Laws, Standards & Compliance terms
48 Laws, Standards & Compliance terms explained in plain English.
- Adequacy decisionAn adequacy decision is the European Commission's formal determination that a country, territory, or sector offers data protection 'essentially equivalent' to the EU's.
- Attestation and CertificationAttestation is a formal written declaration (typically by management or a third-party auditor) that specified controls or requirements have been implemented and are operating effectively.
- Bill C-36 (Protecting Privacy and Consumer Data Act)Bill C-36, the Protecting Privacy and Consumer Data Act, is the federal government's proposed replacement for the privacy rules in PIPEDA, Canada's main private-sector privacy law.
- CASL (Canada's Anti-Spam Legislation)CASL, Canada's Anti-Spam Legislation, controls how businesses send commercial electronic messages like marketing emails and texts.
- CCPA and CPRAThe California Consumer Privacy Act (CCPA), as expanded by the California Privacy Rights Act (CPRA), is the most influential US state privacy law.
- CIS BenchmarksCIS Benchmarks are a set of internationally recognized, consensus-developed configuration guidelines published by the Center for Internet Security for securing operating systems, cloud platforms, browsers, databases, middleware, and applications.
- CIS ControlsThe CIS Controls (formerly CIS Critical Security Controls) are a set of 18 prioritized cybersecurity best practices published by the Center for Internet Security (CIS).
- CMMC (Cybersecurity Maturity Model Certification)CMMC, the Cybersecurity Maturity Model Certification, is the US Department of Defense program that requires defence contractors to meet specific cybersecurity standards, and in many cases prove it through assessments, before winning contracts.
- Compliance AuditA compliance audit is a formal, independent examination of an organization's processes, controls, documentation, and practices to determine whether they meet the requirements of a specific regulation, standard, contract, or internal policy.
- Consent management platform (CMP)A consent management platform (CMP) is the software behind most cookie banners.
- Cyber EssentialsCyber Essentials is a UK government-backed certification scheme designed to help organizations protect against the most common cybersecurity threats.
- Cyber Resilience Act (CRA)The Cyber Resilience Act (CRA) is the EU regulation that makes manufacturers responsible for the cybersecurity of products with digital elements, including smart home devices, apps, and software, throughout their life cycle.
- Data Processing Agreement (DPA)A Data Processing Agreement (DPA) is a legally binding contract between a data controller (the organization that determines the purposes of data processing) and a data processor (an organization that processes data on the controller's behalf).
- Data Protection Impact Assessment (DPIA)A Data Protection Impact Assessment (DPIA) is a formal privacy risk assessment required under Article 35 of the EU General Data Protection Regulation (GDPR) whenever a proposed processing activity is likely to result in a high risk to individuals' rights and freedoms.
- Data protection officer (DPO)A data protection officer (DPO) is the person responsible for overseeing an organization's data protection strategy and compliance, advising staff, monitoring practices, and acting as the contact point for regulators and individuals.
- Data subject access request (DSAR)A data subject access request (DSAR) is a request from an individual asking an organization for a copy of the personal data it holds about them, along with details on how it's used and shared.
- Digital Markets Act (DMA)The Digital Markets Act (DMA) is an EU law that imposes upfront competition rules on the largest digital platforms, called gatekeepers, such as Apple, Google, Meta, Amazon, Microsoft, and ByteDance.
- Digital Services Act (DSA)The Digital Services Act (DSA) is the EU law that sets rules for online intermediaries and platforms, from hosting services to social networks and marketplaces, covering illegal content, ad transparency, and protection of minors.
- DORA (Digital Operational Resilience Act)DORA, the Digital Operational Resilience Act, is an EU regulation that requires banks, insurers, investment firms, payment companies, and other financial entities to withstand, respond to, and recover from technology disruptions.
- DPDP Act (India)India's Digital Personal Data Protection (DPDP) Act is the country's first comprehensive data protection law, covering personal data in digital form and built around consent and the duties of 'data fiduciaries.' While it arrived later than most major economies' laws, its reach is enormous, covering a digital population of hundreds of millions.
- EU Data ActThe EU Data Act is a regulation that gives users of connected products, such as cars, appliances, and industrial machines, the right to access and share the data those products generate.
- EU-US Data Privacy FrameworkThe EU-US Data Privacy Framework (DPF) is the arrangement that allows personal data to flow from the European Union to US companies that certify their compliance with its principles.
- FedRAMPFedRAMP (the Federal Risk and Authorization Management Program) is a US government program that provides a standardized security assessment, authorization, and continuous monitoring process for cloud products and services used by federal agencies.
- FERPAFERPA (the Family Educational Rights and Privacy Act) is a US federal law enacted in 1974 that grants parents the right to access their children's education records, request corrections, and consent before those records are disclosed to third parties.
- GDPRGDPR stands for General Data Protection Regulation.
- Global Privacy Control (GPC)Global Privacy Control (GPC) is a setting in some browsers and extensions that automatically tells every website you visit that you don't want your personal data sold or shared.
- HIPAAHIPAA (the Health Insurance Portability and Accountability Act) is a US federal law passed in 1996 that establishes national standards for protecting individually identifiable health information, known as Protected Health Information (PHI).
- ISO 27001ISO 27001 is an international standard published by the International Organization for Standardization that specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).
- ISO 27701ISO 27701 is an international standard for a Privacy Information Management System (PIMS).
- LGPD (Brazil)The LGPD (Lei Geral de Proteção de Dados) is Brazil's general data protection law, modelled closely on Europe's GDPR.
- NIS2 DirectiveThe NIS2 Directive is the EU's main cybersecurity law for organizations in critical and important sectors, from energy and health care to digital infrastructure, waste management, and manufacturing.
- NIST Cybersecurity FrameworkThe NIST Cybersecurity Framework (NIST CSF) is a set of standards, guidelines, and best practices published by the US National Institute of Standards and Technology to help organizations manage cybersecurity risk.
- PCI DSSPCI DSS (the Payment Card Industry Data Security Standard) is a set of 12 security requirements created by the major card networks (Visa, Mastercard, Amex, Discover) to protect credit and debit card data from theft and fraud.
- PIPA (Alberta and British Columbia)Alberta and British Columbia each have their own Personal Information Protection Act, known as PIPA, which governs how private businesses in those provinces handle personal information.
- PIPEDAPIPEDA (the Personal Information Protection and Electronic Documents Act) is Canada's federal privacy law for the private sector, governing how organizations engaged in commercial activities collect, use, and disclose personal information.
- PIPL (China)China's Personal Information Protection Law (PIPL) governs how organizations collect, use, and transfer personal information of people in China, including companies based abroad.
- Privacy Impact Assessment (PIA)A Privacy Impact Assessment (PIA) is a structured process for identifying, assessing, and mitigating the privacy risks associated with a new or modified system, project, or business process that involves the collection, use, or disclosure of personal information.
- Privacy PolicyA privacy policy is a document that explains what personal information a company collects about you, how they use it, who they share it with, and how they protect it.
- Quebec Law 25Quebec's Law 25 is the province's sweeping modernization of its private-sector privacy law, adding breach reporting, privacy impact assessments, stronger consent rules, data portability, and penalties of up to $25 million or 4% of worldwide turnover.
- Records Retention ScheduleA records retention schedule is a policy document that defines the minimum and maximum periods for retaining different categories of organizational records, based on legal requirements, regulatory obligations, and business needs.
- Right to erasure (right to be forgotten)The right to erasure, often called the right to be forgotten, lets individuals ask organizations to delete their personal data in certain circumstances, such as when it's no longer needed or consent is withdrawn.
- Security frameworks (CIS Controls, Essential Eight)Security frameworks are structured, expert-developed sets of recommended protections that turn 'be more secure' into a concrete, prioritized to-do list.
- SOC 2SOC 2 (System and Organization Controls 2, originally Service Organization Control 2) is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA) to evaluate how service organizations manage customer data against five Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
- SOXSOX (the Sarbanes-Oxley Act) is a US federal law passed in 2002 that imposes strict requirements on public companies regarding financial reporting accuracy, internal controls, and executive accountability.
- Standard contractual clauses (SCCs)Standard contractual clauses (SCCs) are model contract terms, approved by the European Commission, that companies sign to legally transfer personal data from the EU to countries without an adequacy decision.
- Terms and ConditionsTerms and conditions (also called terms of service) are the rules you agree to follow when you use a website, app, or service.
- UK GDPR and the Data (Use and Access) ActUK GDPR is the version of the EU's General Data Protection Regulation that the United Kingdom kept in domestic law after Brexit, alongside the Data Protection Act 2018.
- US state privacy lawsThe United States has no comprehensive federal consumer privacy law, so states have filled the gap.