Compliance & Regulatory Language
Practice the English vocabulary for GDPR, SOC 2, ISO 27001, and PCI DSS compliance that every engineer in regulated environments needs.
Frequently Asked Questions
What's the difference between GDPR and CCPA, particularly regarding data subject rights?
GDPR (General Data Protection Regulation) is a European Union-wide law, while CCPA (California Consumer Privacy Act) focuses on California residents. Both grant individuals rights like access, rectification, and erasure of their personal data, but GDPR's scope is broader due to its EU enforcement, whereas CCPA has specific definitions and enforcement mechanisms tailored to the Californian legal landscape.
I'm building an API; how does 'data minimization' relate to my design?
Data minimization dictates that you should only collect and retain the absolute minimum amount of personal data necessary for a specific, legitimate purpose. Implementing this involves carefully considering each field in your API requests and responses, avoiding collecting extraneous information that isn't directly needed.
Can you explain 'purpose limitation' under data protection laws?
'Purpose limitation' means the data collected must only be used for the specific purpose stated at the time of collection. Changing the purpose later necessitates obtaining fresh consent or reclassifying the data, as simply repurposing existing data without justification is a violation.
What are 'pseudonymized' and 'anonymized' data – what's the practical difference for developers?
Pseudonymized data replaces identifying information with pseudonyms, allowing analysis while reducing risk. Anonymized data removes all identifiers, rendering it truly irreversible and compliant with strict privacy regulations. Developers must understand this distinction to implement appropriate safeguards based on the level of protection needed.
I'm handling user consent for marketing emails – what are 'opt-in' and 'opt-out'?
'Opt-in' requires explicit affirmative action from a user to subscribe to receive marketing communications, such as ticking a box. 'Opt-out' allows users to revoke their consent easily, typically through an unsubscribe link in emails, fulfilling the right to be forgotten or cease receiving communications.
What is 'Data Retention' and what are some common legal retention periods?
'Data Retention' refers to the length of time an organization is legally required to keep personal data. This varies by jurisdiction, but generally, financial records might require 7 years, while employment records could be retained for 30-60 years depending on local laws.
Explain 'Consent Management Platform' (CMP) – what does a developer need to know about integrating one?
A CMP is a software tool that helps manage user consent across multiple websites and apps, ensuring compliance with regulations like GDPR. Developers must integrate the CMP's JavaScript snippet into their site to capture and track consent choices accurately, triggering appropriate data processing restrictions.
What's 'Data Breach Notification' – what are my obligations if a security incident occurs?
'Data Breach Notification' laws require organizations to inform affected individuals and regulatory bodies about a confirmed data breach within specific timeframes. This typically involves detailing the type of data compromised, the potential harm, and steps taken to mitigate the damage, varying by jurisdiction.
What is 'Data Subject Access Request' (DSAR) – how does this impact my API development?
A DSAR is a legal right granted to individuals to access their personal data held by an organization. Developers must build APIs that allow authorized requests for data retrieval, ensuring the response complies with all data protection requirements, including providing transparency and justification.
Define 'Vendor Risk Management' in the context of compliance – what responsibilities do I have?
Vendor risk management involves assessing the security and compliance practices of third-party vendors who process personal data on your behalf. Developers must ensure contracts with vendors include clauses requiring them to adhere to relevant regulations like GDPR, including data protection impact assessments (DPIAs).