CIPP/E Glossary
60 terms defined · Last reviewed: · By Victor Humenhuk (CIPP/E certified)
This glossary defines the terms that actually come up when you study for the CIPP/E: the definitions in Article 4 of the GDPR, the concepts the EDPB and the old Article 29 Working Party have built on top of them, the ePrivacy vocabulary that trips people up, and the CJEU cases that gave those terms their current meaning. Each entry says what the term means, where it comes from in the law, and where it sits in the wider framework, so you can see the concept rather than memorise a sentence.
The definitions are taken from this site's own CIPP/E study notes, written by Victor Humenhuk. They reflect how the terms are used in the GDPR, the ePrivacy Directive, the Law Enforcement Directive, EDPB and WP29 guidance and CJEU case law - not a generic dictionary entry. Where a term is genuinely contested or unsettled in practice, the entry says so instead of pretending there is a clean answer.
The most efficient way to use this when revising is to work outwards from the terms you cannot explain out loud. Look a term up the moment you meet it in the study guide, read the definition once, cover it and say it back in your own words, then follow the link to the topic page for the full treatment and the context you need for scenario questions. The comparison pages below are worth going through separately: most CIPP/E questions do not test whether you know a definition, they test whether you can tell two neighbouring concepts apart under time pressure. When a pair stops feeling slippery, move to the practice questions and check it holds up in scenario form.
A
- Accountability - The set of obligations an organisation must meet to demonstrate and evidence its compliance with data protection law - n…
- Adequacy decision - A European Commission determination that a third country's protection is essentially equivalent to the EU's, removing th…
- Article 22 - Prohibits decisions based solely on automated processing (including profiling) that produce legal or similarly significa…
- Article 28 - Requires a written controller-processor contract with mandatory content and governs sub-processing.
- Article 49 - The GDPR article listing derogations - narrow, last-resort grounds for a transfer when no adequacy decision or appropria…
B
- Binding corporate rules - An internal, legally binding and enforceable privacy code allowing a corporate group to transfer personal data between i…
- biometric data - Article 4(14): personal data from specific technical processing of physical, physiological or behavioural characteristic…
C
- CJEU - Court of Justice of the European Union; assesses whether national surveillance laws comply with EU law and the Charter.
- Consent - Freely given, specific, informed and unambiguous indication of wishes, by a statement or clear affirmative action, agree…
- controller - The natural/legal person, authority, agency or body that, alone or jointly with others, determines the purposes and mean…
- Convention 108+ - The modernised Convention 108, via a protocol signed by 21 states on 10 October 2018; raises standards and aligns closel…
D
- Data minimisation - Personal data must be adequate, relevant and limited to what is necessary for the purpose; supports preferring traffic d…
- Data portability - Article 20: the right to receive personal data in a structured, commonly used, machine-readable format and transmit it t…
- Data protection by design - Embedding data protection into the design of systems and technologies from the outset and across the entire data life cy…
- Data Protection Directive - Directive 95/46/EC on the protection of individuals regarding processing of personal data and free movement of such data…
- data subject - An identified or identifiable natural person - defined only parenthetically within the definition of personal data, not …
- DPIA - Data protection impact assessment - a systematic process to identify and minimise the data protection risks of processin…
- DPO - Data protection officer - a staff member or contractor, expert in data protection law and practices, who advises on and …
E
- EDPB - European Data Protection Board (Art 68) - successor to the WP29; comprises a chair, the heads of the DPAs and the EDPS, …
- ePrivacy Directive - Directive 2002/58 governing communications over public electronic networks; main basis is consent, applies to public (no…
- ePrivacy Regulation - Proposed Regulation to replace the ePrivacy Directive with uniform, directly-effective EU rules on unsolicited communica…
- EU representative - The Article 27 representative a non-EU organisation caught by Article 3(2) must appoint; appointing one does not by itse…
- Explicit consent - A stricter, higher-bar consent for special-category data - still freely given, specific, informed and unambiguous, but u…
G
- Google Spain - CJEU case (C-131/12): Google Spain's selling of advertising was 'inextricably linked' to the US search engine's processi…
H
- Household exemption - Article 2(2)(c): exempts processing by a natural person in the course of a purely personal or household activity, with n…
I
- IP address - A numerical label assigned to internet-connected devices; may reveal the ISP and the device's physical location.
J
- Joint controllers - Two or more controllers jointly determining purposes and means; they must transparently allocate responsibilities and ma…
L
- Law Enforcement Directive - Directive (EU) 2016/680 (the LED), which governs processing by competent authorities for criminal-law purposes not cover…
- Lawful basis - One of the six legal grounds in Article 6 (consent, contract, legal obligation, vital interests, public interest, legiti…
- Legitimate interests - Lawful basis where processing is necessary for interests of the controller/third party, unless overridden by the data su…
- Location data - ePrivacy term for data showing the geographic position of a user's TERMINAL EQUIPMENT (phone/device) - not the person. I…
N
- NIS Directive - The Directive on security of network and information systems (also 'Cybersecurity Directive'); advances EU cybersecurity…
O
- OBA - Online behavioural advertising - website ads targeted on a user's behaviour observed over time, often via third-party ad…
- OECD Guidelines - 1980 OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data; placed accountability on the d…
- One-stop shop - The principle that for cross-border processing a single lead supervisory authority is the controller/processor's 'sole i…
P
- personal data - Any information relating to an identified or identifiable natural person (the data subject) - Article 4(1) GDPR.
- Personal data breach - Article 4(12): a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised di…
- Planet49 - CJEU ruling (October 2019) confirming cookie consent must be active behaviour, applies even to non-personal data, and mu…
- processing - Any operation or set of operations performed on personal data, automated or not - e.g. collection, storage, use, disclos…
- processor - The entity that processes personal data on behalf of the controller; keeps its own Article 30 record with controller-foc…
- Profiling - Automated processing to evaluate, analyse or predict personal aspects of a person - e.g. via cookies, web beacons or dig…
- Pseudonymisation - Processing data so it can no longer be attributed to a person without separately-kept additional information; a recommen…
- Purpose limitation - Data collected for a specified purpose may not be further processed in an incompatible way; a compatibility test governs…
R
- Records of processing - The Article 30 documentation that replaced the old notification/registration regime; kept internally, not filed, but pro…
- Right of access - Article 15: on request, a data subject gets confirmation of processing, a copy of their data, and prescribed details abo…
- Right to be forgotten - The right (from Google Spain, later Article 17) to have certain personal data delisted/erased, balanced against public-i…
- Right to object - The data subject's right (Article 21) to object to processing based on legitimate interests/public-interest tasks, or to…
S
- Schrems II - CJEU case (C-311/18): a commercial data transfer is not removed from the GDPR merely because the data might later underg…
- Soft opt-in - ePrivacy exemption letting a controller email/SMS its own similar products/services to a person whose details it obtaine…
- Special-category data - Article 9 data revealing racial/ethnic origin, political opinions, religious/philosophical beliefs, trade-union membersh…
- Standard contractual clauses - SCCs / model clauses - Commission-approved, non-negotiable standard contract terms binding the importer to EU-level prot…
- Storage limitation - Keep data in identifiable form no longer than necessary for the purpose; delete or anonymise when no longer needed.
- sub-processor - A processor engaged by the processor; must be subject to the same contractual obligations and the controller must at min…
- Supervisory authority - The independent national body in each member state charged with overseeing and enforcing data protection law; also calle…
T
- Technical and organisational measures - The security controls (technical, e.g. encryption; organisational, e.g. policies/teams) that protect personal data.
- Territorial scope - The Article 3 rules deciding which organisations are bound by the GDPR, based on EU establishment or on targeting/monito…
- Transfer impact assessment - The six-step assessment (per EDPB Recommendations 01/2020) of whether a transfer tool is effective in light of third-cou…
- Transparency - The requirement to be open and honest about the ways in which personal data are used, so data subjects understand the pr…
U
- UK GDPR - The GDPR as retained EU law in the UK, amended by the 2019 Exit Regulations (e.g. references to the EU/SAs replaced with…
W
- WP29 - Article 29 Working Party; its DPIA guidelines (revised 4 October 2017) cite systematic monitoring of employees as likely…
Keep going
The full CIPP/E study guide · Free practice questions · All study notes
Commonly confused pairs
Side-by-side breakdowns of the distinctions this exam tests most often.