Data Breach Notification (72-Hour Rule)
The requirement to report certain personal data breaches to the supervisory authority within 72 hours of becoming aware of them (Articles 33–34).
Data Controller
The entity that determines the purposes and means of processing personal data (Article 4(7)).
Data Localisation
A legal or policy requirement that certain personal data be stored and processed within a specific country or region, rather than transferred abroad (Articles 44–49).
Data Minimisation
Ensuring only the data necessary for a specific purpose is collected and processed (Article 5(1)(c)).
Data Processor
An entity that processes personal data on behalf of the data controller (Article 4(8)).
Data Protection Impact Assessment (DPIA)
A process to identify and minimise risks to personal data in high-risk processing activities, such as profiling (Article 35).
Data Protection Officer (DPO)
A professional appointed to oversee GDPR compliance and advise organisations on data protection (Articles 37–39).
Data Retention Policy
An internal policy setting out how long each type of personal data is kept and when it is deleted or anonymised, putting the storage limitation principle into day-to-day practice (Article 5(1)(e)).
Data Subject
An individual whose personal data is processed. GDPR grants data subjects specific rights, such as the right to access, rectify, and erase their data (Articles 12–23).
Deployer
Any organisation using an AI system under its own authority in the course of its activities. Most businesses using off-the-shelf AI tools are deployers rather than providers (Article 3(4), EU AI Act).