Term Kind Topic What it is
Consent Propagation concept Consent Architecture Ensuring a consent decision reaches and is honoured by every system that processes the data, including those that received it before the decision changed.
Data Minimisation concept Privacy by Design Collecting and retaining only what a stated purpose requires, which reduces both regulatory exposure and breach impact at the same time.
Differential Privacy Budget concept Privacy-Enhancing Technologies The cumulative privacy loss permitted across all queries against a dataset, which must be tracked and exhausted rather than applied per query.
Fourth Party Risk concept Third-Party Risk The dependencies of your dependencies, which you did not choose, may not know about, and remain accountable for.
Geo-Blocking Accuracy concept Geo-Restriction & Sanctions The reliability of determining a user's jurisdiction from network signals, which is imperfect in both directions and therefore needs a designed handling of errors.
Immutable Store Erasure Conflict concept Erasure vs Immutability The direct contradiction between architectures designed never to forget and obligations requiring data to be removed, which must be resolved in the design rather than in policy.
In-Country Processing concept Data Residency Keeping data within a jurisdiction across every path it takes — including backups, logs, telemetry, support access and the disaster recovery region.
Minimum Necessary Access concept Healthcare Data Protection Restricting each user to the health information required for their specific role and, in the strong form, to the patients they are actually treating.
Operational Resilience Requirement concept Financial Services Regulation A supervisory expectation that a firm can continue delivering critical business services through disruption, expressed as an impact tolerance it must evidence.
Operator Independence concept Digital Sovereignty The requirement that no foreign entity can be compelled to access or disclose data, which goes beyond where the bytes are stored to who controls the operator.
Purpose Binding concept Lawful Basis & Purpose Limitation Attaching the reason data was collected to the data itself, so a later use that does not match can be identified rather than assumed permissible.
Re-Identification Risk concept Pseudonymisation The probability that pseudonymised data can be linked back to individuals, which is what keeps such data within the scope of data protection law.
Submission Deadline Architecture concept Regulatory Reporting Pipelines Designing a reporting pipeline around a fixed external deadline, where late is a breach and the recovery window is part of the schedule rather than a contingency.
Transfer Mechanism concept Cross-Border Transfer The specific legal instrument permitting personal data to leave a jurisdiction, which must exist per flow and which architecture must make identifiable.