GDPR in plain language: a glossary of 20 terms

The General Data Protection Regulation (GDPR) is the European Union's data protection law. This glossary explains twenty of its terms in plain words, with the article where each is defined or set out. It is general information, not legal advice. Definitions follow Article 4 where one exists.

The people and roles

Data subject. The person the data is about.

Controller. The party that decides why and how personal data is processed. Article 4.

Processor. A party that processes personal data on behalf of a controller, such as a software vendor hosting customer data. Article 4.

Recipient and third party. Recipient is anyone the data is disclosed to. A third party is someone other than the data subject, controller, processor and the people authorized to process under their direct authority. Article 4.

Supervisory authority. The independent public body in an EU member state that monitors the law. Article 4.

The data

Personal data. Any information relating to an identified or identifiable person, such as a name, identifier, location or online identifier. Article 4.

Processing. Nearly anything you do with personal data: collecting, storing, using, sharing or deleting. Article 4.

Special categories of data. Data about things like health, ethnic origin, religious belief or biometric data used to identify someone. It has stricter rules. Article 9.

Pseudonymization. Processing data so it cannot be linked to a person without extra information that is kept separately. It reduces risk but the data remains personal data. Article 4.

Personal data breach. A security breach that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data. Article 4.

The rules

Lawful basis. The legal reason you may process data, such as consent or a contract. Article 6.

Consent. A freely given, specific, informed and unambiguous indication of the person's wishes. Article 4.

Purpose limitation and data minimization. Collect for a stated purpose and no more than you need. Article 5.

Storage limitation. Do not keep identifiable data longer than needed. Article 5.

Accountability. The controller must be able to show it complies. Article 5.

The tools and duties

Records of processing. A written record of what processing you do. Article 30.

Data processing agreement. The contract between controller and processor setting out the terms of processing. Article 28.

Security of processing. Appropriate technical and organizational measures for the risk, such as encryption and regular testing. Article 32.

Breach notification. A controller must notify the supervisory authority without undue delay and where feasible within 72 hours after becoming aware of a breach. Article 33.

Data protection impact assessment (DPIA). A structured assessment required where processing is likely to result in high risk to people. Article 35.

How do I use this?

Keep it next to your privacy notice and your questionnaire answers. When a customer uses a term, check which article it comes from before replying, because the same word can mean different things in a contract and in the law.

What to do

1. Share this glossary with sales, support and engineering so everyone uses the terms the same way.
2. Decide whether you are controller or processor for each service you offer.
3. Keep your record of processing and sub-processor list current.
4. Write down your breach response steps and who calls the supervisory authority.
5. Check definitions against the official text for anything contractual.

Quick check

Sources

• GDPR Article 4, Definitions
• GDPR Article 5, Principles
• GDPR Article 6, Lawfulness of processing
• GDPR Article 9, Special categories
• GDPR Article 28, Processor
• GDPR Article 30, Records of processing activities
• GDPR Article 32, Security of processing
• GDPR Article 33, Notification of a personal data breach
• GDPR Article 35, Data protection impact assessment

Last reviewed: 18 October 2026.