller
Frequency where occurences are often or frequent, but not continous
Often Frequency
Security implemented at or through operating systems
Operating System Security
Optimize activities and services for consumer or user
Optimisation for Consumer
Optimize activities and services for provider or controller
Optimisation for Controller
Optimize interfaces presented to the user
Optimise User Interface
Indication of 'optional' or 'voluntary'
Optional
A general term reflecting a company or a business or a group acting as a unit
Organisation
Manage compliance for organisation in relation to internal policies
Organisation Compliance Management
Conduct activities and functions for organisation's governance
Organisation Governance
Manage risk for organisation's activities
Organisation Risk Management
Organisational measures required/followed when processing data of the declared category
Organisational Measure
Entity within an organisation that does not constitute as a separate legal entity
Organisational Unit
to organize data for arranging or classifying
Organise
Carrying out an impact assessment regarding privacy risks
Privacy Impact Assessment
Parent(s) of data subjects such as children
Parent(s) of Data Subject
Processing that is partially automated or semi-automated
For example, a series of distinct processing operations that are automated individually or have some human involvement
Partially Automated Processing
State of partially being compliant i.e. only some objectives have been met, and others have not been in violation
Partially Compliant
Data subjects that participate in some context such as volunteers in a function
Participant
The right(s) applicable, provided, or expected that are always (passively) applicable
Passive Right
Use of passwords to perform authentication
Password Authentication
Data subjects that receive medican attention, treatment, care, advice, or other health related services
Patient
Process payment transactions in relation to service
Payment
Use of penetration testing to identity weaknessess and vulnerabilities through simulations
Penetration Testing Methods
A rule describing a permission to perform an activity
Permission
Data directly or indirectly associated or related to an individual.
This definition of personal data encompasses the concepts used in GDPR Art.4-1 for 'personal data' and ISO/IEC 2700 for 'personally identifiable information (PII)'.
Personal Data
A high-level Class to describe 'data handling'. This can consist of personal data being processed for a purpose, involving entities, using technical and organisational measures, applicable risks, rights, and legal basis.
Personal Data Handling
Create and provide customisation based on attributes and/or needs of person(s) or context(s).
This term is a blanket purpose category for indicating personalisation of some other purpose, e.g. by creating a subclass of the other concept and Personalisation
Personalisation
Create and provide personalised advertising
Personalised Advertising
Create and provide personalised benefits for a service
Personalised Benefits
Management and execution of hiring processes of personnel
Personnel Hiring
Management of personnel associated with the organisation e.g. evaluation and management of employees and intermediaries
Personnel Management
Management and execution of payment of personnel
Personnel Payment
Access control applied for physical access e.g. premises or equipement
Physical Access Control Method
A guidance document outlining any of: procedures, plans, principles, decisions, intent, or protocols.
Policy
Use of algorithms that are intended to be secure against cryptanalytic attack by a quantum computer
Post-Quantum Cryptography
Indication of 'primary' or 'main' or 'core' importance
Primary Importance
Practices regarding selecting appropriate data protection and privacy measures as the 'default' in an activity or service
Privacy by Default
Practices regarding incorporating data protection and privacy in the design of information and services
Privacy by Design
Represents a notice or document outlining information regarding privacy
Privacy Notice
Use of protocols designed with the intention of provided additional guarentees regarding privacy
Privacy Preserving Protocol
Use of cryptographic methods to retrieve a record from a system without revealing which record is retrieved
Private Information Retrieval
Location that is not or cannot be accessed by the public and is controlled as a private space
Private Location
The processing performed on personal data
Processing
Context or conditions within which processing takes place
Processing Context
Scale of Processing
The exact definition of what constitutes "scale" depends on use of jurisdictional, domain-specific, or other forms of externally defined criterias. Where possible, this should be reflected by extending the scales provided with the appropriate context.
Processing Scale
Training methods that are intended to provide professional knowledge and expertise
Professional Training
to create a profile that describes or represents a person
Profiling
A rule describing a prohibition to perform an activity
Prohibition
Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
Pseudonymisation
to replace personal identifiable information by artificial identifiers
Pseudonymise
Personal Data that has undergone a pseudonymisation process or a partial (incomplete) anonymisation process such that it is still considered Personal Data
Pseudonymised Data
A source of data that is publicly accessible or available
The term 'Public' is used here in a broad sense. Actual consideration of what is 'Public Data' can vary based on several contextual or jurisdictional factors such as definition of open, methods of access, permissions and licenses.
Public Data Source
Processing is necessary or beneficial for interest of the public or society at large
Public Interest
Manage and conduct public relations processes. This includes creating goodwill for the organization.
Public Relations
Location that is or can be accessed by the public
Publicly Accessible Location
The purpose of processing personal data
Purpose
Cryptographic methods that utilise quantum mechanical properties to perform cryptographic tasks
Quantum Cryptography
to query or make enquiries over data
Query
A pseudonymisation method where identifiers are substituted by a number chosen by a Random Number Generator (RNG)
RNG Pseudonymisation
Location that is random or unknown
Random Location
Entities that receive personal data
A recipient of personal data can be used to indicate any entity that receives personal data. This can be a Third Party, Processor (GDPR), or even a Controller.
Recipient
to make a record (especially media)
Record
Manage creation, storage, and use of records relevant to operations, events, and processes e.g. to store logs or access requests
Record Management
Records of activities within some context such as maintainence tasks or governance functions
Records of Activities
A region is an area or site that is considered a location
Region
An authority tasked with overseeing legal compliance for a region
RegionalAuthority
Geographic coverage spanning a specific region or regions
RegionalScale
A ROPA is a document maintained by Data Controllers detailing processing activities carried out under their responsibility
Tied to compliance processes and documents, decide how to specify those
Register of Processing Activities
Register, authenticate, and identify users or agents in context of a service
Registration and Authentication
Policy regarding repetition or renewal of existing certification(s)
Regularity of Re-certification
Relation
Location is remote i.e. not local
Remote Location
to destruct or erase data
Remove
The state where a previously given consent has been 'renewed' or 'refreshed' or 'reaffirmed' to form a new instance of given consent
An example of this state is when a previously given consent has expired, and the individual is presented a notice regarding continuing associated processing operations - to which they agree. This state can be useful to keep track of 'reconfirmed' or 'refreshed' consent within consent records, assist notices and contextual agents to create better consenting dialogues, and assist with specific legal obligations related to subsequent consenting
Renewed Consent Given
A representative of a legal entity
Representative
Deliver service as requested by user or consumer
Requested Service Provision
Indication of 'required' or 'necessary'
Required
Conduct research and development for new methods, products, or services
Research and Development
to apply a restriction on the processsing of specific records
Restrict
to retrieve data, often in an automated manner
Retrieve
A procedure or process that reviews the correctness and validity of other measures and processes
Review Procedure
The right(s) applicable, provided, or expected
The right(s) applicable, provided, or expected.
A 'right' is a legal, social, or ethical principle of freedom or entitlement which dictate the norms regarding what is allowed or owed.. Rights as a concept encompass a broad area of norms and entities, and are not specific to Individuals or Data Protection / Privacy. For individual specific rights, see dpv:DataSubjectRight
Right
The exercising of an active right
Right Exercise
A risk or possibility or uncertainty of negative effects, impacts, or consequences.
Risks can be associated with one or more different concepts such as purpose, processing, personal data, technical or organisational measure.
Risk
The magnitude of a risk expressed as an indication to aid in its management
Risk Levels can be defined as a combination of different characteristics. For example, ISO 31073:2022 defines it as a combination of consequences and their likelihood. Another example would be the Risk Matrix where Risk Level is defined as a combination of Likelihood and Severity associated with the Risk.
Risk Level
A scheme within the risk management framework specifying the approach, the management components, and resources to be applied to the management of risk
Risk Management Plan
A policy or statement of the overall intentions and direction of an organisation related to risk management
Risk Management Policy
The systematic application of management policies, procedures and practices to the activities of communicating, consulting, establishing the context, and identifying, analysing, evaluating, treating, monitoring, and reviewing risk
Risk Management Process
Measures intended to mitigate, minimise, or prevent risk.
Risk Mitigation Measure
A rule describing a process or control that directs or determines if and how an activity should be conducted
Rule
A safeguard is a precautionary measure for the protection against or mitigation of negative effects
This concept is relevant given the requirement to assert safeguards in cross-border data transfers
Safeguard
Represents a safeguard used for data transfer. Can include technical or organisational measures.
Safeguard for Data Transfer
A measurement along some dimension
Scales are subjective concepts that need to be defined and interpreted within the context of their application. For example, what would be small within one context could be large within another.
Scale
Indication of the extent or range or boundaries associated with(in) a context
Scope
Processing that involves scoring of individuals
Scoring of Individuals
to remove data for some criteria
Screen
A seal or a mark indicating proof of certification to some certification or standard
Seal
Indication of 'secondary' or 'minor' or 'auxiliary' importance
Secondary Importance
Use of secret sharing schemes where the secret can only be reconstructed through combination of sufficient number of individuals
Secret Sharing Schemes
Indicate or restrict scope for interpretation and application of purpose in a domain e.g. Agriculture, Banking
There are various sector codes used commonly to indicate the domain of an organisation or business. Examples include NACE (EU), ISIC (UN), SIC and NAICS (USA).
Sector
Use of cryptographic methods for entities to jointly compute functions without revealing inputs
Secure Multi-Party Computation
Assessment of security intended to identity gaps, vulnerabilities, risks, and effectiveness of controls
Security Assessments
Training intended to increase knowledge regarding security
Security Knowledge Training
Methods that relate to creating and providing security
Security Method
Procedures associated with assessing, implementing, and evaluating security
Security Procedure
Procedures related to security roles
Security Role Procedures
Sell data or information to third parties
Sell here means exchange, submit, or provide in return for direct or indirect compensation. Was subclass of commercial interest, changed to reflect selling something
Sell Data to Third Parties
Sell data or information relevant to insights obtained from analysis of data
Sell Insights from Data
Sell products or services
Sell here means exchange, submit, or provide in return for direct or indirect compensation.
Sell Products
Sell products or services to the user, consumer, or data subjects
Was subclass of commercial interest, changed to reflect selling something
Sell Products to Data Subject
Personal data that is considered 'sensitive' in terms of privacy and/or impact, and therefore requires additional considerations and/or protection
Sensitivity' is a matter of context, and may be defined within legal frameworks. For GDPR, Special categories of personal data are considered a subset of sensitive data. To illustrate the difference between the two, consider the situation where Location data is collected, and which is considered 'sensitive' but not 'special'. As a probable rule, sensitive data require additional considerations whereas special category data requires additional legal basis / justifications.
Sensitive Personal Data
Optimise services or activities
Subclass of ServiceProvision since optimisation is usually considered part of providing services
Service Optimization
Personalise services or product or activities
Subclass of ServiceProvision since personalisation is usually considered part of providing services
Service Personalization
Provide service or product or activities
Service Provision
Manage invoicing, orders, and records in relation to services
Service Order Management
Conduct analysis and reporting related to usage of services or products
Was "UsageAnalytics", prefixed with Service to better reflect scope
Service Usage Analytics
The magnitude of being unwanted or having negative effects such as harmful impacts
Severity can be associated with Risk, or its Consequences and Impacts
Severity
to give data (or a portion of it) to others
Share
Use of credentials or processes that enable using one set of credentials to authenticate multiple contexts.
Single Sign On
Data volume that is considered singular i.e. a specific instance or single item
SingularDataVolume
Frequency where occurences are singular i.e. they take place only once
Singular Frequency
Scale of data subjects considered singular i.e. a specific data subject
SingularScaleOfDataSubjects
Data volume that is considered small or limited within the context
SmallDataVolume
Scale of data subjects considered small or limited within the context
SmallScaleOfDataSubjects
Processing that takes place at small scales (as specified by some criteria)
Small Scale Processing
Conduct marketing through social media
Social Media
Sensitive Personal Data whose use requires specific legal permission or justification
The term 'special category' is based on GDPR Art.9, but should not be considered as exlusive to it. DPV considers all Special Categories to also be Sensitive, but whose use is either prohibited or regulated and therefore requires additional legal basis for justification.
Special Category Personal Data
Data volume that is considered sporadic or sparse within the context
SporadicDataVolume
Frequency where occurences are sporadic or infrequent or sparse
Sporadic Frequency
Scale of data subjects considered sporadic or sparse within the context
SporadicScaleOfDataSubjects
Practices and policies regarding training of staff members
Staff Training
The status or state of something
Status
Conditions required or followed regarding storage of data
Storage Condition
Deletion or Erasure of data including any deletion guarantees
Storage Deletion
Duration or temporal limitation on storage of personal data
Storage Duration
Location or geospatial scope where the data is stored
Storage Location
Regularity and temporal span of data restoration/backup mechanisms that guarantee that data is preserved
Storage Restoration
to keep data for future use
Store
to arrange data according to a structure
Structure
Data subjects that are students
Student
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between a Data Processor and a Data (Sub-)Processor
Sub-Processor Agreement
Data subjects that subscribe to service(s)
note: subscriber can be customer or consumer
Subscriber
An authority tasked with overseeing legal compliance for a supra-national union e.g. EU
SupraNationalAuthority
A political union of two or more countries with an establishment of common authority
SupraNationalUnion
Use of crytography where the same keys are utilised for encryption and descryption of information
Symmetric Cryptography
Use of symmetric crytography to encrypt data
Symmetric Encryption
Synthetic data reffers to artificially created data such that it is intended to resemble real data (personal or non-personal), but does not refer to any specific identified or identifiable individual, or to the real measure of an observable parameter in the case of non-personal data
Synthetic Data
Processing that involves systematic monitoring of individuals
Systematic Monitoring
Create and provide pesonalised advertisement where the personalisation is targeted to a specific individual or group of individuals
Targeted Advertising
Technical measures required/followed when processing data of the declared category
Technical Measure
The Technical and Organisational measures used.
Technical and Organisational Measure
Manage and provide technical processes and functions necessary for delivering services
Technical Service Provision
Technical_Organisational_Measures Concepts
The technology, technological implementation, or any techniques, skills, methods, and processes used or applied
Examples (non-exhaustive) include: Algorithm, Process, Method, Skill, Database, Cookies, Server, Device
Technology
Duration that has a fixed temporal duration e.g. 6 months
Temporal Duration
Represents a country outside applicable or compatible jurisdiction as outlined in law
Third Country
A ‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and people who, under the direct authority of the controller or processor, are authorised to process personal data.
Third Party
An agreement outlining conditions, criteria, obligations, responsibilities, and specifics for carrying out processing of personal data between a Data Controller or Processor and a Third Party
Third-Party Agreement
Procedures related to security associated with Third Parties
Third Party Security Procedures
Data subjects that are tourists i.e. not citizens and not immigrants
Tourist
to move data from one place to another
Transfer
to change the form or nature of data
Transform
to send out data
Transmit
Use of cryptographic methods to restrict access and execution to trusted parties and code
Trusted Computing
Use of cryptographic methods to restrict access and execution to trusted parties and code within a dedicated execution environment
Trusted Execution Environments
Utilisation of a trusted third party to provide or carry out a measure
Trusted Third Party Utilisation
Consent that is uninformed i.e. without requirement to provide sufficient information to make a consenting decision
Uninformed Consent
State of being unlawful or legally non-compliant
Unlawful
Duration that takes place until a specific event occurs e.g. Account Closure
Until Event Duration
Duration that has a fixed end date e.g. 2022-12-31
Until Time Duration
Management of usage, which is intended to be broader than access control and may cover trust, digital rights, or other relevant controls
Usage Control
to use data
Use
Use of synthetic data to preserve privacy, security, or other effects and side-effects
Use of Synthetic Data
Data subjects that use service(s)
User
Personalise interfaces presented to the user
User Interface Personalisation
Location that is known but is variable e.g. somewhere within a given area
Variable Location
Manage orders, payment, evaluation, and prospecting related to vendors
Vendor Management
Manage payment of vendors
Vendor Payment
Manage orders related to vendors
Vendor Records Management
Manage selection, assessment, and evaluation related to vendors
Vendor Selection Assessment
Security implemented at or through virtualised environments
Virtualisation Security
Data subjects that are temporary visitors
Visitor
Processing is necessary or required to protect vital interests of a data subject or other natural person
Vital Interest
Processing is necessary or required to protect vital interests of a data subject
Vital Interest of Data Subject
Processing is necessary or required to protect vital interests of a natural person
Vital Interest of Natural Person
Methods that assess or discover vulnerabilities in a system
Vulnerability Testing Methods
Data Subjects which should be considered 'vulnerable' and therefore would require additional measures and safeguards
This concept denotes a Data Subject or a group are vulnerable, but not what vulnerability they possess or its context. This information can be provided additionally as comments, or as separate concepts and relations. Proposals for this are welcome.
Vulnerable Data Subject
Security implemented at or over web browsers
WebBrowser Security
Security implemented at or over web-based protocols
Web Security Protocols
Security implemented at or over wireless communication protocols
Wireless Security Protocols
Location is local and entirely within a device, such as a smartphone
Within Device
Location is local and entirely within a physical environment, such as a room
Within Physical Environment
Location is local and entirely within a virtual environment, such as a shared network directory
Within Virtual Environment
Authentication using Zero-Knowledge proofs
Zero Knowledge Authentication
Indicates the status of activity of specified concept
has activity status
Specifies address of a legal entity such as street address or pin code
has address
Indicates the logic used in processing such as for automated decision making
has algorithmic logic
Indicates applicability of a Law
has applicable law
Indicates the status of audit associated with specified concept
has audit status
Indicates applicability of authority for a jurisdiction
has authority
Indicates the status of compliance of specified concept
has compliance status
sunset
Specifies the notice provided in context of consent
WARNING: This concept will be deprecated in future releases
The actual notice that the Data Subject received to consent to, either a text or link to a document, which should be usable to decide whether the form or consent was compliant to legislation, e.g. documenting how the user has been informed about rights and implications (such as, right to data portability,right to recitffy, right to erasure, right to restrict processing, right to object, rights regarding automated decision making or profiling, processors, third parties, sub-processors, outside-EEA transfers, automated decision-making, or other necessary details of the privacy-policy). Can be TextOrDocumentOrURI.
has consent notice
Specifies the state or status of consent
has consent status
Indicates consenquence(s) possible or arising from specified concept
Removed plural suffix for consistency
has consequence
Specifies contact details of a legal entity such as phone or email
has contact
Indicates a purpose is restricted to the specified context(s)
has context
Indicates applicability of specified country
has country
Indicates associated with Data (may or may not be personal)
has data
Indicates association with Data Controller
has data controller
Indiciates inclusion or applicability of a LegalEntity in the role of Data Exporter
has data exporter
Indiciates inclusion or applicability of a LegalEntity in the role of Data Importer
has data importer
Indiciates inclusion or applicability of a Data Processor
has data processor
Specifices an associated data protection officer
has data protection officer
Indicates the source or origin of data being processed
has data source
Indicates association with Data Subject
has data subject
Indicates the scale of data subjects
has data subject scale
Indicates the volume of data
has data volume
has domain
Indicates information about duration
has duration
Indicates inclusion or applicability of an entity to some concept
parent property for controller, processor, data subject, authority, etc.?
has entity
Generic property specifying when or under which condition(s) the consent will expire
has expiry
Specifies the condition or event that determines the expiry of consent
Can be TextOrDocumentOrURI
has expiry condition
Specifies the expiry time or duration for consent
has expiry time
Indicates the frequency with which something takes place
has frequency
Indicate the geographic coverage (of specified context)
has geographic coverage
Indicates Involvement of humans in processing such as within automated decision making process
Human involvement is also relevant to 'human in the loop'
has human involvement
Indicates an identifier associated for identification or reference
has identifier
Indicates impact(s) possible or arising as consequences from specified concept
has impact
Indicates the thing (e.g. plan, process, or entity) affected by an impact
has impact on
Specifies the method by which an entity has indicated the specific context
has indication method
Indicates inclusion or applicability of a Joint Data Controller
has joint data controllers
Indicates applicability of specified jurisdiction
has jurisdiction
Indicates a justification for specified concept or context
has justification
Indicates the status of being lawful or legally compliant
has lawfulness
Indicates use or applicability of a Legal Basis
has legal basis
Indicates the likelihood associated with a concept
has likelihood
Indicates information about location
has location
Specifies name of a legal entity
has name
Indicates the use or applicability of a Notice for the specified context
has notice
Specifying applicability or inclusion of an obligation rule within specified context
has obligation
Indicates use or applicability of Organisational measure
has organisational measure
Indicates an outcome of specified concept or context
has outcome
Specifying applicability or inclusion of a permission rule within specified context
has permission
Indicates association with Personal Data
has personal data
Indicates association with Personal Data Handling
has personal data handling
Indicates policy applicable or used
has policy
Indicates association with Processing
has processing
Indicates the use or extent of automation associated with processing
has processing automation
Specifying applicability or inclusion of a prohibition rule within specified context
has prohibition
Specifies the entity that provisioned or provided consent
Normally this would be the dataSubject, but in some exceptional cases, the consent might be given on behalf by someone else, e.g. parents of minors.
has provision by
Specifies the justification for entity providing consent
This field can be used to proivde a justification why the provision was provided by another DataSubject or legal entity, e.g. declariing the relationship (parent, guardian), in combination with the field provisionBy
has provision by justification
Specifies the method by which consent was provisioned or provided
Can be used to record information of how consent was provided e.g. by a click to a form, in writing, etc., by logging into a system and confirm per email, or with some additional authentication, etc.
has provision method
Specifies the instant in time when consent was given
has provision time
Indicates association with Purpose
has purpose
has range
Indicates Recipient of Personal Data
has recipient
Indiciates inclusion or applicability of a Data Controller as a Recipient of persona data
has recipient data controller
Indiciates inclusion or applicability of a Third Party as a Recipient of persona data
has recipient third party
Indicates the relation between specified Entity and Data Subject
has relation with data subject
Specifies representative of the legal entity
has representative
Indicates the associated risk is the remaining or residual risk from applying mitigation measures or treatments to this risk
has residual risk
Specifies the indicated entity is responsible within some context
has responsible entity
Indicates use or applicability of Right
has right
Indicates applicability of Risk
Indicates applicability of Risk for this concept
has risk
Indicates the associated risk level associated with a risk
has risk level
Specifying applicability or inclusion of a rule within specified context
has rule
Indicates the scale of specified concept
has scale
Indicates the scope of specified concept or context
has scope
Indicates the purpose is associated with activities in the indicated (Economic) Sector(s)
has sector
Indicates the severity associated with a concept
has severity
Indicates the status of specified concept
has status
Indicates information about storage condition
has storage condition
Indicates use or applicability of Technical measure
has technical measure
Indicates use or applicability of Technical or Organisational measure
has technical and organisational measure
Indicates applicability or relevance of a 'third country'
has third country
Specifies the entity that withdrew consent
Normally this would be the dataSubject, but in some exceptional cases, the consent might be withdraawn on behalf by someone else, e.g. parents of minors.
has withdrawal by
Specifies the justification for entity withdrawing consent
This field can be used to proivde a justification why the weithdrawal was done by another DataSubject or legal entity, e.g. declariing the relationship (parent, guardian), in combination with the field withdrawalBy
has withdrawal by justification
Specifries the method by which consent can be/has been withdrawn
Can be used to record information of how to withdraw consent, e.g. by a click to a form, in writing, etc., by logging into a system and confirm per email, or with some additional authentication, etc.
has withdrawal method
Specifies the instant in time when consent was withdrawn
has withdrawal time
Indicates the specified concepts is 'after' this concept in some context
is after
Indicates area, scope, or applicability of an Authority
is authority for
Indicates the specified concepts is 'before' this concept in some context
is before
Indicates context or information about exercising a right
is exercised at
Specifies consent is 'explicit'
The conditions for what is considered 'explicit consent' differ by norms and laws.
is explicit
Indicates implementation details such as entities or agents
The use of 'entity' is inclusive of entities (e.g. Data Processor) as well as 'agent' (e.g. DPO). For indicating technological implementation, the property isImplementedByTechnology should be used.
is implemented by entity
Indicates implementation details such as technologies or processes
The term 'technology' is inclusive of technologies, processes, and methods.
is implemented using technology
Specifies the temporal information for when the entity has indicated the specific context
is indicated at time
Specifies entity who indicates the specific context
is indicated by
isInstanceOf
Indicate a risk is mitigated by specified measure
is mitigated by measure
Indicates the context or application of policy
is policy for
Indicates this risk is the remaining or residual risk from applying mitigation measures or treatments to specified risk
is residual risk of
isSubTypeOf
Indicates risks mitigated by this concept
mitigates risk