--- title: GDPR - Key Terms Explained description: Author has explained the key terms in General Data Protection Regulation. image: https://blog.e-zest.com/hubfs/GDPR.png --- [![e-Zest logo\_An accion lab company\_Colour](https://blog.e-zest.com/hubfs/images/Logos%20with%20Tagline/Corporate/SVG/e-Zest%20logo_An%20accion%20lab%20company_Colour.svg "e-Zest logo_An accion lab company_Colour")](https://www.e-zest.com/) - [WORK](https://www.e-zest.com/our-work) - [SERVICES](https://www.e-zest.com/our-services) - [Product Engineering](https://www.e-zest.com/digital-product-engineering-services) - [Enterprise Data Services](https://www.e-zest.com/enterprise-data-services) - [Digital Commerce](https://www.e-zest.com/digital-commerce-services) - [Digital Operations](https://www.e-zest.com/digital-operations) - [Digital Consulting](https://www.e-zest.com/digital-transformation-consulting-services) - [Digital Experience Design](https://www.e-zest.com/digital-experience-design) - [INSIGHTS](https://blog.e-zest.com/) - [CAREERS](https://www.e-zest.com/careers) - [ENTERPRISE DATA SERVICES](https://www.e-zest.com/enterprise-data-services) - [GENERATIVE AI](https://www.e-zest.com/generative-ai) - [Healthcare](https://healthcare.e-zest.com) - [Contact Us](https://www.e-zest.com/contact-us) - ![Elevating Product Engineering with AI and ML](https://blog.e-zest.com/hubfs/Elevating%20Product%20Engineering%20with%20AI%20and%20ML.jpg) [BLOGS](https://blog.e-zest.com) #### Elevating Product Engineering with AI and ML As technology evolves and customer choices broaden, there is an increasing ... [Read more](https://blog.e-zest.com/elevating-product-engineering-with-ai-and-ml) - ![e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024](https://blog.e-zest.com/hubfs/e-Zest%20%E2%80%93%20An%20Accion%20Labs%20Company%20-%20Gets%20Recognition%20as%20a%20Contender%20in%20the%20ISG%20Provider%20LensTM%20Study%20on%20Digital%20Engineering%20Services%202024.jpg) [NEWS](https://blog.e-zest.com/news) #### e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024 We are delighted to announce that e-Zest – An Accion Labs Company has been ... [Read more](https://blog.e-zest.com/news/e-zest-an-accion-labs-company-gets-recognition-as-a-contender-in-the-isg-provider-lens-study-on-digital-engineering-services-2024) - ![e-Zest Solutions supports Digital Pune Mission](https://blog.e-zest.com/hubfs/blog-files/Digital%20Literacy%20Bus%20e-Zest.png) [CSR](https://blog.e-zest.com/csr) #### e-Zest Solutions supports Digital Pune Mission **Pune, India:** e-Zest Solutions, a leading digital technology innovation ... [Read more](https://blog.e-zest.com/csr/e-zest-solutions-supports-digital-pune-mission) - [Work](https://www.e-zest.com/our-work) - [Services](https://www.e-zest.com/our-services) - [Insights](https://blog.e-zest.com) - [Careers](https://www.e-zest.com/careers) - [Enterprise Data](https://www.e-zest.com/enterprise-data-services) - [Generative AI](https://www.e-zest.com/generative-ai) - [Innovations](https://www.e-zest.com/innovations) - [Healthcare](https://healthcare.e-zest.com) - [About](https://www.e-zest.com/about-us) - [Contact](https://www.e-zest.com/contact-us) - [Blog](https://blog.e-zest.com/) - [News](https://blog.e-zest.com/news) - [CSR](https://blog.e-zest.com/csr) - [![Linkedin Icon](https://blog.e-zest.com/hubfs/icons/linkedin_icon_white.svg)](https://www.linkedin.com/company/e-zest-solutions/) - [![Twitter Icon](https://blog.e-zest.com/hubfs/twitter-logo-silhouette%20(5).svg)](https://twitter.com/ezest) - [![Facebook Icon](https://blog.e-zest.com/hubfs/facebook-app-logo%20(4).svg)](https://www.facebook.com/61259256638) - [![Instagram Icon](https://blog.e-zest.com/hubfs/instagram-logo%20(4).svg)](https://www.instagram.com/ezestsolutions/) - [![Youtube Icon](https://blog.e-zest.com/hubfs/icons/youtube_icon_white.svg)](https://www.youtube.com/user/ezestcorporate) [![Go to top icon](https://blog.e-zest.com/hubfs/AA%20Assets/top%20button.svg)](https://blog.e-zest.com/gdpr-key-terms-explained#top) Hit enter to search or ESC to close Insights e-Zest members share technology ideas to foster digital transformation. - [Blog](https://blog.e-zest.com) - [Whitepaper](https://blog.e-zest.com/whitepaper) - [Playbook](https://blog.e-zest.com/playbook) - [News](https://blog.e-zest.com/news) - [Innovation](https://blog.e-zest.com/innovation) - [Media Kit](https://www.e-zest.com/media-kit) # GDPR - Key Terms Explained [Rajendra Babtiwale](https://blog.e-zest.com/author/rajendra-babtiwale) Mar 21, 2018 [GDPR](https://blog.e-zest.com/topic/gdpr) [europe](https://blog.e-zest.com/topic/europe) [General Data Protection Regulation](https://blog.e-zest.com/topic/general-data-protection-regulation) [data subject](https://blog.e-zest.com/topic/data-subject) - - - - In previous [blogs](https://blog.e-zest.com/gdpr-impact-of-europe-new-privacy-policy), we talked about few key requirements of the GDPR. We explored the terms [GDPR](https://blog.e-zest.com/data-protection-in-the-eu-understanding-gdpr), controller, processor, personal data, legitimate interests, consent, and [privacy rights](https://blog.e-zest.com/data-protection-in-the-eu-understanding-gdpr). I personally got confused and amused by a term ‘Data Subject’ used in the regulation. Data Subject is an EU resident whose personal information is being collected or processed. I personally did not like this term as it is very impersonal. It is expected by the regulation that the language used in the ‘privacy notice’, ‘consent forms’ and many other instruments for communicating with the EU citizens should be very simple and easy to understand. I felt the language used by the regulation should have been simple and easy to understand for the people for whom it is meant and for the organizations which plan to comply. After all regulatory laws are meant to be like that. So, Data Subject is an entity, which is a living person in EU. Naturally on first thought, we need to identify who we are and what are our activities. Does the GDPR apply to us? To ascertain this we need to prepare a list of processing activities we perform in our organization. Complete an inventory of functions and projects dealing with the personal information and also take a note of the type of processing we engage in. This could be done using an Excel spreadsheet to record list of processing activities in Marketing, Sales, HR, Projects/Delivery. Once this list is generated, start looking for a lawful base to process the data and record them. These reasons have been identified in my previous blogs. It will be useful if you identify and record responsibility for collecting/processing the data, label the category of data and identify storage locations of this data in the same inventory list. There is a possibility of this data being transferred to internal functions or to an outside vendor for further processing. Recording it will therefore help. Location where data is getting processed must be recorded. If it is outside EU, data protection clauses must be agreed, contracted and adhered to. Special care must be taken for sensitive personal information like medical records, insurance policies, etc. Also it is important to add retention period for the data that is being collected and processed. Justification for extending this retention duration must be backed by statutory and regulatory requirements. It will be highly desirable to record, how this data will be disposed of once retention period is over. Additional columns mentioning links to various policies and security controls, in the same list, will reduce your time to search for appropriate documentation in your organization. Expect several abbreviations to be thrown around as you prepare to review the regulation. I would like to unveil some of them for you here. **Data Protection Officer (DPO)** - Though regulation says, there is no need of a DPO for an organization having less than 150 employees, it depends on how much and what kind of personal information you deal with. The DPO is a central authority and point of contact for all GDPR related matters. ‘Data Subjects’ can access DPO for all their queries and Data Protection Authority (DPA) will get in touch with DPO, in case of complaints related to data breach and violation of GDPR. **Data Protection Authority (DPA)** - These are country specific public authorities ensuring application of data protection regulations. They are experts and provide advice on issues of data protection. In EU they handle GDPR and country specific law violation complaints. I searched for DPA in India and could not find anyone appointed as of yet. **Data Subject Access Request (DSAR)** - Individuals or their legal representatives can make a request to the organization, which is controlling and/or processing their personal data. As the name suggests this request is for accessing their data to ensure it is processed as per the privacy policy declared and consent provided. These requests can come through various channels including via email, letter, corporate website, fax etc. In Germany even verbal requests are considered. These requests can be for modifications, deletion, porting data to different organization, verification of processing etc. This request must be fulfilled within 30 calendar days. Organizations can charge reasonable fee if addressing these requests require sizable efforts or if the requestor is repeatedly submitting those requests or for requests that are beyond the scope of GDPR or the organization. Organizations can decline this request in case a law prevents disclosure of the information. DPO is responsible to analyze all these requests and take necessary actions. **Data Protection Impact Assessment (DPIA)** - Functions handling personal information must perform this activity with the help of DPO. I think asset management classification done on the basis of ‘CIA’ (Confidentiality, Integrity and Availability) for ISO 27001 will be helpful over here. Treat privacy information as an asset and not liability; classify it, and identify vulnerabilities and threats in the system responsible for data breach. Those are the risks, which need to be addressed. Take mitigation actions by placing appropriate controls. DPIA will help organizations take preventive steps rather than doing firefighting at the end of data breach. Our planning will convince DPA that our organization has the intent to protect the privacy information. Capturing learnings from incidences and updating the risk register on an ongoing basis will help meet GDPR requirements. Do it for all functions and processes once you build the inventory list of processing activities. Do it again if there is any change in the privacy information. Do it again when risks are updated based on learning from incidence closures. Revisit for review at regular frequencies. This discipline needs to be inculcated in the organization’s culture. **Privacy by Design** - It is said prevention is better than cure. If setting up the right kind of policies incorporates privacy in the organizational DNA and procedures and people are trained and retrained on them, then chances of mistakes reduce to great extent. If your organization handles errors at the early stage a great deal of the firefighting gets reduced. As an example, do not start defining a template for notification of data breach to DPA and Data subjects after the breach has happened. If those templates are ready you can focus on correction and corrective actions. In my opinion that is ‘Privacy by Design’. **Data Breach** - All of us are aware of this term, which refers to the intentional or unintentional disclosure of personal data. Placing appropriate controls and training people will help prevent the breach. However, when it happens, your ability to respond and contain it, and take long-term actions to prevent it in future, will drive systems to perfection. In case of GDPR notifications to data subjects and DPA, based on severity of breach is a must. If analysis says that the data breach is not going to affect lives of data subjects, then internal recording will suffice. If data breach is to be notified, remember you have SLA of 72 hours from the time it was brought to your notice. Hope I have covered most of the key terms. I want to start explaining few scenarios that could happen to an organization in the context of GDPR in my next post. - - - ### Similar Blog [![Is your e-Commerce compliant with PCI DSS revisions?](https://blog.e-zest.com/hubfs/Is%20your%20e-Commerce%20compliant%20with%20PCI%20DSS%20revisions.png) Is your e-Commerce compliant with PCI DSS revisions? e-Commerce has always been a target for swift cyber theft. You may not even realize that your technology has been compromised by ... By Mariam Abuhaideri Jun 14, 2018](https://blog.e-zest.com/is-your-e-commerce-compliant-with-pci-dss-revisions) [![Applying GDPR to Marketing and Sales units](https://blog.e-zest.com/hubfs/Applying%20GDPR%20to%20Marketing%20and%20Sales%20units.png) Applying GDPR to Marketing and Sales units I am aware of the delay in delivering this blog, however it is for a good reason. Before I start explaining the second scenario ... By Rajendra Babtiwale Apr 20, 2018](https://blog.e-zest.com/applying-gdpr-to-marketing-and-sales-units) [![Role of HR functions in implementing GDPR](https://blog.e-zest.com/hubfs/Role%20of%20HR%20function%20in%20implementing%20GDPR.png) Role of HR functions in implementing GDPR EU will finally introduce GDPR in the month of May 2018. The main purpose of GDPR is to further synchronize higher level of ... By Sakshi Koul Mar 30, 2018](https://blog.e-zest.com/role-of-hr-functions-in-implementing-gdpr) [![Application of GDPR in HR and Talent Acquisition processes](https://blog.e-zest.com/hubfs/Application%20of%20GDPR%20in%20HR%20nad%20TA%20Processes.png) Application of GDPR in HR and Talent Acquisition processes Since we have explored the depths of GDPR in my previous blogs, we are now equipped with the required knowledge, which would ... By Rajendra Babtiwale Mar 28, 2018](https://blog.e-zest.com/application-of-gdpr-in-hr-and-talent-acquisition-processes) [![Brace your organization for GDPR compliance](https://blog.e-zest.com/hubfs/Brace%20your%20organization%20for%20GDPR%20compliance.jpg) Brace your organization for GDPR compliance The moment May 2018 dawns, your organization will have no room for excuses. GDPR can hit your organization like a Tsunami if your ... By Mandar Thosar Mar 27, 2018](https://blog.e-zest.com/brace-your-organization-for-gdpr-compliance) [![Further Drill Down on CMMI Explained - Part 1](https://blog.e-zest.com/hubfs/WhatsApp%20Image%202022-03-07%20at%206.30.52%20PM.jpeg)](https://blog.e-zest.com/further-drill-down-on-cmmi-explained-part-1) [Further Drill Down on CMMI Explained - Part 1](https://blog.e-zest.com/further-drill-down-on-cmmi-explained-part-1) [In my previous blogs on CMMI I had talked about CMMI structure, and categories like](https://blog.e-zest.com/further-drill-down-on-cmmi-explained-part-1)[Doing](https://blog.e-zest.com/cmmi-v2.0-categories-explained), [Managing](https://blog.e-zest.com/cmmi-v2.0-explained-category-managing), [Enabling](https://blog.e-zest.com/cmmi-v2.0-explained-category-enabling), and [Improving](https://blog.e-zest.com/cmmi-v2.0-explained-category-improving). In ... By Rajendra Babtiwale Mar 08, 2022 [![CMMI V2.0 Explained - Category 'Improving'](https://blog.e-zest.com/hubfs/CMMI-Category-Improving.jpg) CMMI V2.0 Explained - Category 'Improving' The last category of CMMI V 2.0 does not actually need any explanation, however I thought of expressing my thoughts as it is very ... By Rajendra Babtiwale Oct 05, 2021](https://blog.e-zest.com/cmmi-v2.0-explained-category-improving) [![CMMI V2.0 Explained - Category 'Enabling'](https://blog.e-zest.com/hubfs/CMMI%202.0%20explained%20%E2%80%93%20Category%20-%20Enabling%20blog.jpg)](https://blog.e-zest.com/cmmi-v2.0-explained-category-enabling) [CMMI V2.0 Explained - Category 'Enabling'](https://blog.e-zest.com/cmmi-v2.0-explained-category-enabling) [This is my fourth blog in the series on the CMMI 2.0 model. My first blog talked about the](https://blog.e-zest.com/cmmi-v2.0-explained-category-enabling)[structure of CMMI 2.0](https://blog.e-zest.com/cmmi-v2.0-explained), explaining in ... By Rajendra Babtiwale May 11, 2021 [![CMMI V2.0 Explained - Category 'Managing'](https://blog.e-zest.com/hubfs/blog%20CMMI%20V2.0%20Explained%20-%20Category%20Managing.jpg)](https://blog.e-zest.com/cmmi-v2.0-explained-category-managing) [CMMI V2.0 Explained - Category 'Managing'](https://blog.e-zest.com/cmmi-v2.0-explained-category-managing) [In my](https://blog.e-zest.com/cmmi-v2.0-explained-category-managing)[previous blog](https://blog.e-zest.com/cmmi-v2.0-categories-explained), I tried to explain how ‘Doing’ Category is broken down into four Capability Areas. Actually, I am in a ... By Rajendra Babtiwale Feb 01, 2021 [![CMMI V2.0 Categories Explained](https://blog.e-zest.com/hubfs/CMMI%20V2.0%20Categories%20Blog.jpg)](https://blog.e-zest.com/cmmi-v2.0-categories-explained) [CMMI V2.0 Categories Explained](https://blog.e-zest.com/cmmi-v2.0-categories-explained) [In my](https://blog.e-zest.com/cmmi-v2.0-categories-explained)[previous blog,](https://blog.e-zest.com/cmmi-v2.0-explained)we explored four capability categories on which CMMI V 2.0 is built. There is very logical thinking for ... By Rajendra Babtiwale Jan 11, 2021 ## Helping Organizations Thrive in the Digital Age [Contact Us](https://www.e-zest.com/contact-us) - [About](https://www.e-zest.com/about-us) - [Services](https://www.e-zest.com/our-services) - [Work](https://www.e-zest.com/our-work) - [Insights](https://blog.e-zest.com/) - [Healthcare](https://healthcare.e-zest.com/) - [Accion Labs](https://www.accionlabs.com/) - - - - - - Dallas - Detroit - Hannover - Vienna - London - Pune © 2025 e-Zest Solutions - [Privacy Policy](https://www.e-zest.com/privacypolicy) - [Cookie Policy](https://www.e-zest.com/cookie-policy) Contact us Contact us e-Zest is a leading digital innovation partner for enterprises and technology companies that utilizes emerging technologies for creating engaging customers experiences. Being a customer-focused and technology-driven company, it always helps clients in crafting holistic business value for their software development efforts. It offers software development and consulting services for cloud computing, enterprise mobility, big data and analytics, user experience and digital commerce.