Privacy, Compliance & Responsible AI

Information relating to an identifiable person

Information that identifies someone directly or can identify them when combined with other information.

Personal data requiring extra protection

Sensitive data categories such as health, biometric identification, beliefs or sexual orientation under UK data protection law.

The organisation deciding why and how personal data is used

The party responsible for determining the purposes and means of personal-data processing.

A party processing personal data for a controller

An organisation that handles personal data on documented instructions from a controller.

A legal justification for processing personal data

One of the recognised grounds that must apply before an organisation processes personal data.

Recording and respecting people's choices

Processes and systems used to collect, prove, update and withdraw valid consent where consent is the lawful basis.

Using only the personal data that is needed

A principle requiring personal data to be adequate, relevant and limited to the stated purpose.

Using personal data only for specified purposes

A principle that data collected for a clear purpose should not be reused incompatibly without justification.

How long information is kept

Rules and processes for keeping data only as long as necessary and disposing of it safely.

A person's right to request deletion in certain cases

A data protection right that can require personal data to be erased when the legal conditions are met.

Subject Access Request

A request by an individual for a copy of their personal data and information about its use.

Data Protection Impact Assessment

A structured assessment used to identify and reduce privacy risks in processing likely to create high risk for people.

Building privacy into design and operation

An approach that considers data protection from the start and throughout the lifecycle of a product or process.

Replacing identifiers while keeping a separate key

Processing that reduces direct identifiability but can still be reversed with additional protected information.

Removing identifiability beyond reasonable reversal

Processing intended to make data no longer relate to an identifiable person; it requires careful assessment of re-identification risk.

Structured documentation about an AI model

A document describing intended uses, limitations, evaluation results and important risk or governance information.

A structured assessment of an AI system's effects

A process for identifying affected people, potential harms, benefits and controls before and during deployment.

Human-in-the-loop

A design in which a person reviews, guides or decides at a defined point in an automated or AI process.