Have you ever been on one of those calls or in one of those meetings where full sentences of back-to-back acronyms are flying around, and after a while it’s far too late to interrupt and reveal to the other participants that you haven’t been following?
This can happen in any sector or organisation but perhaps none more so when the focus of the meeting is data protection. I’ve even had one client tell me that they felt like the meeting they were in was being conducted in Klingon!
Fear not, we are here to help! By decoding some of the commonly used acronyms with our helpful ‘Data Protection Acronym Buster’ in plain and intelligible English, you’ll never have to feel like you are in a parallel universe in a (data protection) meeting again.
Contents:
- (BYOD) Bring your own device
- (BCRs) Binding Corporate Rules
- (C2C) Controller to Controller
- (C2P) Controller to Processor
- (CCPA) California Consumer Privacy Act 2018
- (DP) Data Protection
- (DPA) Data Protection
- (DPA) Data Processing Agreement
- (DPA) Data Protection Authority
- (DPIA) Data Protection Impact Assessment
- (DPM) Data Protection Manager
- (DPO) Data Protection Officer
- (DSA) Data Sharing Agreement
- (EDPB) European Data Protection Board
- (FOIA) Freedom of Information Act 2000
- (GDPR) General Data Protection Regulation
- (ICO) Information Commissioner’s Office
- (IDTA) International Data Transfer Agreement
- (IG) Information Governance
- (P2C) Processor to Controller
- (P2P) Processor to Processor
- (PECR) Privacy and Electronic Communications Regulations
- (PET) Privacy Enhancing
- (ROPA) Record of Processing Activities
- (SCCs) Standard Contractual
- (TIA) Transfer Impact Assessment
- (TOMs) Technical and Organisational
- (TRA) Transfer Risk Assessment
- (UK GDPR) UK General Data Protection Regulation
(BYOD) Bring your own device
‘Bring your own device’: the trend of employees and workers using their own personal devices to connect to their organisational networks and access work related systems. Employers who support this technology are advised to have ‘BYOD Policy’ in place, order to meet obligations to implement appropriate organisational and technical measures under data protection legislation.
(BCRs) Binding Corporate Rules
‘Binding Corporate Rules’: data protection rules and policies adhered to by EU or UK based companies to safeguard the transfer of personal data to a third country. The ‘SCCs’ and the ‘IDTA’ are other examples of accepted methods. BCRs are usually relied upon by large multinational corporate groups.
(C2C) Controller to Controller
‘Controller to Controller’: usually a reference to an agreement such as a DSA (see below) or a clause, annex or schedule that relates to the sharing of personal data between two independent data controllers (i.e. two separate controllers that determine the purpose and means of the processing of the personal data). Sometimes used in the context of restricted transfers and the SCCs (see below). The EU SCCs module 1 applies to C2C restricted transfers.
(C2P) Controller to Processor
‘Controller to Processor’: usually a reference to an agreement such as a DPA (see below) or a clause, annex or schedule, that relates to the sharing of personal data between a data controller and a data processor (acting under the instruction of the controller). Sometimes used in the context of restricted transfers and the SCCs (see below). The EU SCCs module 2 applies to C2P restricted transfers.
(CCPA) California Consumer Privacy Act 2018
‘California Consumer Privacy Act 2018’: a statute intended to enhance privacy rights and consumer protection for residents of California, United States.
(DP) Data Protection
‘Data Protection’: the overarching term used to describe the set of strategies, processes and principles relied upon to secure the privacy, availability and integrity of personal data.
(DPA) Data Protection
‘Data Protection Act 1998: an Act of Parliament of the United Kingdom designed to protect personal data. It was superseded by the DPA 2018.
‘Data Protection Act’ 2018: an Act of Parliament of the United Kingdom which sets out the framework for data protection law in the UK. It updates and replaces the Data Protection Act 1998, and came into effect on 25 May 2018. It sits alongside UK GDPR.
(DPA) Data Processing Agreement
‘Data Processing Agreement’: a written contract between a controller and a processor which sets out the responsibilities and liabilities of both parties, where the controller is using the processor for the purposes of processing personal data. A.28 of the UK GDPR sets out what needs to be included in the contract.
(DPA) Data Protection Authority
‘Data Protection Authority’: independent public authorities that supervise, through investigative and corrective powers, the application of the data protection law. There is one in each EU Member State and the ICO is the UK equivalent.
(DPIA) Data Protection Impact Assessment
‘Data Protection Impact Assessment’: a process designed to help controllers systematically analyse, identify and minimise the data protection risks of a particular project or plan. A.35 UK GDPR states that you must do a DPIA for processing that is likely to result in a high risk to individuals and sets out the circumstances where a DPIA is required.
(DPM) Data Protection Manager
‘Data Protection Manager’: organisations that are not necessarily required to appoint a DPO under the UK GDPR, might appoint a DPM as the individual with oversight of DP compliance.
(DPO) Data Protection Officer
‘Data Protection Officer’: an independent expert in data protection, that reports to the highest management level within an organisation. UK GDPR introduced a duty for organisations to appoint at DPO where they are a public body or carry out certain processing activities, however, many organisations (that are not required by legislation to appoint a DPO) chose voluntarily to appoint an individual with oversight of DP compliance and may label them a DPO (or sometimes a DPM).
(DSA) Data Sharing Agreement
‘Data Sharing Agreement’: awritten agreement between controllers that are sharing and receiving personal data. Unlike a DPA, a DSA is not mandatory under UK GDPR, it’s considered good practice to give controllers clarify about their respective roles, liabilities and the standards that are expected.
(DSAR or SAR) Data Subject Access Request
‘Data Subject Access Request’: a request made by or on behalf of an individual for the personal data that they are entitled to under A.15 of the UK GDPR.
(EDPB) European Data Protection Board
‘European Data Protection Board’: an independent European body, which contributes to the consistent application of data protection rules throughout the European Union and promotes cooperation between the EU's data protection authorities. Their guidelines and recommendations are not binding in themselves, but they reflect the common position and understanding which the DPAs agree to apply in a consistent way.
(FOIA) Freedom of Information Act 2000
‘Freedom of Information Act 2000’: an Act of Parliament of the United Kingdom which provides public access to information held by public authorities.
(GDPR) General Data Protection Regulation
‘General Data Protection Regulation’ (2016/679)’: an EU regulation which came into effect on 25th May 2018, which provided a legal framework for keeping everyone’s personal data safe.
(ICO) Information Commissioner’s Office
‘Information Commissioner’s Office’: a non-departmental public body which regulates data protection in the UK.
(IDTA) International Data Transfer Agreement
‘International Data Transfer Agreement’: the UK’s alternative to the SCCs. A non-negotiable set of terms which UK based organisations can use to safeguard personal data when making restricted transfers (of personal data outside of the UK).
(IG) Information Governance
‘Information Governance’: the framework for handling information in a secure and confidential manner that allows organisations and individuals to manage information legally, securely, efficiently and effectively.
ISO 27001 not data protection related, strictly speaking but ISO 27001 is an international standard to manage information security.
(P2C) Processor to Controller
‘Processor to Controller’: usually used in the context of restricted transfers and the SCCs (see below). The EU SCCs module 3 applies to P2C restricted transfers.
(P2P) Processor to Processor
‘Processor to Processor’: usually used in the context of restricted transfers and the SCCs (see below). The EU SCCs module 4 applies to P2C restricted transfers.
(PECR) Privacy and Electronic Communications Regulations
‘The Privacy and Electronic Communications Regulations 2003’: sit alongside the DPA and the UK GDPR. They give people specific privacy rights in relation to electronic communications. They contain specific rules on electronic marketing and cookies.
(PET) Privacy Enhancing
‘Privacy Enhancing Technologies’: technologies that can help organisations share and use people’s data responsibly, lawfully, and securely, including by minimising the amount of data used and by encrypting or anonymising personal information.
(ROPA) Record of Processing Activities
‘Record of Processing Activities’: an organisation’s formal, documented comprehensive record of the processing activities it carries out based on a data mapping exercise that it regularly reviewed.
(SCCs) Standard Contractual
‘Standard Contractual Clauses’: A non-negotiable set of terms which EU based organisations (and UK based organisations in conjunction with the ‘UK Addendum’) can rely upon to safeguard the transfer of personal data from the EU/UK to a third country.
(TIA) Transfer Impact Assessment
‘Transfer Impact Assessment’: a risk assessment undertaken by an EU or UK based organisation that is exporting data to third country, taking into consideration whether personal data will be adequately protected in that country by the use of the SCCs or whether ‘supplementary measures’ should be implemented.
(TOMs) Technical and Organisational
‘Technical and Organisational Measures’: A key principle of data protection legislation is that organisations process personal data securely by means of 'appropriate’ technical and organisational measures – this is the 'security principle'.
(TRA) Transfer Risk Assessment
‘Transfer Risk Assessment’: the ICO’s equivalent to the TIA, can be used in conjunction with the approved safeguarding methods such as the BCRs, SCCs or the IDTA.
(UK GDPR) UK General Data Protection Regulation
The UK’s retained equivalent of the (EU) GDPR, which came into effect as a consequence of Brexit.
