Glossary

Data breach notification is the legal duty to tell the regulator, and in serious cases the affected individuals, within a set time after personal data has been lost, stolen or exposed.

Data classification is the practice of sorting information into categories by sensitivity and value, such as public, internal, confidential and restricted, so that each category gets matching handling and protection rules.

Data lineage is a record of where a piece of data came from, what systems and transformations it passed through, and where it ends up, allowing any reported figure to be traced to source.

Data loss prevention is a set of tools and rules that detect sensitive information and block or flag attempts to send it outside approved channels, whether by accident or on purpose.

Data minimisation is the principle of collecting and keeping only the personal data a stated purpose truly needs, in amounts no larger and for no longer than that purpose requires.

A data processing agreement is the written contract a controller must have with any processor handling personal data for it, setting out what the processor may do, for how long, and under which safeguards.

A DPIA is a structured assessment, done before starting a new use of personal data, that identifies privacy risks to individuals and decides what safeguards are needed to reduce them.

A data retention schedule is a document listing each type of record or data the organisation holds, how long it must be kept, the reason, and what happens when that period ends.

De-risking is when a correspondent bank ends or limits services to whole categories of respondent banks or countries without judging each on its own controls, leaving some places short of access to international payments.

A declaration of interests register is a record in which directors, officials or staff list their financial interests, outside roles and relationships that could conflict with their duties, kept current and open to review.

Defensive reporting is filing suspicious activity or transaction reports on weak or no grounds, mainly to protect the reporting firm from criticism or penalty, rather than because real suspicion exists.

A deferred prosecution agreement is a deal in which a prosecutor files or holds criminal charges against a company but pauses them, on condition it pays, cooperates and reforms; if it complies, the charges are dropped.

Detective controls are checks that find an error, loss or breach after it has happened, so it can be corrected, investigated and reported. Examples are reconciliations, exception reports and audits.

Digital forensics is the careful examination of computers, phones, servers and cloud accounts to recover data and establish what happened, with handling strict enough for the results to be used as evidence.

A disaster recovery plan sets out the steps, people and resources needed to restore IT systems, data and supporting facilities after a major outage or destructive event, within agreed time and data-loss limits.

Disaster recovery testing is the planned exercise of restoring systems and data from backups or alternate sites, to prove that recovery can meet its time and data-loss targets before a real failure.

Double materiality asks two questions about a sustainability topic: does the company affect people or the environment in a significant way, and does the topic significantly affect the company’s own finances?

A due diligence questionnaire is a standard set of written questions sent to a customer, counterparty or partner so it can describe its ownership, business, controls and risk profile for the sender's review.