Internet of Things (IoT) Data
Personal data collected by internet-connected devices — smart speakers, wearables, connected cars — which still falls fully under GDPR’s data minimisation and security requirements, even when it is collected passively in the background (Articles 5(1)(c), 32).
Joint Controllers
Two or more organisations that jointly decide why and how personal data is processed, sharing responsibility for GDPR compliance (Article 26).
Lawful Basis for Processing
One of six legal grounds — such as consent or legitimate interest — that a company must have before it can lawfully process personal data (Article 6).
Legal Obligation
A lawful basis allowing personal data to be processed when it is necessary to comply with a legal duty the organisation is subject to, such as tax or employment law (Article 6(1)(c)).
Legitimate Interest
A lawful basis for processing data where it is necessary and does not override individual rights (Article 6(1)(f)).
Legitimate Interests Assessment (LIA)
A documented three-part test — purpose, necessity, and balancing — an organisation must complete to rely on legitimate interest as its lawful basis (Article 6(1)(f)).
Necessity and Proportionality
A core legal test requiring that data processing goes no further than what is genuinely needed to achieve its purpose (Articles 5–6).
NIS2 Directive
An EU cybersecurity law requiring a wider range of medium and large organisations in essential and important sectors to manage cyber risk and report significant incidents, sitting alongside — not replacing — GDPR’s own breach notification duties. Cyprus transposed it through Law 60(I)/2025, in force since 25 April 2025 (Directive (EU) 2022/2555).
One-Stop-Shop Mechanism
A GDPR system letting an organisation operating in several EU countries deal with a single lead supervisory authority instead of one per country (Article 56).
Personal Data
Any information relating to an identified or identifiable individual, such as names, email addresses, or IP addresses (Article 4(1)).