B
BINDING CORPORATE RULES
The set of internal rules adopted by multinational companies in to define their global policies on international data transfers within the same corporate group towards countries that don't share the same level of protection.
BIOMETRIC DATA
Personal data that resulted from specific processing related to physical and behavioural features of a person, which allows the identification of that person.
C
Consent
The informed, unambiguous and freely given permission from the data subject to have data relating to him or her processed.
Controller
The natural or legal person, public authority or other body which establishes the purpose and method of data processing, alone of together with other actors.
Cross Border Processing
Processing of personal data when the controller or processor is established in more than one Member State, and the data processing takes place in more than one Member State, OR processing activities that take place in a single establishment in the Union, but that affects data subjects from more than one Member State.
D
Data Concerning Health
Personal data referring to the personal mental and physical health of a person, including information on health services accessed.
E
Enterprise
Natural or legal person who performs an economic activity, regardless of the legal form, including associations and partnerships.
G
Genetic Data
Data related to a natural person's genetic characteristics, whether inherent or acquired, which offers information about the mental or physica health of that person.
Group Of Undertakings
Is formed by the controlling undertaking and the subsequent controlled undertakings.
I
Information Society Service
A service as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535 of the European Parliament and of the Council (19).
International Organisation
An organisation and its subordinate bodies regulated by the public international law, or a body established based on an agreement between at least two countries.
M
Main Establishment
For controllers with establishments in more than one Member State, it is the central administration place in the Union, unless the processing decisions are taken in another establishment which in this case will be considered the main establishment. For processors with establishments in more than one Member State, it is the central administration place in the Union, unless the processor doesn't have a central administration, in which case the main establishment will be the place where the main processing activities are performed.
P
Personal Data
Any information related to an identified or identifiable data subject (natural person).
Processor
The natural or legal person, public authority or other body which processes data on behalf of the controller.
Personal Data Breach
A breach of security that caused accidental or intentional loss, destruction, disclosure or access to processed or transmitted personal data.
Profiling
Any automated processing that uses personal data to evaluate personal aspects and predict future actions and aspects.
Processing
Any action or set of actions that is performed on personal data or sets of data, whether automated or not.
Pseudonymising
Personal data processing so that the data can no longer attributed to a specific data subject
R
Recipient
The natural or legal person, public authority or other body which is disclosed the personal data.
Restriction Of Processing
Marking of stored personal data in order to restrict its processing in the future.
Relevant And Reasoned Objection
An objection regarding whether there exists an infringement of the Regulation or not, or whether the agreed action in relation to the controller or processor is in conformity with the Regulation.
Representative
A natural or legal person established in the EU, appointed by the data processor or controller to represent him with respect to the obligations under the regulation.
S
Supervisory Authority
An independent public authority established by a EU Member State in accordance to Article 51.
T
Third party
A natural or legal person that is not the controller or the processor, but who is authorized by them to process personal data.