ResourceCenter (/resources)

All the privacy tools and information you need in one easy-to-find place

 (h ps://www.linkedin.com/company/iapp---international-association-of-privacy-professionals/) 

(h ps://twi er.com/PrivacyPros)  (h ps://www.instagram.com/iappprivacypros/?hl=en) 

(h ps://www.facebook.com/IAPPprivacypros)  (h ps://www.youtube.com/user/IAPPvideos)

Glossary of Privacy Terms

Find the terms that relate to the program or designation you are studying for by using
the tabs below to narrow your search.

All (/resources/glossary) CIPM (/resources/glossary/group/cipm)

CIPP/C (/resources/glossary/group/cippc) CIPP/E (/resources/glossary/group/cippe)
CIPP/US (/resources/glossary/group/cippus) CIPT (/resources/glossary/group/cipt)

A B C D E F G H I J L M N O P Q R S U V W

 COLLAPSE ALL


Accountability

The implementation of appropriate technical and organisational measures to ensure and be able to
demonstrate that the handling of personal data is performed in accordance with relevant law, an idea
codified in the EU General Data Protection Regulation and other frameworks, including APEC's Cross
Border Privacy Rules. Traditionally, accountability has been a fair information practices principle, that due
diligence and reasonable steps will be undertaken to ensure that personal information will be protected
and handled consistently with relevant law and other fair use principles.

Return to top

/

Active Scanning Tools

DLP network, storage, scans and privacy tools can be used to identify security and privacy risks to
personal information. They can also be used to monitor for compliance with internal policies and
procedures, and block e-mail or file transfers based on the data category and definitions.

Return to top


American Institute of Certified Public Accountants

A U.S. professional organization of certified public accountants and co-creator of the WebTrust seal
program.

Acronym(s): AICPA

Associated term(s): Canadian Institute of Chartered Accountants (/resources/glossary/#canadian-

institute-of-chartered-accountants), Seal Programs (/resources/glossary/#seal-programs), WebTrust
(/resources/glossary/#webtrust)

Return to top


Anonymization

The process in which individually identifiable data is altered in such a way that it no longer can be related
back to a given individual. Among many techniques, there are three primary ways that data is anonymized.
Suppression is the most basic version of anonymization and it simply removes some identifying values
from data to reduce its identifiability. Generalization takes specific identifying values and makes them
broader, such as changing a specific age (18) to an age range (18-24). Noise addition takes identifying values
from a given data set and switches them with identifying values from another individual in that data set.
Note that all of these processes will not guarantee that data is no longer identifiable and have to be
performed in such a way that does not harm the usability of the data.

Associated law(s):Anonymous Data, De-Identification (h ps://iapp.org/resources/glossary/#280017),

Mircodata Sets, Re-identification

Return to top


APEC Privacy Principles

A set of non-binding principles adopted by the Asia-Pacific Economic Cooperative (APEC) that mirror the
OECD Fair Information Privacy Practices. Though based on OECD Guidelines, they seek to promote
electronic commerce throughout the Asia-Pacific region by balancing information privacy with business
needs.

Return to top


Assess

/
The first of four phases of the privacy operational life cycle; provides the steps, checklists and processes
necessary to assess any gaps in a privacy program as compared to industry best practices, corporate
privacy policies, applicable privacy laws, and objective-based privacy program frameworks.

Associated term(s): Privacy Operational Life Cycle; Protect (/resources/glossary/#protect-2); Sustain

(/resources/glossary/#sustain-2); Respond (/resources/glossary/#respond-2)

Return to top


Audit Life Cycle

High-level, five-phase audit approach.  The steps include: Audit Planning; Audit Preparation; Conducting
the Audit; Reporting; and Follow-up.

Return to top


Behavioral Advertising

Advertising that is targeted at individuals based on the observation of their behaviour over time. Most
o en done via automated processing of personal data, or profiling, the General Data Protection Regulation
requires that data subjects be able to opt-out of any automated processing, to be informed of the logic
involved in any automatic personal data processing and, at least when based on profiling, be informed of
the consequences of such processing. If cookies are used to store or access information for the purposes of
behavioral advertising, the ePrivacy Directive requires that data subjects provide consent for the
placement of such cookies, a er having been provided with clear and comprehensive information.

Acronym(s): OBA

Associated term(s): Online Behavioral Advertising, Behavioral Targeting, Contextual Advertising,

Demographic Advertising, Premium Advertising, Psychographic Advertising, Remnant Advertising

Return to top


Binding Corporate Rules

Binding Corporate Rules (BCRs) are an appropriate safeguard allowed by the General Data Protection
Regulation to facilitate cross-border transfers of personal data between the various entities of a corporate
group worldwide. They do so by ensuring that the same high level of protection of personal data is
complied with by all members of the organizational group by means of a single set of binding and
enforceable rules. BCRs compel organizations to be able to demonstrate their compliance with all aspects
of applicable data protection legislation and are approved by a member state data protection authority. To
date, relatively few organizations have had BCRs approved.

Acronym(s): BCR

Return to top


Bureau of Competition

/
The United States’ Federal Trade Commission’s Bureau of Competition enforces the nation's antitrust laws,
which form the foundation of our free market economy. The antitrust laws promote the interests of
consumers; they support unfe ered markets and result in lower prices and more choices.

Associated term(s): Bureau of Consumer Protection; Bureau of Economics

Return to top


Bureau of Consumer Protection

The United States’ Federal Trade Commission’s Bureau of Consumer Protection stops unfair, deceptive and
fraudulent business practices by collecting complaints and conducting investigations, suing companies
and people that break the law, developing rules to maintain a fair marketplace, and educating consumers
and businesses about their rights and responsibilities.

Associated term(s): Bureau of Competition; Bureau of Economics

Return to top


Bureau of Economics

The United States’ Federal Trade Commission’s Bureau of Economics helps the FTC evaluate the economic
impact of its actions by providing economic analysis for competition and consumer protection
investigations and rulemakings, and analyzing the economic impact of government regulations on
businesses and consumers.

Associated term(s): Bureau of Competition; Bureau of Consumer Protection

Return to top


Business case

The starting point for assessing the needs of the privacy organization, it defines the individual program
needs and the ways to meet specific business goals, such as compliance with privacy laws or regulations,
industry frameworks, customer requirements and other considerations.

Return to top


Business Continuity and Disaster Recovery Plan

A risk mitigation plan designed to prepare an organization for crises and to ensure critical business
functions continue. The focus is to recover from a disaster when disruptions of any size are encountered.

Acronym(s): BCDR

Return to top


Business Continuity Plan
/
The business continuity plan is typically dra ed and maintained by key stakeholders
(h ps://iapp.org/resources/glossary/#stakeholders-2), spelling out departmental responsibilities and
actions teams must take before, during and a er an event in order to help operations run smoothly.
Situations covered in a BCP o en include fire, flood, natural disasters (tornadoes and hurricanes), and
terrorist a ack.

Acronym(s): BCP

Return to top


Canadian Institute of Chartered Accountants

The Canadian Institute of Chartered Accountants (h ps://www.cpacanada.ca/) (CICA), in partnership with

the provincial and territorial institutes, is responsible for the functions that are critical to the success of
the Canadian CA profession. CICA, pursuant to the 2006 Protocol, is entrusted with the responsibility for
providing strategic leadership, co-ordination of common critical functions of strategic planning, protection
of the public and ethics, education and qualification, standard se ing and communications

Acronym(s): CICA

Return to top


Centralized governance

Privacy governance model that leaves one team or person responsible for privacy-related affairs; all other
persons or organizations will flow through this point.

Return to top


Children’s Online Privacy Protection Act (COPPA) of 1998

A U.S. federal law that applies to the operators of commercial websites and online services that are
directed to children under the age of 13. It also applies to general audience websites and online services
that have actual knowledge that they are collecting personal information from children under the age of
13. COPPA requires these website operators: to post a privacy notice on the homepage of the website;
provide notice about collection practices to parents; obtain verifiable parental consent before collecting
personal information from children; give parents a choice as to whether their child’s personal information
will be disclosed to third parties; provide parents access and the opportunity to delete the child’s personal
information and opt out of future collection or use of the information, and maintain the confidentiality,
security and integrity of personal information collected from children.

Acronym(s): COPPA

Link to text of law: 15 U.S.C. §§ 6501-6508 (h p://www.ecfr.gov/cgi-bin/text-idx?

SID=4939e77c77a1a1a08c1cbf905fc4b409&node=16%3A1.0.1.3.36&rgn=div5)

Return to top


Choice

/
In the context of consent, choice refers to the idea that consent must be freely given and that data
subjects must have a genuine choice as to whether to provide personal data or not. If there is no true
choice it is unlikely the consent will be deemed valid under the General Data Protection Regulation.

Associated term(s): Consent

Return to top


CIA Triad

Also known as information security triad; three common information security principles from the 1960s: 
Confidentiality, integrity (h ps://iapp.org/resources/glossary/#integrity), availability
(h ps://iapp.org/resources/glossary/#availability).

Associated term(s): Information Security Triad

Return to top


Collection Limitation

A fair information practices principle, it is the principle stating there should be limits to the collection of
personal data, that any such data should be obtained by lawful and fair means and, where appropriate,
with the knowledge or consent of the data subject.

Return to top


Consent

This privacy requirement is one of the fair information practices. Individuals must be able to prevent the
collection of their personal data, unless the disclosure is required by law. If an individual has choice about
the use or disclosure of his or her information, consent is the individual's way of giving permission for the
use or disclosure. Consent may be affirmative; i.e., opt-in; or implied; i.e., the individual didn’t opt out.
(1) Affirmative/Explicit Consent: A requirement that an individual ""signifies"" his or her agreement with a
data controller by some active communication between the parties.

(2) Implicit Consent: Implied consent arises where consent may reasonably be inferred from the action or
inaction of the individual.

Associated term(s): Choice

Return to top


Consumer Reporting Agency

Any person or entity that complies or evaluates personal information for the purpose of furnishing
consumer reports to third parties for a fee.

Acronym(s): CRAs
/
Associated term(s): Credit Reporting Agency

Return to top


Current baseline

“As-is” data privacy requirements; the current environment and any protections, policies, and procedures
currently deployed.

Return to top


Cyber liability insurance

Relatively new form of insurance protection that fills gaps typically not covered by General Commercial
Liability plans. Cyber liability insurance may cover many breach-related expenses, including forensic
investigations, outside counsel fees, crisis management services, public relations experts, breach
notification, and call center costs.

Return to top


Data Breach

The unauthorized acquisition of computerized data that compromises the security, confidentiality, or
integrity of personal information maintained by a data collector. Breaches do not include good faith
acquisitions of personal information by an employee or agent of the data collector for a legitimate purpose
of the data collector—provided the personal information is not used for a purpose unrelated to the data
collector's business or subject to further unauthorized disclosure.

Associated term(s): Breach, Privacy Breach (Canadian)

Return to top


Data Controller

The natural or legal person, public authority, agency or any other body which alone or jointly with others
determines the purposes and means of the processing of personal data. Where the purposes and means of
such processing are determined by EU or member state law, the controller or the specific criteria for its
nomination may be provided for by EU or member state law.

Associated term(s): Data Processor

Return to top


Data Inventory

/
Also known as a record of authority, identifies personal data as it moves across various systems and thus
how data is shared and organized, and its location.  That data is then categorized by subject area, which
identifies inconsistent data versions, enabling identification and mitigation of data disparities.

Return to top


Data Life Cycle Management

Also known as Information Life Cycle Management (ILM) or data governance, DLM is a policy-based
approach to managing the flow of information through a life cycle from creation to final disposition. DLM
provides a holistic approach to the processes, roles, controls and measures necessary to organize and
maintain data, and has 11 elements: Enterprise objectives; minimalism; simplicity of procedure and
effective training; adequacy of infrastructure; information security; authenticity and accuracy of one’s own
records; retrievability; distribution controls; auditability; consistency of policies; and enforcement.

Acronym(s): DLM; ILM

Associated term(s): Information Life Cycle Management

Return to top


Data Minimization Principle

The idea that one should only collect and retain that personal data which is necessary.

Link to text of law: Directive 95/46/EC (h p://eur-lex.europa.eu/LexUriServ/LexUriServ.do?

uri=CELEX:31995L0046:en:HTML)

Link to text of law: Regulation EC (No) 45/2001 (h p://eur-lex.europa.eu/LexUriServ/LexUriServ.do?

uri=OJ:L:2001:008:0001:0022:en:PDF)

Return to top


Data Protection Authority

Independent public authorities that supervise the application of data protection laws in the EU. DPAs
provide advice on data protection issues and field complaints from individuals alleging violations of the
General Data Protection Regulation. Each EU member state has its own DPA. Under GDPR, DPAs have
extensive enforcement powers, including the ability to impose fines that total 4% of a company’s global
annual revenue.

Acronym(s): DPA

Return to top


Data Protection Impact Assessment

/
The process by which companies can systematically assess and identify the privacy and data protection
impacts of any products they offer and services they provide. It enables them to identify the impact and
take the appropriate actions to prevent or, at the very least, minimise the risk of those impacts. DPIAs are
required by the General Data Protection Regulation in some instances, particularly where a new product or
service is likely to result in a high risk to the rights and freedoms of natural persons.

Acronym (s): DPIA

Associated term(s): Privacy Impact Assessments (PIAs)

Return to top


Data Quality

A fair information practices principle, it is the principle that personal data should be relevant to the
purposes for which it is to be used, and, to the extent necessary for those purposes, should be accurate,
complete and kept up-to-date. The quality of data is judged by four criteria: Does it meet the business
needs?; Is it accurate?; Is it complete?, and is it recent? Data is of an appropriate quality if these criteria
are satisfied for a particular application.

Return to top


Decentralized Governance

Also known as “local governance,” this governance model involves the delegation of decision-making
authority down to the lower levels in an organization, away from and lower than a central authority. There
are fewer tiers in the organizational structure, wider span of control and bo om-to-top flow of decision-
making and ideas.

Associated term(s): Local Governance

Return to top


Direct Marketing

When the seller directly contacts an individual, in contrast to marketing through mass media such as
television or radio.

Return to top


Do Not Track

A proposed regulatory policy, similar to the existing Do-Not-Call Registry in the United States, which
would allow consumers to opt out of web-usage tracking.

Acronym(s): DNT

Return to top
/

Electronic Communications Privacy Act of 1986

The collective name of the Electronic Communications Privacy and Stored Wire Electronic
Communications Acts, which updated the Federal Wiretap Act of 1968
(h ps://transition.fcc.gov/Bureaus/OSEC/library/legislative_histories/1615.pdf). ECPA, as amended,
protects wire, oral and electronic communications while those communications are being made, are in
transit, and when they are stored on computers. The act applies to e-mail, telephone conversations and
data stored electronically. The USA PATRIOT Act and subsequent federal enactments have clarified and
updated ECPA in light of the ongoing development of modern communications technologies and methods,
including easing restrictions on law enforcement access to stored communications in some cases.

Link to text of law: Electronic Communications Privacy Act of 1986

(h ps://www.law.cornell.edu/uscode/text/18/part-I/chapter-119)

Acronym(s): ECPA

Associated law(s): Stored Communications Act (h ps://iapp.org/resources/glossary/#stored-

communications-act), Stored Wire Electronic Communications Act
(h ps://www.law.cornell.edu/uscode/text/18/part-I/chapter-121), USA Patriot Act
(h ps://iapp.org/resources/glossary/#usa-patriot-act)

Return to top


EU Data Protection Directive

The EU Data Protection Directive (95/46/EC) was replaced by the General Data Protection Regulation in
2018. The Directive was adopted in 1995, became effective in 1998 and was the first EU-wide legislation that
protected individuals’ privacy and personal data use.

Associated term(s): Data Protection Directive

Return to top


Five-Step Metric Life Cycle

See Metrics (h ps://iapp.org/resources/glossary/#metrics-2)

Return to top


Gap Analysis

Performed to determine the capability of current privacy management to support each of the business and
technical requirements uncovered during an audit or privacy assessment, if any exist; requires reviewing
the capabilities of current systems, management tools, hardware, operating systems, administrator
expertise, system locations, outsourced services and physical infrastructure.

Return to top

Generally Accepted Privacy Principles

/
 A framework promulgated by the American Institute of Certified Public Accountants
(h ps://iapp.org/resources/glossary/#american-institute-of-certified-public-accountants) (AICPA) in
conjunction with the Canadian Institute of Chartered Accountants (CICA). The ten principles are
management, notice, choice and consent, collection, use and retention, access, disclosure to third parties,
security for privacy, quality, monitoring and enforcement.

Acronym(s): GAPP

Return to top


Gramm-Leach-Bliley Act

The commonly used name for The Financial Services Modernization Act of 1999. The act re-organized
financial services regulation in the United States and applies broadly to any company that is “significantly
engaged” in financial activities in the U.S. In its privacy provisions, GLBA addresses the handling of non-
public personal information (h ps://iapp.org/resources/glossary/#personal-information), defined broadly
to include a consumer’s name and address, and consumers’ interactions with banks, insurers and other
financial institutions. GLBA requires financial institutions to securely store personal financial information;
give notice of their policies regarding the sharing of personal financial information, and give consumers
the ability to opt-out (h ps://iapp.org/resources/glossary/#opt-out) of some sharing of personal financial
information.

Link to text of law: Gramm-Leach-Bliley Act (h ps://www.congress.gov/106/plaws/publ102/PLAW-

106publ102.pdf)

Acronym(s): GLBA

Return to top


Health Insurance Portability and Accountability Act, The

A U.S. law passed to create national standards for electronic healthcare transactions, among other
purposes. HIPAA required the U.S. Department of Health and Human Services (h p://www.hhs.gov/) to
promulgate regulations to protect the privacy and security of personal health information. The basic rule
is that patients have to opt in before their information can be shared with other organizations—although
there are important exceptions such as for treatment, payment and healthcare operations.

Link to text of law: The Health Insurance Portability and Accountability Act

(h ps://www.gpo.gov/fdsys/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf)

Acronym(s): HIPAA

Related terms: HITECH (h ps://iapp.org/resources/glossary/#health-information-technology-for-

economic-and-clinical-health-act-the), The Privacy Rule (h ps://iapp.org/resources/glossary/#privacy-rule),
The Security Rule

Return to top


Hybrid Governance

/
This privacy governance model allows for a combination of centralized and local governance.  Typically
seen when a large organization assigns a main individual responsibility for privacy-related affairs, and the
local entities then fulfill and support the policies and directives from the central governing body.

Return to top


Individual Participation

It is fair information practices principle that an individual should have the right: a) to obtain from a data
controller, or otherwise, confirmation of whether or not the data controller has data relating to them; b) to
have data relating to them communicated to them within a reasonable time; at a charge, if any, that is not
excessive; in a reasonable manner, and in a form that is readily intelligible to them; c) to be given reasons if
a request made under subparagraphs (a) and (b) is denied, and to be able to challenge such denial; and d) to
challenge data relating to them and, if the challenge is successful, to have the data erased, rectified,
completed or amended.

Associated term(s): FIPs

Return to top


Information Life Cycle

The information life cycle recognizes that data has different value, and requires approaches, as it moves
through an organization from collection to deletion. The stages are generally considered to be: Collection,
processing, use, disclosure, retention, and destruction.

Return to top


Information Life Cycle Management

Also known as data life cycle management (DLM) or data governance, ILM is a policy-based approach to
managing the flow of information through a life cycle from creation to final disposition. ILM provides a
holistic approach to the processes, roles, controls and measures necessary to organize and maintain data,
and has 11 elements:  Enterprise objectives; minimalism; simplicity of procedure and effective training;
adequacy of infrastructure; information security; authenticity and accuracy of one’s own records;
retrievability; distribution controls; auditability; consistency of policies; and enforcement.

Acronym(s): DLM, ILM

Associated term(s): Data Life Cycle Management

Return to top


Information Security Practices

Provide management, technical and operational controls to reduce probable damage, loss, modification or
unauthorized data access.

Return to top
/

Information Security Triad

Also known as “the C-I-A triad”; consists of three common information security principles: Confidentiality,
integrity (h ps://iapp.org/resources/glossary/#integrity), and availability
(h ps://iapp.org/resources/glossary/#availability).

Associated law(s): C-I-A Triad (h ps://iapp.org/resources/glossary/#c-i-a-triad-2)

Return to top


Internal Partners

Professionals and departments within an organization who have ownership of privacy activities, e.g.,
human resources, marketing, information technology.

Return to top


Jurisdiction

The authority of a court to hear a particular case. Courts must have jurisdiction over both the parties to
the dispute (personal jurisdiction) and the type of dispute (subject ma er jurisdiction). The term is also
used to denote the geographical area or subject-ma er to which such authority applies.

Return to top


Local Governance

Also known as “decentralized governance,” this governance model involves the delegation of decision-
making authority down to the lower levels in an organization, away from and lower than a central
authority. There are fewer tiers in the organizational structure, wider span of control and bo om-to-top
flow of decision-making and ideas.

Associated term(s): Decentralized Governance

Return to top


Metric Life Cycle

The processes and methods to sustain a metric (h ps://iapp.org/resources/glossary/#metrics-2) to match

the ever-changing needs of an organization.  Consists of a 5-step process: (1) Identification of the intended
audience; (2) Definition of data sources; (3) Selection of privacy metrics; (4) Collection and refinement of
systems/application collection points; and (5) Analysis of the data/metrics to provide value to the
organization and provide a feedback quality mechanism.

Return to top


Metrics

/
Tools that facilitate decision-making and accountability through collection, analysis, and reporting of data.
They must be measurable, meaningful, clearly defined (with boundaries), indicate progress, and answer a
specific question to be valuable and practical.

Associated term(s): Metric Life Cycle

Return to top


National Institute of Standards and Technology

NIST is an agency within the Department of Commerce.  NIST has the lead responsibility for the
development and issuance of security standards and guidelines for the federal government, contractors,
and the United States critical information infrastructure.

The NIST has published a series of publications in support of its risk management framework (RMF).  The
RMF is a multi-tiered and structured methodology for creating a unified information security framework
for the federal government in order to meet the vast array of requirements set forth in FISMA.

Link to: National Institute of Standards and Technology (h ps://www.nist.gov/)

Acronym(s): NIST

Associated term(s): FISMA

Associated law(s): FISMA

Return to top


Negligence

An organization will be liable for damages if it breaches a legal duty to protect personal information and
an individual is harmed by that breach.

Associated term(s): Private Right of Action

Return to top


Non-Public Personal Information

Is defined by GLBA as personally identifiable financial information (i) provided by a consumer to a

financial institution, (ii) resulting from a transaction or service performed for the consumer, or (iii)
otherwise obtained by the financial institution. Excluded from the definition are (i) publicly available
information and (ii) any consumer list that is derived without using personally identifiable financial
information.

Acronym(s): NPI

Associated law(s): GLBA (h ps://iapp.org/resources/glossary/#gramm-leach-bliley-act)

Return to top
/

Openness

A fair information practices principle. There should be a general policy of openness about developments,
practices and policies with respect to personal data. Means should be readily available to establish the
existence and nature of personal data, and the main purposes of their use, as well as the identity and usual
residence of the data controller. Closely linked with transparency.

Return to top


Opt-In

One of two central concepts of choice. It means an individual makes an active affirmative indication of
choice; i.e., checking a box signaling a desire to share his or her information with third parties.

Associated term(s): Choice; Consent; Opt-Out

Return to top


Opt-Out

One of two central concepts of choice. It means an individual’s lack of action implies that a choice has
been made; i.e., unless an individual checks or unchecks a box, their information will be shared with third
parties.

Associated term(s): Choice; Consent; Opt-In

Return to top


Organization for Economic Cooperation and Development

An international organization that promotes policies designed to achieve the highest sustainable
economic growth, employment and a rising standard of living in both member and non-member countries,
while contributing to the world economy.

Link to: Organization for Economic Cooperation and Development (h p://www.oecd.org/)

Acronym(s): OECD

Return to top


PCI Data Security Standard

A self-regulatory system that provides an enforceable security standard for payment card data. The rules
were dra ed by the Payment Card Industry Security Standards Council, which built on previous rules
wri en by the various credit card companies. Except for small companies, compliance with the standard
requires hiring a third party to conduct security assessments and detect violations. Failure to comply can
lead to exclusion from Visa, MasterCard or other major payment card systems, as well as penalties.

/
Acronym(s): PCI-DSS

Return to top


Performance Measurement

The process of formulating or selecting metrics to evaluate implementation, efficiency or effectiveness;

gathering data and producing quantifiable output that describes performance.

Associated term(s): Metrics

Return to top


Personal Data

The predominant term for Personal Information in the European Union, defined broadly in the General
Data Protection Regulation as any information relating to an identified or identifiable natural person.

Associated term(s): Personal Information (h ps://iapp.org/resources/glossary/#personal-information);

Personally Identifying Information; Personally Identifiable Information

Return to top


Personal Information

A synonym for "personal data." It is a term with particular meaning under the California Consumer Privacy
Act, which defines it as information that identifies, relates to, describes, is capable of being associated
with, or could reasonably be linked, directly or indirectly, with a particular consumer.

Acronym(s): PI

Associated term(s): Personal Data (h ps://iapp.org/resources/glossary/#personal-data); Personally

Identifying Information; Personally Identifiable Information

Return to top


Personal Information Protection and Electronic Documents Act

A Canadian act with two goals: (1) to instill trust in electronic commerce and private sector transactions
for citizens, and (2) to establish a level playing field where the same marketplace rules apply to all
businesses.

Link to text of law: Personal Information Protection and Electronic Documents Act (h p://laws-
lois.justice.gc.ca/eng/acts/P-8.6/index.html)

Acronym(s): PIPEDA

Return to top
/

Platform for Privacy Preferences

A machine-readable language that helps to express a website’s data management practices in an

automated fashion.

Acronym(s): P3P

Return to top


Privacy by Design

Generally regarded as a synonym for Data Protection by Design (see Data Protection by Design
(h ps://iapp.org/resources/glossary/#data-protection-by-design)). However, Privacy by Design as a specific
term was first outlined in a framework in the mid-1990s by then-Information and Privacy Commissioner of
Ontario, Canada, Ann Cavoukian, with seven foundational principles.

Acronym(s): PbD

Return to top


Privacy Champion

An executive who serves as the privacy program sponsor and acts as an advocate to further foster privacy
as a core organization concept.

Return to top


Privacy Impact Assessment

“An analysis of how information is handled: (i) to ensure handling conforms to applicable legal, regulatory
and policy requirements regarding privacy; (ii) to determine the risks and effects of collecting, maintaining
and disseminating information in identifiable form in an electronic information system, and (iii) to
examine and evaluate protections and alternative processes for handling information to mitigate potential
privacy risks.” PIAs should disclose what PII is being collected, why it is being collected, what the intended
uses of the PII are, whom the PII will be shared with, what opportunities individuals will have to opt-out of
PII collection or use, how the PII will be secured, whether a system of records is being created under the
Privacy Act and an analysis of the information life cycle. Checklists or tools used to ensure that the system
used to collect personal information is evaluated for privacy risks, designed with lifecycle principles in
mind and made to ensure that effective and required privacy protection measures are used. A PIA should
be completed pre-implementation of the privacy project, product, or service and should be ongoing
through its deployment. The PIA should identify these a ributes of the data collected: what information is
collected; why it is collected; the intended use of the information; with whom the information is shared,
and the consent and choice rights of the data subjects. The PIA should be used to assess new systems,
significant changes to existing systems, operational policies and procedures and intended use of the
information. PIAs should also be used before, during, and a er mergers and acquisitions. An effective PIA
evaluates the sufficiency of privacy practices and policies with respect to existing legal, regulatory and
industry standards, and maintains consistency between policy and operational practices.

Acronym(s): PIAs
/
Return to top


Privacy Maturity Model

Provides a standardized reference for companies to use in assessing the level of maturity of their privacy
programs.

Acronym(s): PMM

Return to top


Privacy Operational Life Cycle

Focused on refining and improving privacy processes, this model continuously monitors and improves the
privacy program, with the added benefits of a life cycle approach to measure (assess), improve (protect),
evaluate (sustain) and support (respond), and then start again.

Associated term(s): Assess; Protect; Sustain; Respond

Return to top


Privacy Program Framework

An implementation roadmap that provides the structure or checklists (documented privacy procedures
and processes) to guide the privacy professional through privacy management and prompts them for the
details to determine all privacy-relevant decisions for the organization.

Return to top


Privacy Threshold Analysis

One tool used to determine whether a PIA should be conducted.

Acronym(s): PTA

Return to top


Privacy-Enhancing Technologies

Privacy technology standards developed solely to be used for the transmission, storage and use of privacy
data. Examples include Platform for Privacy Preferences (h ps://iapp.org/resources/glossary/#platform-
for-privacy-preferences-project) (P3P) and Enterprise Privacy Authorization Language (EPAL).

Acronym(s): PETs

Return to top

/

Private Right of Action

Unless otherwise restricted by law, any individual that is harmed by a violation of the law can file a lawsuit
against the violator.

Associated term(s): Negligence

Return to top


Protect

The second of four phases of the privacy operational life cycle. It provides the data life cycle, information
security practices and Privacy by Design principles to “protect” personal information.

Associated term(s): Privacy Operational Life Cycle; Assess; Sustain; Respond

Return to top


Protected Health Information

Any individually identifiable health information transmi ed or maintained in any form or medium that is
held by an entity covered by the Health Insurance Portability and Accountability Act or its business
associate; identifies the individual or offers a reasonable basis for identification; is created or received by a
covered entity or an employer; and relates to a past, present or future physical or mental condition,
provision of healthcare or payment for healthcare to that individual.

Acronym(s): PHI

Return to top


Pseudonymous Data

Data points which are not directly associated with a specific individual. The identity of the person is not
known but multiple appearances of that person can be linked together. Uses an ID rather than PII to
identify data as coming from the same source. IP address, GUID and ticket numbers are forms of
pseudonymous values.

Associated term(s): Identifiability, Identifiers, GUID, Authentication, De-Identification

(h ps://iapp.org/resources/glossary/#280017), Re-Identification.

Return to top


Purpose Specification

See "Purpose Limitation".

Associated term(s): FIPs

/
Return to top


Qualified Protective Order

Requires that the parties are prohibited from using or disclosing protected health information for any
purpose other than the litigation and that the PHI will be returned or destroyed at the end of the
litigation.

Acronym(s): QPO

Associated law(s): HIPAA

Associated terms: PHI

Return to top


Respond

The fourth of four phases of the privacy operational life cycle. It includes the respond principles of
information requests, legal compliance, incident-response planning and incident handling. The “respond”
phase aims to reduce organizational risk and bolster compliance to regulations.

Associated term(s): Privacy Operational Life Cycle; Assess; Protect; Sustain

Return to top


Retention

Within the information life cycle, the concept that organizations should retain personal information only
as long as necessary to fulfill the stated purpose.

Return to top


Return on Investment

An indicator used to measure the financial gain/loss (or “value”) of a project in relation to its cost.  Privacy
ROI defines metrics to measure the effectiveness of investments to protect investments in assets.

Acronym(s): ROI

Return to top


Right Not To Be Subject to Fully Automated Decisions

Under Article 15 of the Data Protection Directive, individuals are entitled to object to being subject to fully
automated decisions. The right, however, does not allow an individual to object to automated processing
that then leads to a human decision.
/
Associated law(s): EU Data Protection Directive

Return to top


Security Safeguards

A fair information practices principle, it is the principle that personal data should be protected by
reasonable security safeguards against such risks as loss or unauthorized access, destruction, use,
modification or disclosure of data.

Return to top


Social Engineering

A general term for how a ackers can try to persuade a user to provide information or create some other
sort of security vulnerability.

Associated term(s): Phishing

Return to top


Stakeholders

Individual executives within an organization who lead and “own” the responsibility of privacy activities.

Return to top


Strategic Management

The first high-level task necessary to implementing proactive privacy management through three
subtasks:  Define your organization’s privacy vision and privacy mission statements; develop privacy
strategy; and structure your privacy team.

Return to top


Substitute Notice

Most legislation recognizes that data breach notifications involving thousands of impacted data subjects
could place an undue financial burden on the organization and therefore allow substitute notification
methods. In Connecticut, for example, “Substitute notice shall consist of the following: (A) Electronic mail
notice when the person, business or agency has an electronic mail address for the affected persons; (B)
conspicuous posting of the notice on the website of the person, business or agency if the person maintains
one, and (C) notification to major state-wide media, including newspapers, radio and television.”

Associated term(s): Data Breach

/
Return to top


Sustain

The third of four phases of the privacy operational life cycle. It provides privacy management through the
monitoring, auditing, and communication aspects of the management framework.

Associated term(s): Privacy Operational Life Cycle; Assess; Protect; Respond

Return to top


Unfair Trade Practices

Commercial conduct that intentionally causes substantial injury, without offse ing benefits, and that
consumers cannot reasonably avoid.

Associated term(s): Deceptive Trade Practices

Associated law(s): U.S. Federal Trade Commission Act (h p://uscode.house.gov/view.xhtml?

req=granuleid%3AUSC-prelim-title15-chapter2-subchapter1&edition=prelim)

Return to top


US-CERT

A partnership between the Department of Homeland Security and the public and private sectors intended
to coordinate the response to security threats from the Internet. As such, it releases information about
current security issues, vulnerabilities and exploits via the National Cyber Alert System and works with
so ware vendors to create patches for security vulnerabilities.

Link to: National Cyber Alert System (h ps://www.us-cert.gov/ncas)

Link to: U.S. Computer Emergency Readiness Team (h ps://www.us-cert.gov/)

Acronym(s): US-CERT

Return to top


US-CERT IT Security Essential Body of Knowledge

Fourteen generic information security practice competency areas, including: Digital Security; Digital
Forensics; Enterprise Continuity; Incident Management; IT Security and Training Awareness; IT Systems
Operation and Maintenance; Network and Telecommunications Security; Personnel Security; Physical and
Environmental Security; Procurement; Regulatory and Standards Compliance; Security Risk Management;
Strategic Security Management; and System and Application Security.

Link to: US-CERT IT Security Essential Body of Knowledge

(h p://csrc.nist.gov/groups/SMA/ispab/documents/minutes/2007-12/ISPAB_Dec7-BOldfield.pdf)
/
  

Return to top


Vendor Management

Assessment of a third-party vendor for the vendor’s privacy and information security policies, access
controls, where the personal information will be held and who has access to it. Privacy/security
questionnaires, privacy impact assessments and other checklists can be used to assess this risk.

Return to top


Video Surveillance

Recordings that do not have sound.

Associated term(s): Video Surveillance Guidelines

Associated law(s): FISA (h ps://iapp.org/resources/glossary/#foreign-intelligence-surveillance-act-of-1978-

the)

Return to top


WebTrust

Created by the American Institute of Certified Public Accountants (AICPA) and the Canadian Institute of
Chartered Accountants (CICA). It is a self-regulating seal program which licenses qualifying certified public
accountants.

Associated term(s): Seal Programs

Return to top

© 2020 International Association of Privacy Professionals.

All rights reserved.

Pease International Tradeport, 75 Rochester Ave.

Portsmouth, NH 03801 USA • +1 603.427.9200