Key terms
GDPR: key terms
Plain-English definitions of the words used in the course. In the lessons, tap any underlined term to read its definition without leaving the page.
12 terms, United Kingdom version
- BCC
- Blind carbon copy: sending an email to several people without showing them each other's addresses.
- Controller
- The organisation that decides why and how personal data is used.
- Data subject
- The person the personal data is about.
- ICO
- The Information Commissioner's Office (ICO), the data protection regulator.
- Lawful basis
- One of six legal reasons for using personal data: consent, contract, legal obligation, vital interests, public task or legitimate interests.
- Personal data
- Any information about an identifiable living person, such as a name, email, photo or booking history.
- Personal data breach
- A security incident in which personal data is lost, destroyed, changed, shared or accessed without permission.
- Phishing
- A fake email or message designed to trick you into clicking a link, opening a file or giving away passwords or payment details.
- Processing
- Anything done with personal data: collecting, storing, using, sharing or deleting it.
- Processor
- A company that handles personal data on behalf of a controller, such as a booking or payroll provider.
- Special category data
- More sensitive personal data, such as health (including allergies), religion, ethnicity or biometrics, which needs extra protection.
- Subject access request
- A request by a person for a copy of the personal data an organisation holds about them.
These terms come from the United Kingdom version of the course. See what the course covers.