The European compliance glossary

Identity and Access Management — centralised management of identities and access rights.

A core GDPR principle: being able to prove your compliance at all times.

The European regulation on artificial intelligence, the world's first law on AI.

An entity that uses an AI system in the course of its professional activity.

A response from an AI model that is factually incorrect but presented with confidence.

AI Act obligation to inform users when content is AI-generated.

An entity that develops, or has developed, an AI system and places it on the market.

Adversarial testing designed to identify weaknesses in an AI system.

A machine-based system designed to operate with a certain degree of autonomy.

A systematic distortion in an algorithm's outputs, generally inherited from its training data.

Irreversible process that prevents any re-identification of an individual.

Agence nationale de la sécurité des systèmes d'information — the French national cybersecurity authority.

Provision that makes it mandatory to maintain a record of processing activities.

A decision producing legal effects, made solely on the basis of automated processing.

Assessment weighing the controller's interest against the rights of individuals.

Business continuity / disaster recovery plan — essential for coping with incidents.

Binding Corporate Rules — binding rules for intra-group transfers.

Obligation to notify the French supervisory authority (CNIL) of any data breach within 72 hours.

A programme open to security researchers to report vulnerabilities in return for a reward.

Chief Information Security Officer — guarantor of the company's cybersecurity.

The French supervisory authority for personal data protection.

The procedure by which the French supervisory authority (CNIL) verifies GDPR compliance.

Overall score of your organisation's compliance level.

A legal basis for processing required for certain data, which must be freely given, informed and specific.

The entity that determines the purposes and means of the processing of personal data.

Trackers placed on a user's device, regulated by the GDPR and the ePrivacy Directive.

Computer Security Incident Response Team.

A training programme that educates employees about cyber risks and good practices.

An event affecting the availability, integrity or confidentiality of information systems.

A security incident resulting in a compromise of personal data.

The set of rules and processes that govern data within the organisation.

Mapping of personal data flows across the organisation.

GDPR principle requiring that only strictly necessary data be collected.

The set of rights (access, rectification, erasure, portability, etc.) granted by the GDPR.

Distributed denial-of-service attack aimed at making a service unavailable.

Digital Operational Resilience Act — operational resilience for the European financial sector.

Data Processing Agreement — processing agreement between controller and processor.

Data Protection Impact Assessment — mandatory for high-risk processing.

English acronym for the AIPD / PIA: Data Protection Impact Assessment.

Data Protection Officer — the data protection lead, mandatory in many cases.

European Data Protection Board, the EU body bringing together national data protection authorities (known in French as the CEPD).

Endpoint Detection and Response — an advanced endpoint protection solution.

Transforming data so that it is unreadable without a decryption key.

Adapting a pre-trained model using your own data.

European regulation on personal data protection, applicable since May 2018.

Structured assessment of GDPR compliance level.

Fines of up to €20M or 4% of global annual turnover for GDPR infringements.

An entity that processes data on behalf of a controller.

Event or situation likely to jeopardise compliance or the rights of individuals.

AI systems capable of producing content (text, images, audio, video, code).

Hébergement de Données de Santé (health data hosting) — mandatory French certification.

An AI system subject to the strictest obligations under the AI Act.

A technique that allows computations to be performed on encrypted data without decrypting it.

Human control exercised over high-risk AI systems.

Transfer of personal data outside the European Economic Area.

International standard for business continuity management systems.

The leading international standard for information security management.

ISO standards specific to security and privacy in the cloud.

An extension of ISO 27001 dedicated to personal data protection.

Internal document governing employees' use of IT tools and data.

The legal ground that authorises the processing of personal data.

GDPR legal basis founded on the interests pursued by the controller.

A very large language model, underpinning text-based generative AI.

Time-stamped recording of actions performed on an information system.

Multi-Factor Authentication.

A descriptive sheet for an AI model (use, limitations, data, risks).

European cybersecurity directive — a strengthening of NIS 1, applicable to thousands of entities.

Offensive intrusion test designed to assess the resilience of an information system.

Any information relating to an identified or identifiable natural person.

A social engineering technique designed to trick users by email, SMS or phone.

Building data protection into a product or processing activity from the design stage.

Clear information provided to individuals when their data is collected (Art. 13-14 GDPR).

A dedicated record kept by a processor listing the processing activities carried out on behalf of its clients.

Automated processing intended to evaluate personal aspects of an individual.

The art of crafting optimal instructions for a generative AI model.

Security measure that replaces direct identifiers with pseudonyms.

Responsibility matrix: Responsible, Accountable, Consulted, Informed.

Retrieval-Augmented Generation: generative AI powered by document repositories.

Malicious software that encrypts data and demands a ransom for its decryption.

Mandatory GDPR document listing all of a company's personal data processing activities.

The maximum length of time for which data may be kept.

The right of an individual to obtain a copy of their data and information about how it is processed.

Right to obtain the erasure of one's personal data (Art. 17 GDPR).

The right to receive one's data in a structured format and to transmit it to another controller.

The right to object to processing, in particular in the case of direct marketing.

French qualification for sovereign, trusted cloud services.

Special categories of data that benefit from enhanced protection under the GDPR.

Unmanaged use of AI by employees, outside approved tools.

Tools or applications used by employees without CIO approval.

Security Information and Event Management — a security log correlation platform.

Security Operations Center — a 24/7 cybersecurity monitoring centre.

Model clauses approved by the European Commission to govern transfers outside the EU.

An attack that goes through a trusted third party (service provider, software, library).

The corpus used to teach an AI model its parameters.

A weakness in a system that can be exploited by an attacker.

A security model based on the principle "never trust, always verify".