General-Purpose AI Model (GPAI)
An AI model trained on large amounts of data that displays significant generality and can competently perform a wide range of distinct tasks — the kind of model behind general-purpose chat assistants (Article 3(63), EU AI Act).
High-Risk AI System
An AI system whose use poses a significant risk to health, safety or fundamental rights — including systems used in recruitment, credit scoring, education and access to essential services (Article 6 and Annexes I and III, EU AI Act).
High-Risk Processing
Processing that poses significant risks to individual rights, such as profiling or processing sensitive data (Article 35(3)).
Incident Response Plan
A structured approach for managing and mitigating the impact of data breaches (not explicitly defined in GDPR but essential for compliance under Articles 33–34).
Integrity and Confidentiality
The principle requiring personal data to be processed securely and protected against unauthorised access, loss, or damage using appropriate technical and organisational measures (Articles 5(1)(f), 32).
Joint Controllers
Two or more organisations that jointly decide why and how personal data is processed, sharing responsibility for GDPR compliance (Article 26).
Lawful Basis for Processing
One of six legal grounds — such as consent or legitimate interest — that a company must have before it can lawfully process personal data (Article 6).
Legal Obligation
A lawful basis allowing personal data to be processed when it is necessary to comply with a legal duty the organisation is subject to, such as tax or employment law (Article 6(1)(c)).
Legitimate Interest
A lawful basis for processing data where it is necessary and does not override individual rights (Article 6(1)(f)).
Legitimate Interests Assessment (LIA)
A documented three-part test — purpose, necessity, and balancing — an organisation must complete to rely on legitimate interest as its lawful basis (Article 6(1)(f)).