With an ever-growing list of acronyms, the world of data privacy can feel a little like alphabet soup whether you’re a newcomer or a privacy pro. Data privacy is a complex field, but the vocab does not need to be overwhelming. To bring genuine data privacy to more businesses and users, we believe that a little education goes a long way.
We curate this running Acronym Resource where you can find all data privacy abbreviations from A – Z in a single, central location. Bookmark this page for handy reference — we regularly update the list with new terms and link more resources. Check out our Latest Updates section if you just need a quick refresher on any new terms from the past couple of weeks.
Table of Contents
- September 10, 2021: We moved PIPL from the “Pending Legislation” section to the “Laws” section. We added ECPA and FCRA to the “Laws” section. We added CAC to the “Organizations and Roles” section. We added ADM, SADM, GPC, QR, and VPN to the “Concepts and Tools” section.
- July 2, 2021: We added PIPA to the “Laws” section. We added DMA to the “Pending Legislation” section. We added FHE, FIPPs, and PHE to the “Concepts and Tools” section. We updated POPI(A) in the “Laws” section as well as PIPL in the “Pending Legislation” section.
- June 14, 2021: We added IDFA, MPC, and PRA to the “Concepts and Tools” section.
- May 21, 2021: We added FISA to the “Laws” section. We added E2E(E), IoT, and UA to the “Concepts and Tools” section.
- April 30, 2021: We added CARU, DPC, FTC, ICO and NIST to the “Organizations and Roles” section. We added ATT and FLoC to the “Concepts and Tools” section.
- April 9, 2021: We added ePR to the “Pending Legislation” section. We added IAPP to the “Organizations and Roles” section. We added BCR to the “Activities” section.
- March 19, 2021: We added CPPA, FPIC, and OPC to the “Organizations and Roles” section.
These measures are either in effect, or already passed and approaching the start of their enforcement period.
Biometric Information Privacy Act
State privacy law in Illinois governing how businesses can handle users’ biometric information, effective since 2008.
State privacy law in California, effective since 2020 and to be followed by the CPRA in 2023.
Consumer Data Protection Act
State privacy law in Virginia, going into effect in 2023.
Children’s Online Privacy Protection Act
Federal rule in the United States that regulates how online services can handle the personal information of children under 13 years of age.
California Privacy Rights Act
Upcoming state privacy law in California to replace the CCPA in 2023.
Data Protection Act
Federal privacy act in the United Kingdom, effective since 2018.
Electronic Communications Privacy Act
Federal law in the US, effective since 1986, that extends previous legislation against phone wiretapping to protect the contents of computer communications while they are being made, in transit, and stored on computers.
Fair Credit Reporting Act
Federal law in the US, effective since 1970, that regulates credit agencies’ collection of credit report information as well as individuals’ access to such information.
Foreign Intelligence Surveillance Act
Federal law in the US, effective since 1978, that establishes processes for surveillance of communications, a provision that has been an ongoing point of contention in international data-transfer negotiations, especially between the US and the EU.
Privacy law for the European Union, effective since 2018.
Federal statute in the United States that, among other measures, requires financial organizations to disclose their data safeguards to their users; effective since 1999.
Health Insurance Portability and Accountability Act
Federal medical privacy law in the United States governing protections for patients’ health information.
Lei Geral de Proteção de Dados Pessoais (Portuguese for General Personal Data Protection Law)
Data privacy law in Brazil, effective since 2020 with sanctions for violations starting in 2021.
Nevada Privacy of Information Collected on the Internet from Consumers Act
State privacy law in Nevada for websites’ privacy policies, effective in its amended form since 2019.
Federal privacy law in Canada, effective since 2000.
Personal Information Protection Act
Federal data protection law in Japan, effective since 2005, sometimes referred to as the Personal Information Protection Law (PIPL). See also: China’s draft Personal Information Protection Law (PIPL) in the Laws section.
Personal Information Protection Law
Federal privacy bill in China, passed in 2021. See also: Japan’s Personal Information Protection Act (PIPA), sometimes referred to as the Personal Information Protection Law (PIPL), in the Laws section.
Protection of Personal Information Act
Federal privacy act in South Africa, effective since 2020.
These measures are under consideration but not yet passed.
Digital Markets Act
Proposed EU legislation that aims to address unfair business practices among large providers of digital services, including through regulation of end-user profiling, presented in 2020.
Proposed EU regulation with specific privacy guidelines for electronic communications, presented in 2017.
Personal Data Protection Bill
Federal privacy bill in India, presented in 2019.
Organizations and Roles
Agencia Española de Protección de Datos (Spanish for Spanish Data Protection Agency)
Spanish agency responsible for upholding data privacy law in the country.
Autoridade Nacional de Proteção de Dados (Portuguese for National Data Protection Authority)
Brazilian agency responsible for upholding data privacy law in the country.
Cybersecurity Administration of China
Chinese agency responsible for upholding data protection law in the county and for implementing technical specifications for the country’s PIPL.
Children’s Advertising Review Unit
US agency responsible for regulating advertising as it relates to children under the age of 12.
Certification des compétences du DPO
Individual certified by the International Association of Privacy Professionals to practice privacy in accordance with France’s CNIL agency
Certified Information Privacy Manager
Title for an individual certified by the International Association of Privacy Professionals to build privacy into operations, e.g., audits and risk management.
Certified Information Privacy Professional
Title for an individual certified by the International Association of Privacy Professionals to practice privacy in legal and compliance settings.
Certified Information Privacy Technologist
Title for an individual certified by the International Association of Privacy Professionals to build privacy into engineering and IT functions..
Court of Justice of the European Union
Judicial body charged with interpreting and applying EU law in EU member countries.
Commission National de l’Informatique et des Libertés (French for National Commission on Informatics and Liberty)
French agency responsible for upholding data privacy law in the country.
Commission Nationale pour la Protection des Données (French for National Data Protection Commission)
Luxembourgish agency responsible for upholding data privacy law in the country.
California Privacy Protection Agency
Agency responsible for implementing and enforcing the CPRA in California, beginning in 2023.
Data Protection Authority
Independent authority in an EU member country that oversees the application of GDPR and relevant country-specific laws; a legacy term for ISA.
Data Protection Commission
Ireland’s agency for upholding privacy law in the country, notably including Facebook’s EU base in Dublin.
Point-person for a company’s privacy compliance and training under GDPR.
European Data Protection Board
Independent organization for implementing data protection regulations in the EU, working in concert with DPAs and the EDPS.
European Data Protection Supervisor
Independent authority in the EU charged with overseeing how EU entities process personal data.
Federal Data Protection and Information Commissioner
Switzerland’s data protection authority.
Federal Trade Commission
US federal agency responsible for enforcing regulations pertaining to consumer protection and market competition.
International Association of Privacy Professionals
Organization that conducts research, creates resources, and provides professional development among privacy professionals; body that grants certifications like CIPM, CIPP, and CIPT.
Information Commissioner’s Office
United Kingdom’s agency for upholding privacy law in the country.
Independent Supervisory Authority
Independent authority in an EU member country that oversees the application of GDPR and relevant country-specific laws; GDPR’s updated term for DSA.
National Institute of Standards and Technology
US federal agency that sets guidelines for innovation across technical fields and establishes frameworks for cybersecurity and privacy.
Office of the Privacy Commissioner
New Zealand’s agency for upholding privacy law in the country.
Privacy Commissioner for Personal Data
Hong Kong agency responsible for upholding data privacy law in the country.
Personal Information Protection Commission
South Korean agency responsible for upholding data privacy law in the country.
Privacy Protection Agency
Enforcement agency under California’s CPRA.
Automated Decision-Making, Solely Automated Decision-Making
The process by which a computer makes a decision given data as input, without human involvement. For SADM, no human is involved at any stage of the process.
Binding Corporate Rule
Policy for data protection applying to EU companies that transfer EU residents’ personal data outside of the EU.
Data Processing Agreement
Agreement between parties that share EU citizens’ personal data , as required under GDPR.
Data Protection Impact Assessment
Risk evaluation carried out for a data processing activity, legally required in certain cases under Virginia’s CDPA and the EU’s GDPR.
|DSR, DSAR, SAR||
A consumer’s request to a business to access, delete, or not sell the personal information that the business holds on them. The activities covered under a DSR depend on the applicable law.
Extract, Transform, Load
General data management term for the process of combining data from multiple sources.
Identifier for Advertisers
A unique device identifier for targeting users for advertising purposes, and advertisers’ access to such identifiers on Apple’s mobile devices now requires explicit user consent following the iOS 14.5 update.
Multi-Factor Authentication (aka 2FA for 2-Factor Authentication)
Process of verifying identity through more than one mechanism, e.g., sending a code to a user’s phone after they have entered their password.
Cryptography practice in which multiple parties run computations while their inputs are kept private from one another.
Private Right of Action
A right granted under certain laws by which individuals, rather than a government entity like the Attorney General’s office, can sue an organization for violating the law.
Record of Processing Activities
Inventory of how, why, and with whom a business handles EU citizens’ personal data, as required under GDPR.
Standard Contractual Clause
Legal mechanism for sharing the personal data of European Economic Area’s citizens with entities outside of the European Economic Area.
Concepts and Tools
App Tracking Transparency
Anti-tracking feature from Apple, rolled out with the 2021 iOS 14.5 update, which requires apps to receive an iPhone user’s explicit consent in order to track the user’s unique advertising identifier.
An encryption practice in which the cryptographic keys needed to read a message are only accessible at the endpoints of the communication: the sender and the receiver, to the exclusion of intermediate parties such as service providers.
Fully Homomorphic Encryption
Encryption practice which allows an arbitrary number of computations on the encrypted data.
Fair Information Practice Principles
Privacy framework that has shaped privacy legislation as well as privacy engineering initiatives, a predecessor more modern approaches like Privacy by Design (PbD).
Federated Learning of Cohorts
One of Google’s proposed alternatives to cookies for individualized third-party tracking on its Chrome browser, relying on tracking users in groups rather than as individuals.
Global Privacy Control
A browser setting for individuals to signal their privacy preferences (e.g., Do Not Sell My Personal Information under CCPA) to all sites visited.
Google Tag Manager
System for web developers to manage user tracking on their businesses’ websites.
Internet of Things
The interconnected network of devices embedded with computing and sensing abilities, particularly in contexts such as the home or workplace with devices that might not resemble computers in a traditional sense, e.g., a home thermostat with internet connectivity.
Feature offered by Facebook in 2020 to businesses, aiming to limit businesses’ collection of Californians’ personal information in order for them to comply with the CCPA.
Framework for building privacy into the design of technologies.
Privacy Enhancing Technologies
Tools designed to strengthen users’ privacy and to use minimal amounts of personal information, e.g., pseudonymization.
Partially Homomorphic Encryption
Encryption practice which allows a single computation on the encrypted data.
Personally Identifiable Information
Information that could reasonably identify a unique individual; different regulations have different designations of what pieces of information are considered personally identifiable.
Quick Response (Code)
A two-dimensional barcode that can point to a URL or application, posing risks to security and privacy if the code, for instance, links to a dangerous website or compromises device settings.
Role-based Access Control
Security and privacy framework with permissions assigned according to personnels’ specific roles.
Right to Be Forgotten
Data right under some privacy laws, in which an individual can request that their personal information be removed from certain databases; sometimes used to refer to GDPR’s right to erasure.
Short for “User Agent string,” information on a browser that communicates which browser is being used, the device it’s being used on, and the version of the browser.
Universally Unique Identifier
128-bit value used in software and encryption as a distinct label.
Virtual Private Network
A network over a public network so that parties can exchange information as if they were connected by a private network.