Glossary

Dark patterns are online interface designs that steer, trick or pressure users into choices they would not otherwise make, such as buying extras, sharing data or staying subscribed.

Data anonymisation transforms personal data so thoroughly that nobody can work out who it describes, even by combining it with other information they could realistically obtain.

A data breach is an incident in which information is accessed, disclosed, lost, altered or destroyed without authorisation, whether through attack, error or theft.

Data breach notification is the legal duty to tell the regulator, and in serious cases the affected individuals, within a set time after personal data has been lost, stolen or exposed.

Data classification is the practice of sorting information into categories by sensitivity and value, such as public, internal, confidential and restricted, so that each category gets matching handling and protection rules.

A data controller decides why and how personal data is used. A data processor handles the data only on the controller's instructions. The split decides who carries which legal duties.

Data governance is the framework of roles, policies, standards and decision rights that determines how an organisation's data is owned, defined, quality-checked, secured and used across its life.

Data lineage is a record of where a piece of data came from, what systems and transformations it passed through, and where it ends up, allowing any reported figure to be traced to source.

Data localisation is a legal or contractual requirement that certain data be stored, and sometimes processed, only inside a particular country or region, rather than being sent or held abroad.

Data loss prevention is a set of tools and rules that detect sensitive information and block or flag attempts to send it outside approved channels, whether by accident or on purpose.

Data minimisation is the principle of collecting and keeping only the personal data a stated purpose truly needs, in amounts no larger and for no longer than that purpose requires.

Data privacy is the right of individuals to have a say over how information about them is collected, used, shared and kept, and the organisational duty to respect that say.

A data processing agreement is the written contract a controller must have with any processor handling personal data for it, setting out what the processor may do, for how long, and under which safeguards.

A DPIA is a structured assessment, done before starting a new use of personal data, that identifies privacy risks to individuals and decides what safeguards are needed to reduce them.

A data protection officer is a designated person who advises an organisation on its privacy duties, monitors compliance, and acts as the contact point for regulators and individuals, while staying independent of day-to-day decisions.

Data quality management is the ongoing work of defining, measuring and improving how accurate, complete, consistent, timely and valid data is, so that it is fit for the decisions and reports that rely on it.

A data retention schedule is a document listing each type of record or data the organisation holds, how long it must be kept, the reason, and what happens when that period ends.

Data sovereignty is the principle that data is subject to the laws and courts of the country where it is stored or processed, so that country's authorities can control access to it.

Data stewardship is the assignment of named people to look after specific data sets, setting their definitions, quality, access rules and fixing problems, under the policies of data governance.

Data subject rights are the powers privacy laws give individuals over their own personal data, such as seeing it, correcting it, having it erased, moving it elsewhere, or objecting to certain uses.

A dawn raid is a surprise inspection of a company's premises by a competition authority, which arrives without warning to search for and copy evidence of suspected cartel or other illegal conduct.

De-risking happens when a bank drops whole customer categories or country business wholesale, rather than judging each client on its merits, because the controls needed cost more than the relationship earns.

De-risking is when a correspondent bank ends or limits services to whole categories of respondent banks or countries without judging each on its own controls, leaving some places short of access to international payments.

Dealers in precious metals and stones are businesses that buy, sell or trade gold, silver, diamonds and similar goods. They are a recognised money laundering risk because these items hold high value in small, portable and easily traded form.

Debarment is the formal exclusion of a company or person, for a set period or permanently, from winning public contracts or taking part in projects funded by an institution, because of misconduct.

A declaration of interests register is a record in which directors, officials or staff list their financial interests, outside roles and relationships that could conflict with their duties, kept current and open to review.

Defensive reporting is filing suspicious activity or transaction reports on weak or no grounds, mainly to protect the reporting firm from criticism or penalty, rather than because real suspicion exists.

A deferred prosecution agreement is a deal in which a prosecutor files or holds criminal charges against a company but pauses them, on condition it pays, cooperates and reforms; if it complies, the charges are dropped.

A delegation of authority is a formal record of who may approve which decisions and spend which amounts, passed down from the board to managers, so that no one acts beyond their stated limits.

Delisting is the removal of a person, company or vessel from a sanctions list, which ends the freeze and other restrictions that applied because of the listing.

These are the two tests of a control. Design effectiveness asks whether the control, if run as described, would address the risk. Operating effectiveness asks whether it was actually run properly over the period.

DNFBPs are non-bank businesses and professionals, among them casinos, estate agents, lawyers, accountants and company formation agents, that FATF says must follow AML/CFT rules because criminals can use them.

Detective controls are checks that find an error, loss or breach after it has happened, so it can be corrected, investigated and reported. Examples are reconciliations, exception reports and audits.

Digital forensics is the careful examination of computers, phones, servers and cloud accounts to recover data and establish what happened, with handling strict enough for the results to be used as evidence.

DORA is an EU regulation that sets common rules on managing technology risk, reporting incidents, testing resilience and overseeing technology suppliers for banks, insurers, investment firms and other financial entities.

The DPDP Act is India's main data protection statute, passed in 2023, setting rules for how organisations may process the digital personal data of individuals and giving those individuals enforceable rights.

Director disqualification is a legal sanction that bars a person from serving as a company director, or from managing a company, for a set period because of misconduct or unfitness.

Directors' duties are the legal obligations that company directors owe to the company, mainly to act in good faith, avoid conflicts, and exercise reasonable care, skill and diligence when making decisions.

A disaster recovery plan sets out the steps, people and resources needed to restore IT systems, data and supporting facilities after a major outage or destructive event, within agreed time and data-loss limits.

Disaster recovery testing is the planned exercise of restoring systems and data from backups or alternate sites, to prove that recovery can meet its time and data-loss targets before a real failure.

Disgorgement is a court or regulatory order requiring a wrongdoer to hand back profits or benefits obtained through illegal or improper conduct, so that they do not keep the gains.

DEI is a set of policies and practices aimed at representing people of different backgrounds, treating them fairly and giving them real opportunities to take part, in the workforce, in management and on the board.

Do No Significant Harm is a test applied in sustainable finance: an activity counted as environmentally sustainable for one objective must not materially damage any of the other environmental objectives.

The Dodd-Frank Act is a 2010 United States law that reformed financial regulation after the 2008 crisis, creating new oversight bodies and rules on risk-taking, derivatives, consumer finance and whistleblowing.

Double materiality asks two questions about a sustainability topic: does the company affect people or the environment in a significant way, and does the topic significantly affect the company’s own finances?

A double taxation agreement is a treaty between two countries that decides which of them may tax certain income, and by how much, so the same income is not taxed twice.

Dual-use goods are ordinary commercial or research products, software or technical know-how that could also be put to military use or to making weapons of mass destruction.

Due diligence is a careful, documented investigation of a person, company or deal before committing to it, to confirm facts and uncover risks such as fraud, corruption, legal exposure or financial weakness.

A due diligence questionnaire is a standard set of written questions sent to a customer, counterparty or partner so it can describe its ownership, business, controls and risk profile for the sender's review.

The duty of care requires directors to act with the knowledge, attention and caution that a reasonable person in their position would show, informing themselves before decisions and monitoring the company properly.

The duty of loyalty requires directors to act in good faith and in the company's interest, putting it ahead of their own, and to avoid or disclose conflicts and personal gains from their position.