Data protection acronyms can be dense – even for seasoned professionals – so it's no surprise that acronyms like DPIA, SCCs and IDTA can leave you second-guessing your understanding in meetings or compliance reviews.
Whether you're working through cross-border transfers or implementing appropriate technical and organisational measures, it’s crucial to know your DPOs from your DSARs. To help, we’ve put together a plain-English breakdown of the most common data protection acronyms.
And if you're navigating complex obligations under UK GDPR or managing internal policies, our data protection solicitors are here to advise you on compliance strategies, documentation and risk mitigation that align with your commercial goals.
Contents:
- (BYOD) Bring your own device
- (BCRs) Binding Corporate Rules
- (C2C) Controller to Controller
- (C2P) Controller to Processor
- (CCPA) California Consumer Privacy Act 2018
- (DP) Data Protection
- (DPA) Data Protection
- (DPA) Data Processing Agreement
- (DPA) Data Protection Authority
- (DPIA) Data Protection Impact Assessment
- (DPM) Data Protection Manager
- (DPO) Data Protection Officer
- (DSA) Data Sharing Agreement
- (DSAR or SAR) Data Subject Access Request
- (EDPB) European Data Protection Board
- (FOIA) Freedom of Information Act 2000
- (GDPR) General Data Protection Regulation
- (ICO) Information Commissioner’s Office
- (IDTA) International Data Transfer Agreement
- (IG) Information Governance
- (P2C) Processor to Controller
- (P2P) Processor to Processor
- (PECR) Privacy and Electronic Communications Regulations
- (PET) Privacy Enhancing
- (ROPA) Record of Processing Activities
- (SCCs) Standard Contractual
- (TIA) Transfer Impact Assessment
- (TOMs) Technical and Organisational
- (TRA) Transfer Risk Assessment
- (UK GDPR) UK General Data Protection Regulation
- Making sense of your data protection responsibilities
(BYOD) Bring your own device
Bring your own device: the trend of employees and workers using their own personal devices to connect to their organisational networks and access work-related systems. Employers who support this technology are advised to have a ‘BYOD Policy’ in place to meet obligations to implement appropriate organisational and technical measures under data protection legislation.
(BCRs) Binding Corporate Rules
Binding Corporate Rules: data protection rules and policies adhered to by EU or UK-based companies to safeguard the transfer of personal data to a third country. The ‘SCCs’ and the ‘IDTA’ are other examples of accepted methods. BCRs are usually relied upon by large multinational corporate groups.
(C2C) Controller to Controller
Controller to Controller: usually a reference to an agreement such as a Data Sharing Agreement (DSA) (see below) or a clause, annexe or schedule that relates to the sharing of personal data between two independent data controllers (i.e. two separate controllers that determine the purpose and means of the processing of the personal data). Sometimes used in the context of restricted transfers and the SCCs (see below). The EU SCCs module 1 applies to C2C restricted transfers.
(C2P) Controller to Processor
Controller to Processor: usually a reference to an agreement such as a Data Processing Agreement (DPA) (see below) or a clause, annexe or schedule that relates to the sharing of personal data between a data controller and a data processor (acting under the instruction of the controller). Sometimes used in the context of restricted transfers and the SCCs (see below). The EU SCCs module 2 applies to C2P restricted transfers.
(CCPA) California Consumer Privacy Act 2018
California Consumer Privacy Act 2018: a statute intended to enhance privacy rights and consumer protection for residents of California, United States.
(DP) Data Protection
Data Protection: the overarching term used to describe the set of strategies, processes, and principles relied upon to secure the privacy, availability and integrity of personal data.
(DPA) Data Protection
Data Protection Act 1998: an Act of Parliament of the United Kingdom designed to protect personal data. It was superseded by the Data Protection Act 2018.
Data Protection Act 2018: an Act of Parliament of the United Kingdom which sets out the framework for data protection law in the UK. It updates and replaces the Data Protection Act 1998, and came into effect on 25 May 2018. It sits alongside UK GDPR.
(DPA) Data Processing Agreement
Data Processing Agreement (also known as a controller-to-processor agreement): a written contract between a controller and a processor which sets out the responsibilities and liabilities of both parties, where the controller is using the processor for the purposes of processing personal data. Article 28 of the UK GDPR sets out what needs to be included in the contract.
(DPA) Data Protection Authority
Data Protection Authority: an independent public authorities that supervise, through investigative and corrective powers, the application of the data protection law. There is one in each EU Member State, and the ICO is the UK equivalent.
(DPIA) Data Protection Impact Assessment
Data Protection Impact Assessment: a process designed to help controllers systematically analyse, identify and minimise the data protection risks of a particular project or plan. A.35 UK GDPR states that you must do a DPIA for processing that is likely to result in a high risk to individuals and sets out the circumstances where a DPIA is required.
(DPM) Data Protection Manager
Data Protection Manager: organisations that are not required to appoint a DPO under the UK GDPR may appoint a DPM as the individual with oversight of data protection compliance.
(DPO) Data Protection Officer
Data Protection Officer: an independent expert in data protection who reports to the highest management level within an organisation. UK GDPR introduced a duty for organisations to appoint at DPO where they are a public body or carry out certain processing activities, however, many organisations (that are not required by legislation to appoint a DPO) chose voluntarily to appoint an individual with oversight of DP compliance and may label them a DPO (or sometimes a DPM).
(DSA) Data Sharing Agreement
Data Sharing Agreement: a written agreement between controllers that are sharing and receiving personal data. Unlike a DPA, a DSA is not mandatory under the UK GDPR; it’s considered good practice to provide controllers with clarity about their respective roles, liabilities, and the standards expected.
(DSAR or SAR) Data Subject Access Request
Data Subject Access Request: a request made by or on behalf of an individual for the personal data that they are entitled to under Article 15 of the UK GDPR.
(EDPB) European Data Protection Board
European Data Protection Board: an independent European body, which contributes to the consistent application of data protection rules throughout the European Union and promotes cooperation between the EU's data protection authorities. Their guidelines and recommendations are not binding in themselves, but they reflect the common position and understanding that the DPAs agree to apply consistently.
(FOIA) Freedom of Information Act 2000
Freedom of Information Act 2000: an Act of Parliament of the United Kingdom which provides public access to information held by public authorities.
(GDPR) General Data Protection Regulation
General Data Protection Regulation (2016/679): an EU regulation that came into effect on May 25, 2018, providing a legal framework for keeping everyone’s personal data safe.
(ICO) Information Commissioner’s Office
Information Commissioner’s Office: a non-departmental public body which regulates data protection in the UK.
(IDTA) International Data Transfer Agreement
International Data Transfer Agreement: the UK’s alternative to the SCCs. A non-negotiable set of terms which UK-based organisations can use to safeguard personal data when making restricted transfers (of personal data outside of the UK).
(IG) Information Governance
Information Governance: the framework for handling information in a secure and confidential manner that allows organisations and individuals to manage information legally, securely, efficiently and effectively.
ISO 27001 is not specifically data protection-related, but it is an international standard for managing information security.
(P2C) Processor to Controller
Processor to Controller: usually used in the context of restricted transfers and the SCCs (see below). The EU SCCs module 3 applies to P2C restricted transfers.
(P2P) Processor to Processor
Processor to Processor: usually used in the context of restricted transfers and the SCCs (see below). The EU SCCs module 4 applies to P2C restricted transfers.
(PECR) Privacy and Electronic Communications Regulations
The Privacy and Electronic Communications Regulations 2003: sit alongside the DPA and the UK GDPR. They give people specific privacy rights in relation to electronic communications. They contain specific rules on electronic marketing and cookies.
(PET) Privacy Enhancing
Privacy Enhancing Technologies: technologies that can help organisations share and use people’s data responsibly, lawfully, and securely, including by minimising the amount of data used and by encrypting or anonymising personal information.
(ROPA) Record of Processing Activities
Record of Processing Activities: an organisation’s formal, documented, comprehensive record of the processing activities it carries out based on a data mapping exercise that it regularly reviews.
(SCCs) Standard Contractual
Standard Contractual Clauses: A non-negotiable set of terms which EU-based organisations (and UK-based organisations in conjunction with the ‘UK Addendum’) can rely upon to safeguard the transfer of personal data from the EU/UK to a third country.
(TIA) Transfer Impact Assessment
Transfer Impact Assessment: a risk assessment undertaken by an EU or UK-based organisation that is exporting data to a third country, taking into consideration whether personal data will be adequately protected in that country by the use of the SCCs or whether ‘supplementary measures’ should be implemented.
(TOMs) Technical and Organisational
Technical and Organisational Measures: A key principle of data protection legislation is that organisations process personal data securely by means of 'appropriate’ technical and organisational measures – this is the 'security principle'.
(TRA) Transfer Risk Assessment
Transfer Risk Assessment: The ICO’s equivalent to the TIA can be used in conjunction with approved safeguarding methods, such as the BCRs, SCCs, or the IDTA.
(UK GDPR) UK General Data Protection Regulation
UK GDPR: The UK’s retained equivalent of the EU GDPR came into effect as a consequence of Brexit.
Making sense of your data protection responsibilities
Understanding the language of data protection is a first step in managing your organisation’s legal and regulatory obligations, but it’s often only the start. From reviewing your processing agreements to supporting international data transfers and designing policies such as BYOD or ROPA, the proper legal guidance ensures your business stays protected and compliant.
Our experienced data protection solicitors can support you with clear, commercial advice tailored to your sector, helping you apply these acronyms in practice, not just decode them.
