Data protection glossary
Plain-English definitions of the UK data protection terms you are most likely to come across, with links to the support that can help.
The law and the regulator
UK GDPR
The UK General Data Protection Regulation. Together with the Data Protection Act 2018, it sets out the core data protection rules for organisations processing personal data in the UK.
GDPR Consultancy & Compliance →EU GDPR
The EU General Data Protection Regulation. It can still apply to UK organisations that offer goods or services to, or monitor the behaviour of, people in the EU.
GDPR Consultancy & Compliance →Data Protection Act 2018 (DPA 2018)
The UK law that sits alongside the UK GDPR. It adds exemptions and conditions for sensitive processing, and covers processing by law enforcement and the intelligence services.
GDPR Consultancy & Compliance →Data (Use and Access) Act 2025 (DUAA)
Legislation that amends the UK GDPR, the DPA 2018 and PECR. Its changes are being brought into force in stages, so it is worth checking how they affect your processing.
GDPR Consultancy & Compliance →Privacy and Electronic Communications Regulations (PECR)
Rules on electronic marketing by email, text and phone, and on cookies and similar technologies. They apply alongside the UK GDPR.
Policy Documentation Review →Information Commissioner's Office (ICO)
The UK's independent regulator for data protection and electronic marketing. It publishes guidance, handles complaints and can take enforcement action, including fines.
Outsourced DPO Services →Key concepts and roles
Personal data
Any information relating to an identified or identifiable living person, such as a name, email address, identification number, location data or online identifier.
GDPR Consultancy & Compliance →Special category data
Personal data that needs extra protection: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data about sex life or sexual orientation.
DPIA Support →Data subject
The identifiable living person that personal data is about, such as a customer, employee, patient or pupil.
Data Subject Rights Support →Controller
The organisation that decides why and how personal data is processed. The controller carries primary responsibility for compliance.
GDPR Consultancy & Compliance →Processor
An organisation that processes personal data on a controller's behalf and under its instructions, such as a payroll or cloud provider. Controllers must have a written contract in place with their processors.
Data Protection Risk Assessments →Data Protection Officer (DPO)
An independent role that advises on and monitors data protection compliance and is the contact point for the ICO and individuals. Some organisations must appoint one, including public authorities and those whose core activities involve large-scale monitoring or special category data.
Outsourced DPO Services →Lawful processing
Lawful basis
One of the six reasons the UK GDPR allows for processing personal data: consent, contract, legal obligation, vital interests, public task or legitimate interests. You need at least one for each purpose.
GDPR Consultancy & Compliance →Consent
A freely given, specific, informed and unambiguous indication of agreement, given by a clear affirmative action. It must be as easy to withdraw as it is to give.
Policy Documentation Review →Legitimate interests and LIA
A lawful basis where processing is necessary for your or a third party's legitimate interests, unless they are overridden by the individual's interests. A Legitimate Interests Assessment (LIA) records the three-part test of purpose, necessity and balancing.
Data Protection Risk Assessments →Data protection by design and by default
Building data protection into systems, processes and projects from the start, and making sure that by default only the personal data needed for each purpose is processed.
DPIA Support →Retention
Keeping personal data for no longer than necessary. A retention schedule records how long each type of personal data is kept and why.
Policy Documentation Review →Assessments and records
Data Protection Impact Assessment (DPIA)
An assessment required before processing that is likely to result in a high risk to individuals' rights and freedoms. It identifies the risks and the measures that will reduce them.
DPIA Support →Transfer risk assessment (TRA / TIA)
An assessment of the risks of transferring personal data to a country without UK adequacy regulations, and of whether the safeguards used give appropriate protection. The ICO calls it a transfer risk assessment; it is also known as a transfer impact assessment.
Data Protection Risk Assessments →International transfers and the IDTA
Personal data sent outside the UK needs adequacy regulations or appropriate safeguards, such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses.
Data Flow Mapping →Records of Processing Activities (ROPA)
Documentation of the processing an organisation carries out, including purposes, categories of data, recipients, transfers, retention and security. Most organisations must keep one.
Data Flow Mapping →Data mapping
A record, often visual, of how personal data enters, moves through and leaves an organisation. It supports the ROPA, DPIAs and risk assessments.
Data Flow Mapping →Privacy notice
The information you must give people about how and why you use their personal data, who you share it with, how long you keep it, their rights and how to complain.
Policy Documentation Review →Individuals' rights and incidents
Data subject rights
The rights individuals have over their personal data: to be informed, of access, to rectification, to erasure, to restrict processing, to data portability, to object, and rights related to automated decision-making.
Data Subject Rights Support →Subject access request (SAR / DSAR)
A request from an individual for a copy of their personal data and information about how it is used. It must generally be answered within one month, which can be extended by up to two further months for complex or numerous requests.
Data Subject Rights Support →Personal data breach
A security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Reportable breaches must be notified to the ICO within 72 hours of becoming aware of them, and affected individuals told without undue delay where there is a high risk to them.
Data Breach Support →Automated decision-making
Decisions made by automated means without meaningful human involvement. Where they have legal or similarly significant effects on people, specific rules and safeguards apply.
AI & Data Protection →Need help putting this into practice?
Knowing the terms is the first step. A free review shows where your organisation stands today, and what's worth doing first.