Glossary of privacy and data protection

Each term has its own page, with the definition, the basis in LGPD and the way it appears in the work of a privacy program.

Terms

• AI Act The European law on artificial intelligence, which classifies systems by risk and also applies to companies outside the EU.
• anonymization The process that causes a piece of data to irreversibly lose the possibility of being associated with a person.
• ANPD The federal authority that oversees the LGPD (Brazilian General Data Protection Law), regulates the law, and applies sanctions.
• Cookie banner – The notice that informs the user about the use of cookies and gathers their choice before activating them.
• Legal base – The hypothesis foreseen in the law that authorizes each processing of personal data.
• Consent – The free, informed, and unequivocal expression by which the data subject agrees to the processing of their data for a specific purpose.
• Controller – The agent who decides on the processing of personal data and is responsible for it before the data subjects and the ANPD (National Data Protection Authority).
• Cookie – The small file that websites save in the browser and which, by identifying the user, becomes personal data.
• Personal data – Information relating to an identified or identifiable natural person, the starting point of the entire LGPD (Brazilian General Data Protection Law).
• Sensitive personal data – The categories of data that can generate discrimination and that the LGPD (Brazilian General Data Protection Law) addresses with more restrictive legal hypotheses.
• Data mapping – Mapping the organization's personal data: where it is, where it comes from, where it goes, and why.
• Automated decision – Decisions made by systems, without human intervention, that affect the interests of the data subject, and the right to review.
• DSAR — Data Subject Access Request: the request by which the data subject exercises their rights over their own data.
• Person in Charge (DPO) – The person designated by the controller to be the channel with the data subjects and with the ANPD (National Data Protection Authority).
• GDPR The European data protection regulation, a reference for the LGPD (Brazilian General Data Protection Law) and applicable to Brazilian companies that serve people in the EU.
• Security incident – An event that compromises the confidentiality, integrity, or availability of personal data, and which may require notification to the ANPD (National Data Protection Authority).
• ISO / IEC 27701 – The international standard for privacy management systems, certifiable and built upon ISO/IEC 27001.
• legitimate interest – The legal basis that allows the processing of data for the legitimate purposes of the controller, provided that the rights of the data subject do not prevail.
• LIA — Legitimate Interest Assessment: the test that substantiates the use of legitimate interest as a legal basis.
• Data minimization – Process only the necessary data, for the necessary time, for the stated purpose.
• Operator – The agent who processes personal data on behalf of the controller, following their instructions.
• PL 2338 / 2023 – The project that proposes the legal framework for artificial intelligence in Brazil, with classification of systems by risk.
• Privacy policy – The public document that explains to the data subject how the organization handles their personal data.
• Privacy by design – Incorporate data protection into the product, process, and system from the very beginning, not afterwards.
• Pseudonymization – The technique that replaces identifiers with codes, keeping the re-identification key separate and protected.
• Algorithmic Impact Report – Assessing the risks of an artificial intelligence system before and during its use.
• RIPD — Personal Data Protection Impact Assessment Report: an analysis of the risks of data processing and the measures to mitigate them.
• ROPA — Record of Processing Activities: an inventory of the organization's personal data processing activities.
• Data subject – The natural person to whom the personal data refers and who exercises the rights provided for in the LGPD (Brazilian General Data Protection Law).
• International data transfer – Sending personal data to another country or international organization is only permitted under the provisions of the LGPD (Brazilian General Data Protection Law).

Where do these terms appear on the platform?

ROPA and RIPD are produced in the module. Data Mapping; applications from data subjects (DSAR) are received and answered in the module Management of Holders' Requests and Privacy PortalThe assessment of legitimate interest (LIA) is recorded alongside the processing activities in Data Mapping. To see these features side-by-side with other market options, read the guide. best tools for LGPD.