State privacy law in Illinois governing how businesses can handle users’ biometric information, effective since 2008.

State privacy law in California, effective since 2020 and to be followed by the CPRA in 2023.

State privacy law in Virginia, going into effect in 2023.

Federal rule in the United States that regulates how online services can handle the personal information of children under 13 years of age.

Upcoming state privacy law in California to replace the CCPA in 2023.

Federal privacy act in the United Kingdom, effective since 2018.

Privacy law for the European Union, effective since 2018.

Federal statute in the United States that, among other measures, requires financial organizations to disclose their data safeguards to their users; effective since 1999.

Federal medical privacy law in the United States governing protections for patients’ health information.

Data privacy law in Brazil, effective since 2020 with sanctions for violations starting in 2021.

State privacy law in Nevada for websites’ privacy policies, effective in its amended form since 2019.

Federal privacy law in Canada, effective since 2000.

Federal privacy act in South Africa, effective since 2020.

Proposed EU regulation with specific privacy guidelines for electronic communications, presented in 2017.

Federal privacy bill in India, presented in 2019.

Federal privacy bill in China, presented in 2020

Spanish agency responsible for upholding data privacy law in the country.

Brazilian agency responsible for upholding data privacy law in the country.

Individual certified by the International Association of Privacy Professionals to practice privacy in accordance with France’s CNIL agency

Title for an individual certified by the International Association of Privacy Professionals to build privacy into operations, e.g. audits and risk management.

Title for an individual certified by the International Association of Privacy Professionals to practice privacy in legal and compliance settings.

Title for an individual certified by the International Association of Privacy Professionals to build privacy into engineering and IT functions..

Judicial body charged with interpreting and applying EU law in EU member countries.

French agency responsible for upholding data privacy law in the country.

Luxembourgish agency responsible for upholding data privacy law in the country.

Agency responsible for implementing and enforcing the CPRA in California, beginning in 2023.

Independent authority in an EU member country that oversees the application of GDPR and relevant country-specific laws; a legacy term for ISA.

Point-person for a company’s privacy compliance and training under GDPR.

Independent organization for implementing data protection regulations in the EU, working in concert with DPAs and the EDPS.

Independent authority in the EU charged with overseeing how EU entities process personal data.

Switzerland’s data protection authority.

Organization that conducts research, creates resources, and provides professional development among privacy professionals; body that grants certifications like CIPM, CIPP, and CIPT.

Independent authority in an EU member country that oversees the application of GDPR and relevant country-specific laws; GDPR’s updated term for DSA.

New Zealand’s agency for upholding privacy law in the country.

Hong Kong agency responsible for upholding data privacy law in the country.

South Korean agency responsible for upholding data privacy law in the country.

Enforcement agency under California’s CPRA.

Policy for data protection applying to EU companies that transfer EU residents’ personal data outside of the EU.

Agreement between parties that share EU citizens’ personal data , as required under GDPR.

Risk evaluation carried out for a data processing activity, legally required in certain cases under Virginia’s CDPA and the EU’s GDPR.

A consumer’s request to a business to access, delete, or not sell the personal information that the business holds on them. The activities covered under a DSR depend on the applicable law.

General data management term for the process of combining data from multiple sources.

Process of verifying identity through more than one mechanism, e.g. sending a code to a user’s phone after they have entered their password.

Inventory of how, why, and with whom a business handles EU citizens’ personal data, as required under GDPR.

Legal mechanism for sharing the personal data of European Economic Area’s citizens with entities outside of the European Economic Area.

System for web developers to manage user tracking on their businesses’ websites.

Feature offered by Facebook in 2020 to businesses, aiming to limit businesses’ collection of Californians’ personal information in order for them to comply with the CCPA.

Framework for building privacy into the design of technologies.

Tools designed to strengthen users’ privacy and to use minimal amounts of personal information, e.g. pseudonymization.

Information that could reasonably identify a unique individual; different regulations have different designations of what pieces of information are considered personally identifiable.

Security and privacy framework with permissions assigned according to personnels’ specific roles.

Data right under some privacy laws, in which an individual can request that their personal information be removed from certain databases; sometimes used to refer to GDPR’s right to erasure.

128-bit value used in software and encryption as a distinct label.