C&L October 2017_LR (5)

Feature
THE DATA PROTECTION LINGO
Data Subject: The individual (natural entity) whose
data is being used by the data controller and data processors.
The data protection regulations are meant
for protecting his/her right
Personal Data: Any information related to a natural
person or ‘Data Subject’, that can be used to directly or
indirectly identify the person
Data Controller: The entity that determines the purposes,
conditions and means of the processing of
personal data
Data Processor: The entity that processes data, on
behalf of the Data Controller by the definition of EU
GDPR but also ‘independently’ by the definition in the
private member bill introduced in the Indian Parliament
Consent: The explicit permission given by the data
subject to the controller to use his/her data for a purpose
other than what it was collected for. Usually, that
can be withdrawn at any time
Data Erasure or Right to be Forgotten: The right of
the data subject to have his/her personal data erased
by requesting the data controller/processor/third parties
associated with them
Data Portability: Obligations on data controllers to
provide the data subject with a copy of his or her data
in a commonly used, machine readable format that
can be transferred to another controller with ease
Data Protection Authority: Regulators for ensuring
data and privacy protection; the body may even be
involved in making recommendations to make amendments
to the data protection legislation
Data Protection Officer: The executive within a data
controller or processor accountable for ensuring data
privacy and the data protection regulations are complied
with
Privacy by Design: A principle that calls for the inclusion
of data protection from the onset of the designing
of systems, rather than a later addition
Pseudonymisation: The processing of personal data
in such a manner that the personal data can no longer
be attributed to a specific data subject without the
use of additional information, provided that such additional
information is kept separately and is subject to
technical and organizational measures to ensure that
the personal data are not attributed to an identified or
identifiable natural person
Right to be Forgotten: Also known as Data Erasure,
it entitles the data subject to have the data controller
erase his/her personal data, cease further dissemination
of the data, and potentially have third parties
cease processing of the data
Right to Access: The right of the data subject to
have access to and information about his/her personal
data
6 CIO&LEADER | October 2017