Law · Glossary

Glossary

250 terms of EU privacy and AI law. Wherever a law defines a word (102 of them), the meaning is quoted word for word from the law, with the article it comes from. Every term also gets one plain-English line.

A

AccountabilityThe controller is responsible for complying with the data protection principles and must be able to prove it, using suitable technical and organisational measures.GDPR Art. 5(2)
AccuracyPersonal data must be accurate and, where necessary, kept up to date. Every reasonable step must be taken to erase or correct inaccurate data without delay.GDPR Art. 5(1)(d)
Adequacy decisionA European Commission decision that a non-EU country, territory, sector or international organisation protects personal data adequately. Data can then flow there without specific authorisation.GDPR Art. 45(1)
Administrative fineA money penalty a data protection authority can impose for GDPR infringements. It must be effective, proportionate and dissuasive; the highest tier is up to 20 million euro or 4% of worldwide annual turnover, if higher.GDPR Art. 83(1)
AI ActThe EU law on artificial intelligence. It bans some AI practices, sets requirements for high-risk AI systems and rules for general-purpose AI models. It was amended in 2026 by Regulation (EU) 2026/1744.AI Act Art. 1(1)
AI literacyThe skills, knowledge and understanding that let providers, deployers and affected people use AI systems in an informed way and be aware of AI's opportunities, risks and possible harms.AI Act Art. 3(56)
AI officeThe European Commission's function for implementing, monitoring and supervising AI systems, general-purpose AI models and AI governance. References to the AI Office in the AI Act mean the Commission.AI Act Art. 3(47)
AI regulatory sandboxA controlled framework set up by an authority where providers can develop, train, validate and test an innovative AI system for a limited time under regulatory supervision.AI Act Art. 3(55)
AI systemA machine-based system that works with some autonomy and works out, from the input it receives, how to produce outputs such as predictions, content, recommendations or decisions that can affect physical or virtual environments.AI Act Art. 3(1)
Anonymous informationInformation that does not relate to an identifiable person, or data made anonymous so that no one can identify the person by any means reasonably likely to be used. The GDPR does not apply to it.GDPR recital 26
Appropriate safeguardsWithout an adequacy decision, data may go outside the EU only with appropriate safeguards, such as standard contractual clauses or binding corporate rules, and with enforceable rights and effective remedies for people.GDPR Art. 46(1)
Article 29 Working PartyThe advisory group of national data protection authorities set up under the 1995 Data Protection Directive. It published influential opinions and guidelines until the GDPR replaced it with the European Data Protection Board in May 2018.Directive 95/46 Art. 29(1)
Authorised representativeA person or company in the EU with a written mandate from an AI provider to carry out the provider's AI Act obligations and procedures on its behalf.AI Act Art. 3(5)
Automated individual decision-makingPeople have the right not to be subject to solely automated decisions, including profiling, with legal or similarly significant effects, unless needed for a contract, allowed by law, or based on explicit consent.GDPR Art. 22(1)

B

C

D

E

F

G

H

I

J

L

M

N

O

OperatorThe umbrella word in the AI Act for a provider, product manufacturer, deployer, authorised representative, importer or distributor.AI Act Art. 3(8)

P

R

S

T

U

V

W

Looking for court rulings? They are in Key cases. The official texts are quoted from EUR-Lex, the EU Publications Office and the European Data Protection Board; the plain-English lines are Fino’s own and are not legal advice.