Digital Operational Resilience Act (DORA)
An EU regulation requiring banks, insurers, payment institutions and other financial entities to manage ICT risk and report major ICT-related incidents, applicable since 17 January 2025 alongside their existing GDPR duties (Regulation (EU) 2022/2554).
Encryption
Converting data into a secure format to prevent unauthorised access during transmission or storage (Recital 83).
EU-US Data Privacy Framework
The European Commission’s adequacy decision of July 2023 that allows personal data to flow to self-certified US organisations without extra safeguards such as Standard Contractual Clauses. It replaced the invalidated Privacy Shield (Article 45).
Explicit Consent
A stricter form of consent — a clear, unambiguous statement rather than just an action — required before an organisation can process special category data (Article 9(2)(a)).
Facial Recognition Technology
Technology that identifies or verifies a person from their facial features — treated as biometric, special category data processing under GDPR when used to uniquely identify someone (Article 9).
General-Purpose AI Model (GPAI)
An AI model trained on large amounts of data that displays significant generality and can competently perform a wide range of distinct tasks — the kind of model behind general-purpose chat assistants (Article 3(63), EU AI Act).
High-Risk AI System
An AI system whose use poses a significant risk to health, safety or fundamental rights — including systems used in recruitment, credit scoring, education and access to essential services (Article 6 and Annexes I and III, EU AI Act).
High-Risk Processing
Processing that poses significant risks to individual rights, such as profiling or processing sensitive data (Article 35(3)).
Incident Response Plan
A structured approach for managing and mitigating the impact of data breaches (not explicitly defined in GDPR but essential for compliance under Articles 33–34).
Integrity and Confidentiality
The principle requiring personal data to be processed securely and protected against unauthorised access, loss, or damage using appropriate technical and organisational measures (Articles 5(1)(f), 32).