For the purposes of this law, “personal data” refers to any information relating to an identified or identifiable natural person. This includes, but is not limited to, names, identification numbers, location data, and other identifiers. “Data subject” refers to the individual whose personal data is being processed. “Data controller” is defined as the entity that determines the purposes and means of processing personal data, while a “data processor” refers to any entity that processes data on behalf of the data controller. “Consent” means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, expressing agreement to the processing of their personal data.

• Personal Data: Any information relating to an identified or identifiable natural person. This includes, but is not limited to, names, identification numbers, location data, online identifiers, and other factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of a person.

• Data Subject: An individual whose personal data is being collected, stored, or processed. The data subject is the person to whom the personal data relates.

• Data Controller: The person, organization, or entity that determines the purposes and means of processing personal data. The data controller is responsible for ensuring that data processing complies with the provisions of data protection laws.

• Data Processor: A person or entity that processes personal data on behalf of the data controller. The processor is not responsible for the decision-making regarding the processing of the data but must adhere to the instructions provided by the data controller.

• Processing: Any operation or set of operations performed on personal data, whether or not by automated means, such as collection, storage, retrieval, alteration, sharing, or deletion.

• Consent: A freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they agree to the processing of their personal data for one or more specific purposes.

• Sensitive Personal Data: Personal data that requires a higher level of protection due to its nature, such as data regarding race, ethnicity, political opinions, religious beliefs, genetic or biometric data, health data, and sexual orientation.

• Data Breach: A security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.

• Data Subject Rights: The rights granted to individuals under data protection laws, which may include the right to access, correct, delete, or restrict the processing of their personal data, as well as the right to object to processing or to withdraw consent.

• Data Protection Impact Assessment (DPIA): A process used to assess and evaluate the risks associated with personal data processing activities. It helps identify and mitigate any potential risks to the privacy and rights of data subjects.

• Third Party: Any entity other than the data subject, data controller, or data processor, which may have access to personal data, either with or without the data subject’s consent.

• Cross-border Data Transfer: The transfer of personal data from one country or jurisdiction to another, which may involve different legal protections for personal data.

• Anonymization: The process of removing personally identifiable information from data so that the data can no longer be attributed to a specific individual, effectively making it non-personal.

• Pseudonymization: The process of processing personal data in such a way that it cannot be attributed to a specific data subject without the use of additional information that is kept separate.

• Privacy Policy: A document that informs data subjects about how their personal data is collected, used, stored, and shared by an organization, and outlines their rights under the applicable data protection law.