Core expertise
Further services
Podcast
Datenschutz-Puls: what matters in data protection law, every two weeks.
Focus industries
Further industries
Industries
Your industry is not listed? We advise across all sectors.
About us
Information
Podcast
Datenschutz-Puls: what matters in data protection law, every two weeks.
Glossary A-Z
4 terms
Anonymisation Anonymisation refers to the process of modifying personal data so that the data subject can no longer be identified. According to Recital 26 GDPR, the decisive factor is whether identification is possible using means reasonably likely to be used. Effectively anonymised data no longer falls within the scope of the GDPR. Simply removing names or other direct identifiers is not sufficient to achieve anonymisation. Artificial intelligence and data protection When artificial intelligence is used, the GDPR applies whenever personal data is processed in training, in the input or in the output. Art. 6 GDPR Automated processing Automated processing refers to the processing of personal data by means of technical systems, particularly computers, software or digital applications. This includes, for example, the automatic storage, organisation, analysis or transmission of personal data. The General Data Protection Regulation (GDPR) covers such operations under Article 2(1) and Article 4(2) GDPR. In this context, companies must comply in particular with the principles of data processing, the requirements for lawfulness and data security. 9 terms
Cloud computing Cloud computing refers to the provision of IT services, such as storage space, computing power or software, over a network, particularly the internet. This enables companies to use IT resources flexibly without having to operate the entire technical infrastructure themselves. Where personal data is processed in this context, the requirements of the General Data Protection Regulation (GDPR) must be complied with. Collection of personal data The collection of personal data refers to obtaining information relating to an identified or identifiable natural person. It is a form of processing within the meaning of Article 4(2) of the General Data Protection Regulation (GDPR). Organisations may only collect personal data where an appropriate legal basis exists and the data protection principles are observed. The principles of purpose limitation and data minimisation, as well as the information obligations towards data subjects, are particularly important in this regard. Compensation under the GDPR Under Art. 82 GDPR, any person who has suffered material or non-material damage as a result of an infringement of the GDPR has the right to receive compensation. Art. 82 GDPR Consent Consent is one of the legal bases for the processing of personal data under the General Data Protection Regulation (GDPR). It allows data subjects to decide for themselves whether their personal data may be processed for specific purposes. For consent to be valid, it must be freely given, informed, specific and expressed through an unambiguous affirmative action. The relevant legal provisions are set out in particular in Article 4(11), Article 6(1)(a) and Article 7 GDPR. Consent management Consent management refers to the administration of consent to the processing of personal data. Companies frequently use so-called consent management platforms (CMPs) to obtain, document and manage consent. Consent management is particularly relevant when cookies and tracking technologies are used on websites. The applicable legal requirements arise in particular from the General Data Protection Regulation (GDPR) and Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Controller The controller is the natural or legal person, public authority or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Art. 4(7) GDPR Cookies Cookies are small text files that can be stored on a user’s device when they visit a website. They can be used, for example, to save settings, recognise users during a session or analyse user behaviour. Depending on their purpose, cookies may involve the processing of personal data. Their use is governed in particular by the German Telecommunications Digital Services Data Protection Act (TDDDG) and, where applicable, the General Data Protection Regulation (GDPR). Customer data Customer data is all information about customers that a company processes in the course of the business relationship, and it is personal data insofar as it relates to natural persons. Art. 6(1)(b) GDPR 11 terms
Data breach A data breach is a security incident in which personal data are accidentally or unlawfully disclosed, altered, erased, destroyed or made accessible to unauthorised persons. The General Data Protection Regulation (GDPR) uses the term “personal data breach” for this purpose. Article 4(12) and Articles 33 and 34 GDPR govern the legal classification of such incidents and the obligations arising from them. Data breach notification The obligation to notify personal data breaches requires controllers to report a data breach to the supervisory authority within 72 hours of becoming aware of it. Art. 33 GDPR Data minimisation Data minimisation is a data protection principle that requires personal data to be processed only to the extent necessary for a specified purpose. The term data economy describes the same underlying concept, while the General Data Protection Regulation (GDPR) expressly refers to data minimisation. The legal basis is Article 5(1)(c) GDPR. Data processing agreement (DPA) A data processing agreement (DPA) governs the data protection obligations between a controller and a processor. Under Article 28(3) GDPR, such an agreement or another appropriate legal instrument is required where a service provider processes personal data on behalf of a controller. In particular, the DPA specifies which data is processed for which purposes, which instructions apply and how the protection of personal data is ensured. Data protection Data protection refers to the protection of natural persons with regard to the processing of their personal data. Under Article 1(2) of the General Data Protection Regulation (GDPR), the Regulation protects the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data. The right to informational self-determination, derived from Article 2(1) in conjunction with Article 1(1) of the German Basic Law (Grundgesetz – GG), also provides an important constitutional foundation. Data protection is intended to ensure that personal information is processed only in accordance with the requirements laid down by law. Data protection impact assessment (DPIA) A Data Protection Impact Assessment (DPIA) is a legally required process for assessing and mitigating risks associated with the processing of personal data. Under Article 35 of the General Data Protection Regulation (GDPR), the controller must carry out a DPIA where a planned processing operation is likely to result in a high risk to the rights and freedoms of natural persons. The aim is to identify data protection risks at an early stage and establish appropriate safeguards. Data protection officer (DPO) A Data Protection Officer (DPO) is a qualified individual who advises companies and public authorities on compliance with data protection laws and monitors their implementation. Under certain circumstances, appointing a DPO is mandatory pursuant to Article 37 of the General Data Protection Regulation (GDPR) and Section 38 of the German Federal Data Protection Act (BDSG). The DPO’s responsibilities and independent position are governed in particular by Articles 38 and 39 GDPR. Data security Data security refers to the protection of data against unauthorised access, loss, alteration and destruction. It encompasses technical and organisational measures designed to ensure the confidentiality, integrity and availability of information. Where personal data is processed, the key legal requirements arise in particular from Article 32 of the General Data Protection Regulation (GDPR). Data subject Under Article 4(1) GDPR, a data subject is an identified or identifiable natural person to whom personal data relate. The term therefore refers to the individual whose data are processed and to whom the General Data Protection Regulation (GDPR) grants specific rights. Whether a person qualifies as a data subject does not depend on whether they have consented to the processing or have a contractual relationship with the controller. Deletion concept A deletion concept sets out in a binding manner which personal data is deleted when, how and by whom. Art. 5(1)(e) GDPR 2 terms
Encryption Encryption is the conversion of data by means of a key into a form that can only be read again with the matching key. Art. 32(1)(a) GDPR 4 terms
Informational self-determination The right to informational self-determination protects every individual's authority, in principle, to decide for themselves how their personal data is disclosed and used. It forms part of the general right of personality and is derived from Article 2(1) in conjunction with Article 1(1) of the German Basic Law (Grundgesetz – GG). The Federal Constitutional Court expressly recognised this fundamental right in its Census Act judgment of 15 December 1983. It forms a key constitutional foundation for data protection in Germany. Intra-group privilege (Konzernprivileg) The intra-group privilege refers to a simplified sharing of personal data within a group of undertakings, which the GDPR does not, however, provide for as such. Art. 4(19) GDPR IP address An IP address is a numerical identifier used to address a device in a network such as the internet, and it can be personal data. Art. 4(1) GDPR 2 terms
Legitimate interest / balancing of interests Legitimate interests constitute a legal basis for the processing of personal data under Article 6(1)(f) GDPR. Companies may process personal data on this basis if the processing is necessary for the purposes of the legitimate interests pursued and those interests are not overridden by the interests or fundamental rights and freedoms of the data subjects. Whether these conditions are met must be assessed as part of a balancing test. Where this legal basis applies, consent is generally not required. 11 terms
Physical access control Physical access control prevents unauthorised persons from physically entering premises and facilities in which personal data is processed. Art. 32 GDPR Privacy by default Privacy by default means choosing default settings so that, by default, only the personal data necessary for the specific purpose is processed. Art. 25(2) GDPR Privacy by design Privacy by design means building data protection into the technical and organisational design of systems, products and processes from the outset. Art. 25(1) GDPR Privacy notice A privacy notice informs data subjects about how a company or another controller processes personal data. In particular, it explains the purposes and legal bases of the processing, the retention period and the rights of data subjects. The legal requirements are set out in Articles 12 to 14 of the General Data Protection Regulation (GDPR). The aim is to ensure that data processing is transparent and understandable. Processing of personal data Processing is any operation performed on personal data, from collection through storage and use to erasure. Art. 4(2) GDPR Processing on behalf of a controller Processing on behalf of a controller takes place when a company or another organisation processes personal data on behalf of a controller. The processor generally acts in accordance with the controller’s documented instructions and does not independently determine the purposes of the processing. Under Article 28 GDPR, the parties must govern their relationship by means of a data processing agreement (DPA) or another appropriate legal instrument. Typical examples include external IT service providers and cloud service providers. Prohibition of tying (Koppelungsverbot) The prohibition of tying means that consent is generally not freely given if a contract is made conditional on consent that is not necessary for its performance. Art. 7(4) GDPR Prohibition subject to permission (Verbot mit Erlaubnisvorbehalt) The prohibition subject to permission describes the principle that processing personal data is prohibited unless it is permitted by a legal basis. Art. 6(1) GDPR Pseudonymisation Pseudonymisation is the processing of personal data in such a way that it can no longer be attributed to a specific person without additional information that is kept separately. Art. 4(5) GDPR Purpose limitation Purpose limitation is the principle that personal data may only be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Art. 5(1)(b) GDPR 6 terms
Retention period / storage limitation The principle of storage limitation requires personal data to be kept in a form which permits identification for no longer than is necessary for the purpose of the processing. Art. 5(1)(e) GDPR Right of access The right of access under Article 15 GDPR enables data subjects to find out whether and which personal data concerning them is being processed by a company or public authority. In particular, it covers information about the purposes of processing, the categories of personal data, the recipients and the storage period. In addition, data subjects generally have the right to obtain a copy of the personal data being processed. The right of access serves to ensure transparency and enables data subjects to verify the lawfulness of data processing. Right to erasure / erasure of personal data The right to erasure obliges controllers to erase personal data without undue delay where one of the statutory grounds for erasure applies. Art. 17 GDPR Right to object The right to object allows data subjects to object to processing of their data that is based on legitimate interests or on a task carried out in the public interest. Art. 21(1) GDPR Right to rectification The right to rectification entitles every person to have inaccurate personal data rectified without undue delay and incomplete data completed. Art. 16 GDPR 4 terms
Special categories of personal data Special categories of personal data are particularly sensitive information relating to natural persons, the processing of which is subject to additional data protection requirements. Examples include health data, information about religious beliefs, genetic data and biometric data used for the purpose of uniquely identifying an individual. Article 9(1) GDPR establishes a general prohibition on processing such data. Processing is only permitted where a statutory exception applies and the other data protection requirements are met. Standard contractual clauses (SCCs) Standard contractual clauses are model contracts issued by the European Commission that provide appropriate safeguards for transfers of personal data to third countries. Art. 46(2)(c) GDPR Supervisory authority A supervisory authority monitors compliance with data protection legislation and enforces these requirements against companies and public authorities. Under Article 51 GDPR, European Union Member States must provide for independent data protection supervisory authorities. Their responsibilities include investigating data protection violations, handling complaints and providing guidance on data protection matters. In the event of infringements, they may, in particular, issue orders and impose administrative fines. 4 terms
Third country In data protection law, a third country is a country outside the European Union (EU) and the European Economic Area (EEA). Where personal data is transferred from the European data protection area to recipients in a third country, specific requirements under the General Data Protection Regulation (GDPR) apply. Articles 44 to 49 GDPR govern the conditions under which such data transfers are permitted. Third-country transfer / international data transfer A third-country transfer is the transfer of personal data to a recipient in a state outside the EU and the EEA or to an international organisation. Arts. 44 to 46 GDPR Transmission of personal data Transmission is the disclosure of personal data to a recipient by passing it on or making it available for retrieval. Art. 4(2) GDPR No term found.
Try a different search term. If a term is missing, please get in touch.
We do not use tracking or marketing cookies. Only your choice is stored. External media such as the Apple Podcasts player are loaded only with your consent, in which case your IP address is transmitted to Apple. You can change your choice at any time via "Cookie settings" in the footer.
