AI governance and privacy glossary

Breach notification is the duty to inform the supervisory authority of a personal data breach, within 72 hours under the GDPR and three working days under the LGPD.

An organizational policy stating which AI tools staff may use, for which purposes, with which data, and under which review and disclosure rules.

An adequacy decision is a formal finding by an authority that another country ensures an adequate level of data protection, allowing transfers there without further safeguards.

AI assurance is the process of measuring, evaluating and communicating evidence about whether an AI system or its governance is trustworthy and meets agreed criteria.

A cross-functional body that reviews significant or contested AI uses, advises decision-makers and escalates ethical concerns within an organization's governance structure.

The system of roles, policies, processes and controls through which an organization directs, oversees and is held accountable for how it develops, buys and uses AI.

An assessment of the foreseeable effects of an AI system on individuals, groups and society, documented before deployment and revisited when the system or its use changes.

An event in which the development, use or malfunction of an AI system directly or indirectly causes or nearly causes harm to people, property, the environment or rights.

A maintained register of the AI systems and models an organization develops, buys or uses, with owner, purpose, data, risk level and status for each.

The skills, knowledge and understanding that let providers, deployers and affected persons use AI systems in an informed way and recognize their opportunities, risks and possible harms.

The set of interrelated policies, objectives, processes and controls an organization uses to govern the responsible development, provision or use of AI systems, as defined in ISO/IEC 42001.

A structured process to identify, analyse and evaluate the risks an AI system poses to people, organizations and society, so they can be treated and monitored.

Systematic errors in an AI system's outputs that produce unjustified differences in treatment or outcomes for certain individuals or groups.

Anonymization is the irreversible processing of data so that no individual can be identified by any means reasonably likely to be used, taking the data outside data protection law.

The ANPD (Autoridade Nacional de Proteção de Dados) is Brazil's data protection authority, responsible for regulating, guiding and enforcing compliance with the LGPD.

Audit evidence is verifiable information relevant to audit criteria; a nonconformity is the non-fulfilment of a requirement, identified by comparing that evidence with the criteria.

Decisions about individuals taken solely by automated means, without meaningful human involvement, which may produce legal or similarly significant effects and trigger specific safeguards.

The CCPA, as amended by the CPRA, is California's consumer privacy law granting residents rights over personal information held by covered businesses.

The marking by which a provider indicates that a high-risk AI system conforms to the EU AI Act and other applicable EU harmonization legislation.

The process of demonstrating whether specified requirements for a product, system or process have been fulfilled; under the EU AI Act, the check a high-risk system passes before market entry.

A freely given, specific, informed and unambiguous indication of the data subject's wishes, by a statement or clear affirmative action, agreeing to the processing of their personal data.

The natural or legal person, public authority or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.

The principle that personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.

A data processing agreement is the binding contract in which a controller instructs a processor and sets the mandatory terms for processing personal data on its behalf.

A documented assessment of processing likely to result in high risk to individuals, describing the processing, its necessity and proportionality, the risks and the measures to address them.

The person designated by a controller or processor to advise on, monitor and support compliance with data protection law and to act as contact point for individuals and authorities.

Documented information about where data came from, how it was collected and under what terms, and every transformation it went through before use.

A request by an individual to a controller to exercise a data protection right, most often access to a copy of their personal data and details of its processing.

The rights individuals hold over their personal data, including information, access, rectification, erasure, restriction, portability, objection and safeguards against solely automated decisions.

A standard document that records a dataset's motivation, composition, collection process, preprocessing, intended uses, distribution and maintenance.

AI-generated or manipulated image, audio or video that resembles real people, objects, places or events and would falsely appear authentic.

Under the EU AI Act, a person or body that uses an AI system under its authority, except for purely personal, non-professional activity.

Regulation (EU) 2024/1689, the European Union law that sets harmonized, risk-based rules for placing on the market, putting into service and using AI systems and general-purpose AI models.

The ability to give people meaningful, accurate reasons for an AI system's output, suited to their role and to the decision being made.

Quantitative measures that compare an AI system's outcomes or error rates across groups to detect and track unjustified disparities.

A large AI model trained on broad data at scale, usually with self-supervision, that can be adapted to a wide range of downstream tasks.

An assessment that certain deployers of high-risk AI systems must perform before first use, identifying the specific risks of harm to the fundamental rights of affected people.

The GDPR (Regulation (EU) 2016/679) is the European Union law that governs the processing of personal data and the free movement of such data.

An AI model, typically trained on large data at scale, that displays significant generality, performs a wide range of distinct tasks and can be integrated into many downstream systems.

Output from a generative AI model that is fluent and confident but false, unsupported or fabricated, such as invented facts, citations or quotes.

Under the EU AI Act, an AI system that is a safety component of a regulated product or used in a sensitive Annex III area, subject to strict requirements.

Measures that let competent people monitor an AI system, understand its limits, and intervene in, override or stop its outputs when needed.

An international data transfer is making personal data available to a recipient in another country, permitted only through a recognised mechanism such as an adequacy decision or appropriate safeguards.

International guidance on how organizations that develop, deploy or use AI can manage AI-specific risk, adapting the ISO 31000 risk management principles and process.

ISO/IEC 27701 is the international standard for a privacy information management system, specifying requirements and controls for PII controllers and processors.

The international standard that specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within an organization.

The legal ground, chosen from a closed list in data protection law, that makes a specific processing of personal data permissible, such as consent, contract, legal obligation or legitimate interest.

A lawful basis allowing processing necessary for the legitimate interests of the controller or a third party, unless overridden by the data subject's interests, rights and freedoms.

The LGPD (Law No. 13,709/2018) is Brazil's General Data Protection Law, governing the processing of personal data by public and private organisations, online and offline.

A short structured document that reports a trained model's intended use, performance across relevant groups, limitations, training data and ethical considerations.

The degradation of an AI model's performance over time because the data or relationships it meets in production differ from those it was trained on.

The NIST AI Risk Management Framework, a voluntary US framework that organizes AI risk management into four functions: Govern, Map, Measure and Manage.

The first intergovernmental standard on AI, adopted by the OECD Council, setting five values-based principles for trustworthy AI and five recommendations for national policies.

Any information relating to an identified or identifiable natural person, directly or indirectly, such as a name, an identification number, location data or an online identifier.

A personal data breach is a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

The obligation to embed data protection principles and safeguards into systems and processes from the design stage, and to process by default only the data necessary for each purpose.

Privacy-enhancing technologies are technical methods that let organisations use, share or analyse data while reducing the exposure of personal information.

A natural or legal person, public authority or other body that processes personal data on behalf of the controller and according to its instructions.

Any automated processing of personal data to evaluate personal aspects of an individual, in particular to analyse or predict performance, finances, health, preferences, behaviour, location or movements.

AI uses banned outright by Article 5 of the EU AI Act because their risk to fundamental rights and safety is considered unacceptable, regardless of safeguards.

An attack that hides instructions in user input or in content an AI model reads, causing it to ignore its intended rules and act for the attacker.

Under the EU AI Act, whoever develops an AI system or GPAI model, or has one developed, and offers it under its own name or trademark.

Pseudonymization is processing personal data so they can no longer be attributed to a specific person without additional information kept separately under technical and organisational safeguards.

The principle that personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.

The documented inventory a controller or processor keeps of its processing operations, including purposes, data categories, recipients, transfers, retention periods and security measures.

Structured adversarial testing in which a team deliberately tries to make an AI system fail, misbehave or cause harm, to find weaknesses before others do.

An approach to designing, developing and using AI so that it is lawful, safe, fair, transparent, accountable and respectful of human rights throughout its lifecycle.

The right of individuals to obtain deletion of their personal data without undue delay when a legal ground applies, such as data no longer needed or consent withdrawn.

Use of AI tools, models or features by employees or teams without the knowledge, approval or controls of the organization's governance functions.

Personal data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health, sex life or sexual orientation, subject to stricter rules.

Standard contractual clauses are model data protection terms adopted by an authority that, signed unchanged, provide appropriate safeguards for transferring personal data to another country.

The principle that personal data must be kept in identifiable form for no longer than necessary for the purposes for which it is processed.

Artificially generated data that reproduces statistical properties of a real dataset without directly copying its records, used for training, testing or sharing.

A governance model from The IIA that separates management's risk ownership, specialist risk and compliance oversight, and independent internal audit assurance.

Legal duties to inform people when they interact with AI, when content is AI-generated or manipulated, and how their personal data is processed.