Glossary

Data classification is the practice of sorting information into categories by sensitivity and value, such as public, internal, confidential and restricted, so that each category gets matching handling and protection rules.

Data lineage is a record of where a piece of data came from, what systems and transformations it passed through, and where it ends up, allowing any reported figure to be traced to source.

Data loss prevention is a set of tools and rules that detect sensitive information and block or flag attempts to send it outside approved channels, whether by accident or on purpose.

Data minimisation is the principle of collecting and keeping only the personal data a stated purpose truly needs, in amounts no larger and for no longer than that purpose requires.

A DPIA is a structured assessment, done before starting a new use of personal data, that identifies privacy risks to individuals and decides what safeguards are needed to reduce them.

A data retention schedule is a document listing each type of record or data the organisation holds, how long it must be kept, the reason, and what happens when that period ends.

A declaration of interests register is a record in which directors, officials or staff list their financial interests, outside roles and relationships that could conflict with their duties, kept current and open to review.

Defensive reporting is filing suspicious activity or transaction reports on weak or no grounds, mainly to protect the reporting firm from criticism or penalty, rather than because real suspicion exists.

Detective controls are checks that find an error, loss or breach after it has happened, so it can be corrected, investigated and reported. Examples are reconciliations, exception reports and audits.

Digital forensics is the careful examination of computers, phones, servers and cloud accounts to recover data and establish what happened, with handling strict enough for the results to be used as evidence.

A disaster recovery plan sets out the steps, people and resources needed to restore IT systems, data and supporting facilities after a major outage or destructive event, within agreed time and data-loss limits.

Disaster recovery testing is the planned exercise of restoring systems and data from backups or alternate sites, to prove that recovery can meet its time and data-loss targets before a real failure.

Double materiality asks two questions about a sustainability topic: does the company affect people or the environment in a significant way, and does the topic significantly affect the company’s own finances?

A due diligence questionnaire is a standard set of written questions sent to a customer, counterparty or partner so it can describe its ownership, business, controls and risk profile for the sender's review.