Core expertise
Further services
Podcast
Datenschutz-Puls: what matters in data protection law, every two weeks.
Focus industries
Further industries
Industries
Your industry is not listed? We advise across all sectors.
About us
Information
Podcast
Datenschutz-Puls: what matters in data protection law, every two weeks.
Glossary A-Z
4 terms
Anonymisation Anonymisation means altering personal data in such a way that the data subject is not or is no longer identifiable. Recital 26 GDPR Artificial intelligence and data protection When artificial intelligence is used, the GDPR applies whenever personal data is processed in training, in the input or in the output. Art. 6 GDPR Automated processing Automated processing is any processing of personal data carried out wholly or partly by means of data processing systems. Art. 2(1) GDPR 9 terms
Cloud computing Cloud computing is the provision of IT resources such as storage, computing power or software over the internet by an external provider. Art. 28 GDPR Collection of personal data Collection is the obtaining of personal data about a person and at the same time the first step of any processing. Art. 4(2) GDPR Compensation under the GDPR Under Art. 82 GDPR, any person who has suffered material or non-material damage as a result of an infringement of the GDPR has the right to receive compensation. Art. 82 GDPR Consent Consent is a freely given, specific, informed and unambiguous indication of a person's wishes by which they agree to the processing of their data. Art. 4(11) GDPR Consent management Consent management refers to obtaining, documenting and managing consent, typically through a consent management platform on websites and in apps. Section 25 TDDDG Controller The controller is the natural or legal person, public authority or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Art. 4(7) GDPR Cookies Cookies are small text files that a website stores on the user's terminal device in order to recognise the user or save settings. Section 25 TDDDG Customer data Customer data is all information about customers that a company processes in the course of the business relationship, and it is personal data insofar as it relates to natural persons. Art. 6(1)(b) GDPR 11 terms
Data breach A data breach is a breach of the security of personal data, for example through loss, unauthorised access or accidental disclosure. Art. 4(12) GDPR Data breach notification The obligation to notify personal data breaches requires controllers to report a data breach to the supervisory authority within 72 hours of becoming aware of it. Art. 33 GDPR Data minimisation Data minimisation is the principle that only as much personal data may be processed as is necessary for the purpose in question. Art. 5(1)(c) GDPR Data processing agreement (DPA) The data processing agreement is the contract between a controller and its processor that is required under Art. 28 GDPR. Art. 28(3) GDPR Data protection Data protection is the protection of natural persons with regard to the processing of their personal data. Art. 8 EU Charter of Fundamental Rights Data protection impact assessment (DPIA) The data protection impact assessment is a structured risk analysis for processing operations that are likely to result in a high risk to data subjects. Art. 35 GDPR Data protection officer (DPO) The data protection officer monitors compliance with data protection rules within an organisation and is the point of contact for the supervisory authority and data subjects. Art. 37 GDPR Data security Data security refers to the protection of data against loss, manipulation and unauthorised access through technical and organisational measures. Art. 5(1)(f) GDPR Data subject The data subject is the identified or identifiable natural person to whom personal data relates. Art. 4(1) GDPR Deletion concept A deletion concept sets out in a binding manner which personal data is deleted when, how and by whom. Art. 5(1)(e) GDPR 2 terms
Encryption Encryption is the conversion of data by means of a key into a form that can only be read again with the matching key. Art. 32(1)(a) GDPR 4 terms
Informational self-determination The right to informational self-determination is the right of every individual to decide, in principle, for themselves on the disclosure and use of their personal data. Art. 2(1) in conjunction with Art. 1(1) GG Intra-group privilege (Konzernprivileg) The intra-group privilege refers to a simplified sharing of personal data within a group of undertakings, which the GDPR does not, however, provide for as such. Art. 4(19) GDPR IP address An IP address is a numerical identifier used to address a device in a network such as the internet, and it can be personal data. Art. 4(1) GDPR 2 terms
Legitimate interest / balancing of interests Legitimate interest is a legal basis under which processing is lawful if it is necessary for the purposes of legitimate interests and the interests of the data subject do not override them. Art. 6(1)(f) GDPR 11 terms
Physical access control Physical access control prevents unauthorised persons from physically entering premises and facilities in which personal data is processed. Art. 32 GDPR Privacy by default Privacy by default means choosing default settings so that, by default, only the personal data necessary for the specific purpose is processed. Art. 25(2) GDPR Privacy by design Privacy by design means building data protection into the technical and organisational design of systems, products and processes from the outset. Art. 25(1) GDPR Privacy notice The privacy notice is the information with which a controller informs data subjects about the processing of their personal data, typically on a website. Art. 12 GDPR Processing of personal data Processing is any operation performed on personal data, from collection through storage and use to erasure. Art. 4(2) GDPR Processing on behalf of a controller Processing on behalf of a controller takes place when a service provider processes personal data for another company and is bound by its instructions. Art. 4(8) GDPR Prohibition of tying (Koppelungsverbot) The prohibition of tying means that consent is generally not freely given if a contract is made conditional on consent that is not necessary for its performance. Art. 7(4) GDPR Prohibition subject to permission (Verbot mit Erlaubnisvorbehalt) The prohibition subject to permission describes the principle that processing personal data is prohibited unless it is permitted by a legal basis. Art. 6(1) GDPR Pseudonymisation Pseudonymisation is the processing of personal data in such a way that it can no longer be attributed to a specific person without additional information that is kept separately. Art. 4(5) GDPR Purpose limitation Purpose limitation is the principle that personal data may only be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Art. 5(1)(b) GDPR 6 terms
Retention period / storage limitation The principle of storage limitation requires personal data to be kept in a form which permits identification for no longer than is necessary for the purpose of the processing. Art. 5(1)(e) GDPR Right of access The right of access entitles every person to obtain confirmation from a controller as to whether, and which, personal data concerning them is being processed. Art. 15 GDPR Right to erasure / erasure of personal data The right to erasure obliges controllers to erase personal data without undue delay where one of the statutory grounds for erasure applies. Art. 17 GDPR Right to object The right to object allows data subjects to object to processing of their data that is based on legitimate interests or on a task carried out in the public interest. Art. 21(1) GDPR Right to rectification The right to rectification entitles every person to have inaccurate personal data rectified without undue delay and incomplete data completed. Art. 16 GDPR 4 terms
Special categories of personal data Special categories of personal data are particularly sensitive information whose processing is prohibited in principle under Art. 9 GDPR and permitted only by way of exception. Art. 9 GDPR Standard contractual clauses (SCCs) Standard contractual clauses are model contracts issued by the European Commission that provide appropriate safeguards for transfers of personal data to third countries. Art. 46(2)(c) GDPR Supervisory authority The data protection supervisory authority monitors compliance with data protection law and can carry out audits and impose fines. Arts. 51 to 59 GDPR 4 terms
Third country In data protection law, a third country is any state outside the European Union and the European Economic Area. Art. 44 GDPR Third-country transfer / international data transfer A third-country transfer is the transfer of personal data to a recipient in a state outside the EU and the EEA or to an international organisation. Arts. 44 to 46 GDPR Transmission of personal data Transmission is the disclosure of personal data to a recipient by passing it on or making it available for retrieval. Art. 4(2) GDPR No term found.
Try a different search term. If a term is missing, please get in touch.
We do not use tracking or marketing cookies. Only your choice is stored. External media such as the Apple Podcasts player are loaded only with your consent, in which case your IP address is transmitted to Apple. You can change your choice at any time via "Cookie settings" in the footer.
