Glossary — 300+ Privacy Terms

Accountability

Privacy Concepts

GDPR principle (Article 5(2)) requiring the controller to be responsible for and able to demonstrate compliance with all data protection principles. Includes record-keeping, DPIAs, DPO appointment, and documentation of processing activities.

Act on the Protection of Personal Information

APPI

Regulations & Compliance

Japan’s primary data protection law governing the handling of personal information by business operators. Amended in 2020 to strengthen individual rights and cross-border transfer rules. Enforced by the PPC (Personal Information Protection Commission).

Adequacy Decision

Geopolitical

Determination by the European Commission that a non-EU country provides an adequate level of data protection. Enables free flow of personal data without additional safeguards. Countries with adequacy include UK, Japan, South Korea, Argentina, and Canada (commercial).

AES-256-GCM

Cryptography & Security

Advanced Encryption Standard with 256-bit key length in Galois/Counter Mode. Provides both confidentiality and integrity (authenticated encryption). Widely used for data-at-rest and data-in-transit encryption. NIST-approved symmetric cipher.

Age Verification

Privacy Concepts

Technical mechanisms to confirm a user’s age for compliance with age-gating requirements (COPPA, GDPR Article 8). Methods range from self-declaration to AI-based age estimation and document verification. Balances child protection with privacy.

Agencia Española de Protección de Datos

AEPD

Regulatory Bodies

Spanish data protection authority responsible for enforcing GDPR and Spanish data protection law (LOPDGDD). Active in enforcement, particularly regarding video surveillance, cookie compliance, and data breach notifications.

AI Training & Model Privacy

Track: AI Training

Research Framework

Research track analyzing privacy risks in AI/ML training data, model memorization, data poisoning, and the tension between AI capability and data protection compliance.

anonym.community

Products & Ecosystem

Research and community platform providing privacy problem analysis, structural driver research, pain point tracking, and DPA directory. Hosts 1,478 pain points across 14 research tracks with 240 jurisdiction profiles.

anonym.legal

Products & Ecosystem

Web-based PII anonymization platform providing real-time detection and anonymization of personal data across 48 languages. Features zero-knowledge architecture, reversible encryption (AES-256-GCM), 267+ entity types, and hybrid regex+NLP+ML detection. 100% accuracy (419/419 tests). Available at https://anonym.legal.

anonym.plus

Products & Ecosystem

Desktop application for PII anonymization built with Tauri (Rust + React). Supports offline processing, batch operations, and all features of anonym.legal without requiring internet connection. Available for Windows, macOS, and Linux.

Anonymization

Anonymization & De-identification

Process of irreversibly transforming personal data so that the individual cannot be identified directly or indirectly. Under GDPR, truly anonymized data is no longer considered personal data and falls outside its scope. Stronger than pseudonymization.

anonymize.solutions

Products & Ecosystem

Enterprise anonymization solutions platform providing consulting, integration, and custom deployment services for organizations requiring tailored data protection workflows.

API Rate Limiting

Rate Limiting

Technical Architecture

Technique for controlling the number of requests a client can make to an API within a given time period. Prevents abuse, ensures fair usage, and protects backend resources. Common strategies: token bucket, sliding window, fixed window.

Argon2id

Cryptography & Security

Memory-hard password hashing function that won the Password Hashing Competition (2015). Combines Argon2i (data-independent, side-channel resistant) and Argon2d (data-dependent, GPU resistant) approaches. Recommended by OWASP for password storage.

Article 29 Working Party

WP29

Regulatory Bodies

Former advisory body on data protection matters under the 1995 Data Protection Directive. Composed of DPA representatives from each EU member state. Succeeded by the EDPB when GDPR took effect in May 2018. Its opinions remain influential.

Asia-Pacific

APAC

Geopolitical

Geographic region encompassing East Asia, Southeast Asia, South Asia, and Oceania. Diverse privacy regulatory landscape ranging from comprehensive laws (PIPL, APPI, PDPA) to emerging frameworks. Largest regional market by population.

Asymmetric Encryption

Cryptography & Security

Cryptographic system using pairs of keys: a public key for encryption and a private key for decryption (or vice versa for signing). Enables secure communication without prior shared secrets. RSA, ECDSA, and Ed25519 are common algorithms.

Autoridade Nacional de Proteção de Dados

ANPD

Regulatory Bodies

Brazilian data protection authority established by the LGPD. Responsible for interpreting and enforcing Brazil’s data protection law, issuing regulations and guidelines, and handling complaints. Became an independent agency in 2022.

Autorità Garante per la Protezione dei Dati Personali

Garante

Regulatory Bodies

Italian data protection authority responsible for enforcing GDPR and Italian data protection law. One of the oldest DPAs in Europe (established 1996). Has issued significant enforcement decisions against AI companies.

Autorité de protection des données

APD-GBA

Regulatory Bodies

Belgian data protection authority (Gegevensbeschermingsautoriteit/Autorité de protection des données). Hosts the EDPB secretariat as Belgium is the seat of EU institutions. Known for the IAB Europe Transparency & Consent Framework ruling.

Autoriteit Persoonsgegevens

AP

Regulatory Bodies

Dutch data protection authority responsible for enforcing GDPR and Dutch UAVG in the Netherlands. Known for significant enforcement actions including record fines against tech companies for tracking and consent violations.

Batch Processing

Products & Ecosystem

Capability to process multiple documents or text segments in a single operation. Supports CSV, JSON, and bulk text input. Enables efficient anonymization of large datasets without manual per-document processing.

Benelux

Geopolitical

Economic and political union of Belgium, the Netherlands, and Luxembourg. Relevant in privacy context as Belgium hosts EU institutions (including EDPB secretariat) and Dutch/Belgian DPAs are among the most active GDPR enforcers.

BERT

NLP & AI Technologies

Bidirectional Encoder Representations from Transformers. Pre-trained language model by Google (2018) that uses bidirectional context for understanding text. Foundation for many NLP tasks including NER, classification, and question answering.

Binding Corporate Rules

BCRs

Regulations & Compliance

Internal data protection policies approved by EU supervisory authorities for multinational companies to transfer personal data within their corporate group outside the EU/EEA. Require approval from a lead supervisory authority under the consistency mechanism.

Biometric & Facial Recognition

Track: Biometric

Research Framework

Research track examining privacy challenges specific to biometric data collection, facial recognition deployment, and the unique risks of irrevocable biometric identifiers.

Biometric Data

Data Types & Entities

Personal data resulting from specific technical processing of physical, physiological, or behavioral characteristics. Includes fingerprints, facial geometry, iris patterns, voiceprints, gait analysis, and keystroke dynamics. Special category under GDPR Article 9.

BIP39

Cryptography & Security

Bitcoin Improvement Proposal 39 defining a mnemonic code standard for generating deterministic keys. Uses a wordlist of 2,048 words to encode cryptographic seeds as human-readable phrases (typically 12 or 24 words). Used in cryptocurrency wallets and adapted for encryption key derivation.

Brussels Effect

Geopolitical

Term describing the EU’s unilateral ability to set global regulatory standards through market size, forcing multinational companies to adopt EU standards globally. Named after Anu Bradford’s research. GDPR is the primary example in data protection.

Bundesbeauftragte für den Datenschutz und die Informationsfreiheit

BfDI

Regulatory Bodies

German Federal Commissioner for Data Protection and Freedom of Information. Federal-level DPA for Germany overseeing federal public bodies and telecommunications. Germany also has 16 state-level DPAs (Landesdatenschutzbeauftragte).

Burgerservicenummer

BSN

Data Types & Entities

9-digit Dutch citizen service number used for communication with government agencies in the Netherlands. Legal restrictions on use by private organizations. Must pass the 11-check validation algorithm.

Business Associate Agreement

BAA

Regulations & Compliance

Contract required under HIPAA between a covered entity and a business associate. Establishes permitted uses and disclosures of PHI, requires safeguards, and defines breach notification obligations.

California Consumer Privacy Act

CCPA

Regulations & Compliance

California state law granting consumers rights over their personal information collected by businesses. Provides rights to know, delete, and opt-out of the sale of personal information. Effective January 1, 2020.

California Privacy Protection Agency

CPPA

Regulatory Bodies

State agency established by the CPRA to implement and enforce the CCPA/CPRA. First US agency dedicated solely to privacy enforcement. Rulemaking authority for CCPA regulations.

California Privacy Rights Act

CPRA

Regulations & Compliance

Amendment to the CCPA expanding consumer privacy rights in California. Introduced the California Privacy Protection Agency (CPPA), added rights to correct and limit use of sensitive personal information. Effective January 1, 2023.

Certificate Authority

CA

Cryptography & Security

Trusted entity that issues digital certificates binding public keys to identities. Part of the Public Key Infrastructure (PKI). Let’s Encrypt is a widely used free CA.

Children & Education

Track: Children

Research Framework

Research track focused on privacy protection for minors in educational technology, social media, gaming, and online services. Covers COPPA, FERPA, and age-appropriate design codes.

Children’s Data

Data Types & Entities

Personal data of minors requiring enhanced protection. GDPR Article 8 requires parental consent for information society services for children under 16 (member states may lower to 13). COPPA applies to children under 13 in the US.

Children’s Online Privacy Protection Act

COPPA

Regulations & Compliance

US federal law that imposes requirements on websites and online services directed at children under 13. Requires verifiable parental consent before collecting personal information from children.

Chrome Extension

Products & Ecosystem

Browser extension for Google Chrome enabling in-browser PII detection and anonymization. Allows users to anonymize text directly on web pages, forms, and emails without copying to external tools.

Client-Side Encryption

CSE

Cryptography & Security

Encryption performed entirely on the user’s device before data is transmitted to any server. Ensures that even the service provider cannot read the data. Core component of zero-knowledge architectures.

cloak.business

Products & Ecosystem

Business-focused anonymization platform designed for enterprise data protection workflows. Provides team management, audit trails, and compliance documentation features alongside core anonymization capabilities. Integrates with Nextcloud v2.0.0, SDKs (npm, PyPI), and Cloud Storage (OneDrive, SharePoint, Google Drive, Dropbox).

CLOUD Act

Regulations & Compliance

US Clarifying Lawful Overseas Use of Data Act. Allows US law enforcement to compel US-based technology companies to provide data stored on servers regardless of location. Raises concerns about international data sovereignty and conflicts with GDPR.

Codice Fiscale

Data Types & Entities

16-character Italian tax identification code derived algorithmically from name, date of birth, gender, and place of birth. Used for all fiscal and administrative interactions. Format: 6 letters + 2 digits + 1 letter + 2 digits + 1 letter + 3 digits + 1 letter.

Colorado Privacy Act

CPA

Regulations & Compliance

US state privacy law granting Colorado residents rights to access, correct, delete, and opt out of targeted advertising and sale of personal data. Effective July 1, 2023.

Commission Nationale de l’Informatique et des Libertés

CNIL

Regulatory Bodies

French data protection authority (DPA) responsible for enforcing data protection law in France. One of the most active DPAs in Europe with significant enforcement actions including record GDPR fines against major tech companies.

Confidence Score

NLP & AI Technologies

Numerical value (typically 0–1) indicating the model’s certainty that a detected entity is correctly identified. Higher thresholds reduce false positives but may increase false negatives. Used in PII detection to tune precision/recall trade-off.

Connecticut Data Privacy Act

CTDPA

Regulations & Compliance

US state privacy law providing consumers with rights over their personal data. Similar to Virginia CDPA with some CCPA-like provisions. Effective July 1, 2023.

Consent

Privacy Concepts

Under GDPR, freely given, specific, informed, and unambiguous indication of a data subject’s agreement to processing. Must be as easy to withdraw as to give. For sensitive data and children, explicit consent is required.

Contact Information

Data Types & Entities

Personal data used to reach an individual including name, address, phone number, email, and social media handles. Most commonly processed category of PII. Subject to data minimization requirements under GDPR.

Cookie

Data Types & Entities

Small text file stored on a user’s device by a web browser. Used for session management, personalization, and tracking. Under the ePrivacy Directive, non-essential cookies require informed consent. Types include session, persistent, first-party, and third-party cookies.

Coverage Matrix

Research Framework

Comparative analysis mapping privacy solution capabilities across products, features, and requirements. anonym.community’s coverage matrix compares anonymization tools across detection methods, language support, encryption, and compliance features.

Cross-Border Data Transfers

Track: Cross-Border

Research Framework

Research track analyzing challenges of transferring personal data across jurisdictional boundaries. Covers SCCs, BCRs, adequacy decisions, and regulatory conflicts like CLOUD Act vs. GDPR.

CSV

Technical Architecture

Comma-Separated Values — plain text format for tabular data where each line represents a record and fields are separated by commas. Widely used for data exchange, batch processing, and spreadsheet import/export.

curta.solutions

Products & Ecosystem

Parent organization and development company behind the anonym.legal ecosystem. Based in Germany. Develops and maintains all products in the anonymization suite.

DACH

Geopolitical

Abbreviation for the German-speaking region of Europe: Deutschland (Germany), Austria, and Switzerland (Confoederatio Helvetica). Shares cultural and linguistic characteristics relevant to privacy regulation and data processing practices.

Dark Patterns

Privacy Concepts

User interface designs that trick or manipulate users into making unintended choices, often against their privacy interests. Examples: pre-checked consent boxes, confusing opt-out flows, hidden settings, and confirm-shaming. Addressed by DSA and proposed regulations.

Data Breach

Privacy Concepts

Security incident leading to unauthorized access, disclosure, alteration, or destruction of personal data. Under GDPR Article 33, must be reported to the supervisory authority within 72 hours. High-risk breaches require notification to affected individuals.

Data Brokers & Profiling

Track: Data Brokers

Research Framework

Research track investigating the data broker industry, behavioral profiling, and the challenges individuals face in controlling their data in secondary markets.

Data Controller

Regulations & Compliance

Natural or legal person, public authority, agency, or other body that determines the purposes and means of the processing of personal data. Bears primary responsibility for GDPR compliance.

Data Localization

Geopolitical

Legal requirement that data about a nation’s citizens or residents be collected, processed, and stored within that country’s borders. Motivated by data sovereignty, security, and surveillance concerns. Examples: Russia, China, India (proposed).

Data Masking

Anonymization & De-identification

Technique of obscuring specific data within a dataset so the data remains usable but not identifiable. Methods include substitution, shuffling, character masking, and nulling. Used for test environments and development databases.

Data Minimization

Privacy Concepts

GDPR principle (Article 5(1)(c)) requiring that personal data be adequate, relevant, and limited to what is necessary for the purposes for which it is processed. Prohibits excessive data collection.

Data Perturbation

Anonymization & De-identification

Technique of systematically modifying data values to prevent identification while maintaining statistical properties. Includes noise addition, data swapping, microaggregation, and rounding. Balances privacy protection with data utility.

Data Portability

Privacy Concepts

Data subject right under GDPR Article 20 to receive personal data in a structured, commonly used, machine-readable format and to transmit it to another controller. Applies when processing is based on consent or contract and carried out by automated means.

Data Processing Agreement

DPA (Agreement)

Regulations & Compliance

Contract between a data controller and data processor as required by GDPR Article 28. Specifies the subject matter, duration, nature, and purpose of processing, types of personal data, and obligations of the processor.

Data Processor

Regulations & Compliance

Natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller. Must only process data according to the controller’s instructions and implement appropriate security measures.

Data Protection by Design

DPbD

Privacy Concepts

GDPR Article 25 requirement that controllers implement appropriate technical and organizational measures designed to implement data protection principles effectively. Both at the time of determining processing means and during processing itself.

Data Protection Certification

Certification

Privacy Concepts

Voluntary mechanism under GDPR Article 42 allowing organizations to demonstrate compliance through approved certification bodies. Intended to enhance transparency and facilitate compliance verification. Examples: EuroPriSe, ISO 27701.

Data Protection Impact Assessment

DPIA

Regulations & Compliance

Systematic process required under GDPR Article 35 to identify and minimize data protection risks of a project or processing activity. Mandatory when processing is likely to result in high risk to individuals’ rights and freedoms.

Data Protection Officer

DPO

Regulations & Compliance

Individual designated under GDPR Articles 37–39 to oversee data protection strategy and compliance. Mandatory for public authorities, large-scale processing of special categories, and systematic monitoring. Must have expert knowledge of data protection law and practices.

Data Redaction

Anonymization & De-identification

Removing or blacking out sensitive information from documents or datasets. Common in legal document production, FOIA responses, and medical record sharing. Can be applied to text, images, and metadata.

Data Sovereignty

Geopolitical

Principle that data is subject to the laws and governance structures of the country where it is collected or stored. Tension between global data flows and national jurisdiction. Drives data localization requirements in countries like Russia, China, and India.

Data Subject

Regulations & Compliance

An identified or identifiable natural person whose personal data is processed. Under GDPR, data subjects have rights including access, rectification, erasure, restriction, portability, and objection.

Data Swapping

Anonymization & De-identification

Anonymization technique that exchanges values of sensitive attributes between records. Preserves marginal distributions while breaking the link between quasi-identifiers and sensitive attributes. Used by US Census Bureau.

Datenschutzkonferenz

DSK

Regulatory Bodies

Conference of Independent Federal and State Data Protection Supervisory Authorities of Germany. Coordination body for Germany’s 17 DPAs (1 federal + 16 state). Issues joint resolutions and guidance on data protection topics.

De-identification

Anonymization & De-identification

Process of removing or obscuring personal identifiers from data. Under HIPAA, achievable via Expert Determination (statistical methods) or Safe Harbor (removing 18 identifier types). Broader term than anonymization in US regulatory context.

Dependency Parsing

NLP & AI Technologies

NLP task of analyzing the grammatical structure of a sentence by establishing relationships between words. Produces a tree showing which words modify which. Used to understand entity relationships in text.

Device Fingerprint

Data Types & Entities

Unique combination of device attributes (browser type, screen resolution, installed fonts, plugins, timezone) used to identify and track users without cookies. Considered personal data under GDPR. Difficult for users to prevent or detect.

Differential Privacy

DP

Anonymization & De-identification

Mathematical framework for quantifying privacy loss when releasing statistical information about a dataset. Provides provable guarantees that individual records cannot be distinguished regardless of auxiliary information. Parameterized by epsilon (ε) controlling the privacy-utility tradeoff.

Digital Markets Act

DMA

Regulations & Compliance

EU regulation targeting large online platforms designated as gatekeepers. Establishes obligations to ensure fair competition, interoperability, and data portability. Complements the DSA.

Digital Services Act

DSA

Regulations & Compliance

EU regulation establishing comprehensive rules for digital intermediary services including online platforms and search engines. Aims to create a safer digital space with accountability for platforms regarding illegal content, transparency in advertising, and algorithmic accountability.

Ed25519

Cryptography & Security

Edwards-curve Digital Signature Algorithm using Curve25519. Provides high-performance digital signatures with 128-bit security level. Used for authentication, code signing, and key exchange. Deterministic signatures prevent nonce-reuse vulnerabilities.

Electronic Frontier Foundation

EFF

Regulatory Bodies

US non-profit defending civil liberties in the digital world. Works on privacy, free expression, and innovation through litigation, policy analysis, grassroots activism, and technology development. Founded in 1990.

Electronic Privacy Information Center

EPIC

Regulatory Bodies

US non-profit research organization focused on emerging privacy and civil liberties issues. Files regulatory complaints, submits amicus briefs, and advocates for privacy legislation. Founded in 1994.

Email Address

Data Types & Entities

Electronic mail address that directly or indirectly identifies an individual. Always considered PII when it contains a personal name. Corporate email addresses typically qualify as personal data under GDPR.

Employee Data

Data Types & Entities

Personal data collected and processed in the employment context. Includes payroll information, performance reviews, health records, background checks, and communications monitoring. Subject to specific provisions under GDPR and national labor laws.

Encryption

Cryptography & Security

Process of converting plaintext data into ciphertext using an algorithm and key, making it unreadable without the corresponding decryption key. Fundamental mechanism for protecting data confidentiality at rest, in transit, and in use.

End-to-End Encryption

E2EE

Cryptography & Security

Encryption scheme where only the communicating parties can read the messages. Intermediate servers relay encrypted data without being able to decrypt it. Used in messaging (Signal Protocol), email (PGP), and zero-knowledge storage.

Enforcement & Penalties

Track: Enforcement

Research Framework

Research track tracking DPA enforcement actions, GDPR fines, regulatory patterns, and the effectiveness of different penalty regimes across jurisdictions.

ePrivacy Directive

ePD

Regulations & Compliance

EU directive on privacy and electronic communications (2002/58/EC), supplementing the GDPR for the electronic communications sector. Covers cookies, direct marketing, and confidentiality of communications. Being replaced by the proposed ePrivacy Regulation.

EU AI Act

Regulations & Compliance

European Union regulation establishing a comprehensive legal framework for artificial intelligence. Classifies AI systems by risk level (unacceptable, high, limited, minimal) with corresponding obligations. Includes bans on social scoring, real-time biometric identification (with exceptions), and manipulative AI.

EU-US Data Privacy Framework

DPF

Geopolitical

Framework adopted in July 2023 replacing the invalidated Privacy Shield for EU-US data transfers. Based on US Executive Order 14086 establishing safeguards for signals intelligence activities. Subject to periodic review and potential future legal challenges.

European Data Protection Board

EDPB

Regulatory Bodies

Independent EU body composed of representatives of national data protection authorities and the European Data Protection Supervisor. Ensures consistent application of GDPR across the EU, issues guidelines and binding decisions, and facilitates cooperation between national authorities.

European Data Protection Supervisor

EDPS

Regulatory Bodies

Independent supervisory authority responsible for ensuring EU institutions and bodies respect data protection rights. Also serves as advisor on data protection policy and legislation. Member of the EDPB.

Expert Determination

Anonymization & De-identification

One of two HIPAA de-identification methods. Requires a qualified statistical expert to determine that the risk of identifying an individual is very small using accepted statistical and scientific principles. Must document methods and results.

F1 Score

NLP & AI Technologies

Harmonic mean of precision and recall, providing a single metric for binary classification performance. Ranges from 0 to 1, where 1 is perfect. Standard metric for evaluating NER and PII detection accuracy.

Facial Recognition

Data Types & Entities

Biometric technology that identifies or verifies individuals by analyzing facial features from images or video. Processing facial recognition data typically constitutes processing of biometric data (special category) under GDPR. Regulated under EU AI Act as high-risk.

Family Educational Rights and Privacy Act

FERPA

Regulations & Compliance

US federal law protecting the privacy of student education records. Applies to schools receiving federal funding. Gives parents (and eligible students) rights to access and control education records.

Federal Trade Commission

FTC

Regulatory Bodies

US federal agency with broad authority over unfair and deceptive trade practices, including data privacy and security. Primary US privacy enforcer in the absence of comprehensive federal privacy law. Issues consent orders and imposes significant fines.

Federated Learning

FL

NLP & AI Technologies

Machine learning approach where a model is trained across multiple decentralized devices or servers holding local data samples, without exchanging raw data. Enables privacy-preserving collaborative learning. Proposed by Google in 2016.

Financial Data

Data Types & Entities

Personal data relating to an individual’s financial status, transactions, or accounts. Includes bank account numbers, credit card numbers, income, credit scores, and transaction histories. Protected under GLBA, PCI DSS, and GDPR.

Financial Privacy

Track: Financial

Research Framework

Research track examining privacy challenges in banking, payment processing, fintech, credit scoring, and financial data sharing. Covers GLBA, PCI DSS, and open banking regulations.

Five Eyes

Geopolitical

Intelligence alliance of Australia, Canada, New Zealand, United Kingdom, and United States. Relevant to privacy discussions around government surveillance, data sharing agreements, and the tension between national security and privacy rights.

Format-Preserving Encryption

FPE

Anonymization & De-identification

Encryption technique where the ciphertext has the same format (length, character set) as the plaintext. Useful for encrypting credit card numbers, SSNs, and other formatted data without changing database schemas or application logic.

Future of Privacy Forum

FPF

Regulatory Bodies

US non-profit think tank working to advance principled data practices. Brings together industry, academics, consumer advocates, and policymakers to explore privacy challenges and develop solutions.

GDPR Article 25

Article 25

Regulations & Compliance

GDPR provision requiring data protection by design and by default. Controllers must implement appropriate technical and organizational measures both at the time of determining the means for processing and at the time of processing itself.

GDPR Article 32

Article 32

Regulations & Compliance

GDPR provision requiring controllers and processors to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Explicitly mentions pseudonymization and encryption as examples.

GDPR Article 35

Article 35

Regulations & Compliance

GDPR provision requiring a Data Protection Impact Assessment when processing is likely to result in a high risk to the rights and freedoms of natural persons. Lists criteria including systematic evaluation, large-scale processing, and public area monitoring.

General Data Protection Regulation

GDPR

Regulations & Compliance

European Union comprehensive data protection regulation (2016/679) that governs the processing of personal data of individuals within the EU/EEA. Establishes rights for data subjects and obligations for data controllers and processors. Enforceable since May 25, 2018, with fines up to 4% of global annual turnover or €20M.

Generalization

Anonymization & De-identification

Anonymization technique that replaces specific values with broader categories. Examples: exact age → age range, full address → city only, precise timestamp → date only. Reduces granularity to prevent identification while preserving analytical utility.

Genetic Data

Data Types & Entities

Personal data relating to inherited or acquired genetic characteristics that give unique information about physiology or health. Obtained through biological sample analysis or equivalent. Special category under GDPR Article 9.

Gramm-Leach-Bliley Act

GLBA

Regulations & Compliance

US federal law requiring financial institutions to explain their information-sharing practices and safeguard sensitive data. Includes the Financial Privacy Rule, Safeguards Rule, and Pretexting Protection.

Hash-Based Message Authentication Code

HMAC

Cryptography & Security

Specific type of message authentication code involving a cryptographic hash function and a secret key. Provides both data integrity and authentication. Used in API authentication, token generation, and data verification.

Health & Genomic Privacy

Track: Health

Research Framework

Research track focused on privacy challenges in healthcare, genomic data, medical research, and health technology. Covers HIPAA, clinical data anonymization, and secondary use of health data.

Health Data

Data Types & Entities

Personal data related to physical or mental health of an individual, including provision of health services. Special category under GDPR Article 9. Includes medical records, prescription data, insurance claims, wearable device data, and genetic test results.

Health Information Technology for Economic and Clinical Health Act

HITECH Act

Regulations & Compliance

US law that expanded HIPAA enforcement and increased penalties for data breaches involving health information. Strengthened notification requirements and promoted electronic health record adoption.

Health Insurance Portability and Accountability Act

HIPAA

Regulations & Compliance

US federal law establishing national standards for the protection of Protected Health Information (PHI). Applies to covered entities (healthcare providers, health plans, clearinghouses) and their business associates. Includes the Privacy Rule, Security Rule, and Breach Notification Rule.

Homomorphic Encryption

HE

Cryptography & Security

Encryption scheme allowing computation on ciphertext that produces encrypted results matching operations performed on plaintext. Enables processing sensitive data without decryption. Fully homomorphic encryption (FHE) supports arbitrary computations but remains computationally expensive.

Hostile Defaults

Privacy Concepts

System settings that default to the least privacy-protective option, requiring users to actively opt out to protect their privacy. Exploits status quo bias and privacy fatigue. Violates the principle of privacy by default.

HTTPS

Cryptography & Security

HTTP over TLS. Encrypted version of HTTP that uses TLS to secure communication between web browsers and servers. Indicated by the padlock icon in browsers. Essential for protecting data in transit.

Hybrid Recognizer

Technical Architecture

PII detection approach combining multiple methods: rule-based pattern matching (regex), NLP-based named entity recognition, and machine learning classification. Achieves higher accuracy than any single method alone by leveraging complementary strengths.

Information Commissioner’s Office

ICO

Regulatory Bodies

UK’s independent data protection authority enforcing the UK GDPR and Data Protection Act 2018. Responsible for upholding information rights, promoting openness by public bodies, and data privacy for individuals.

International Association of Privacy Professionals

IAPP

Regulatory Bodies

Largest global information privacy community with over 75,000 members. Provides privacy certifications (CIPP, CIPM, CIPT), research, training, and professional networking. Maintains comprehensive privacy law tracker and DPA directory.

IP Address

Data Types & Entities

Numerical label assigned to devices connected to a computer network. Considered personal data under GDPR when it can be linked to an identifiable individual (dynamic IPs included per CJEU Breyer ruling). IPv4 (32-bit) and IPv6 (128-bit).

ISO 27701

Privacy Concepts

International standard extending ISO 27001 (information security management) to cover privacy information management. Provides a framework for establishing, implementing, and maintaining a Privacy Information Management System (PIMS).

JSON

Technical Architecture

JavaScript Object Notation — lightweight data interchange format. Human-readable text format for structured data. Used for API responses, configuration files, and data storage. Native to JavaScript but supported by all programming languages.

JSON-LD

Technical Architecture

JavaScript Object Notation for Linked Data. W3C standard for encoding structured data using JSON syntax with schema.org vocabulary. Used for SEO-friendly structured data in web pages (WebPage, FAQPage, Organization, BreadcrumbList schemas).

k-Anonymity

Anonymization & De-identification

Privacy model requiring that each record in a dataset is indistinguishable from at least k−1 other records with respect to quasi-identifiers. Protects against identity disclosure but vulnerable to homogeneity and background knowledge attacks.

Key Derivation Function

KDF

Cryptography & Security

Cryptographic function that derives one or more secret keys from a secret value (password, passphrase, or master key). Argon2id, PBKDF2, and scrypt are common KDFs. Used to convert user passwords into encryption keys.

l-Diversity

Anonymization & De-identification

Privacy model extending k-anonymity by requiring that each equivalence class has at least l distinct values for sensitive attributes. Addresses the homogeneity attack on k-anonymity.

Large Language Model

LLM

NLP & AI Technologies

AI model trained on massive text datasets that can generate, understand, and manipulate human language. Examples include GPT-4, Claude, Gemini, and Llama. Raises privacy concerns when trained on personal data.

Latin America

LatAm

Geopolitical

Geographic region comprising Central America, South America, and the Caribbean. Privacy landscape led by Brazil (LGPD), with Argentina, Uruguay, Chile, and Colombia having established frameworks. Growing alignment with GDPR standards.

Lawful Basis

Regulations & Compliance

One of six legal grounds required under GDPR Article 6 for processing personal data: consent, contract, legal obligation, vital interests, public interest, or legitimate interests. Processing without a lawful basis is unlawful.

Legitimate Interest

Regulations & Compliance

One of the six lawful bases under GDPR Article 6(1)(f) for processing personal data. Requires a balancing test weighing the controller’s or third party’s interests against the data subject’s rights. Requires documentation via a Legitimate Interest Assessment (LIA).

Lei Geral de Proteção de Dados

LGPD

Regulations & Compliance

Brazil’s comprehensive data protection law modeled on the GDPR. Applies to any processing of personal data in Brazil. Enforced by the ANPD (National Data Protection Authority). Effective September 2020.

Linkage Attack

Anonymization & De-identification

Re-identification technique combining anonymized data with external datasets to identify individuals. Exploits quasi-identifiers present in both datasets. Demonstrated famously by Sweeney linking Massachusetts health records with voter rolls.

Location Data

Data Types & Entities

Information indicating the geographic position of a device or individual. Includes GPS coordinates, cell tower data, Wi-Fi positioning, and IP geolocation. Considered personal data under GDPR when linkable to an individual. Regulated under the ePrivacy Directive.

MCP Server

Products & Ecosystem

Model Context Protocol server integration for anonym.legal providing 10 anonymization tools accessible from any MCP-compatible AI assistant (Claude, etc.). Enables programmatic PII detection and anonymization within AI workflows.

Metadata

Data Types & Entities

Data that describes other data. In privacy context, includes file properties (author, creation date, GPS coordinates in photos), email headers, and communication patterns. Often overlooked in anonymization but can reveal personal information.

Microaggregation

Anonymization & De-identification

Anonymization technique that groups records into clusters of at least k records and replaces values with cluster averages or representatives. Ensures k-anonymity for numerical quasi-identifiers while minimizing information loss.

Microsoft Presidio

Presidio

NLP & AI Technologies

Open-source framework by Microsoft for PII detection and anonymization. Provides both an analyzer (detection) and anonymizer (redaction/replacement) component. Supports custom recognizers and multiple NLP engines (spaCy, Stanza, transformers).

Middle East and North Africa

MENA

Geopolitical

Geographic region spanning from Morocco to Iran. Rapidly developing data protection legislation, with Bahrain, Qatar, UAE, and Egypt having enacted comprehensive privacy laws. Influenced by both European and US regulatory approaches.

Multilingual NLP

NLP & AI Technologies

NLP capabilities spanning multiple languages. Challenges include varying scripts, morphology, word order, and entity formats. Cross-lingual transfer learning (XLM-RoBERTa) enables models trained on resource-rich languages to work on resource-poor ones.

Named Entity Recognition

NER

NLP & AI Technologies

NLP task of identifying and classifying named entities in text into predefined categories such as person names, organizations, locations, dates, and monetary values. Critical for PII detection in anonymization pipelines.

National Identifier

Data Types & Entities

Government-issued identification number uniquely assigned to individuals within a jurisdiction. Examples include SSN (US), Steuer-ID (DE), NIR (FR), NI Number (UK), Aadhaar (IN), and MyNumber (JP). Critical PII category requiring highest protection.

National Institute of Standards and Technology

NIST

Regulatory Bodies

US federal agency that develops cybersecurity and privacy frameworks, standards, and guidelines. NIST Privacy Framework provides voluntary enterprise-level guidance for managing privacy risks. NIST 800-188 covers de-identification of government datasets.

Natural Language Processing

NLP

NLP & AI Technologies

Branch of artificial intelligence focused on enabling computers to understand, interpret, and generate human language. Core technology behind text anonymization, sentiment analysis, machine translation, and chatbots.

NIS2 Directive

NIS2

Regulations & Compliance

EU directive on measures for a high common level of cybersecurity across the Union. Expands scope of the original NIS Directive to more sectors and entities. Requires incident reporting, risk management, and supply chain security.

Noise Addition

Anonymization & De-identification

Anonymization technique that adds random values to data points to obscure individual contributions while preserving aggregate statistical properties. Core mechanism in differential privacy implementations.

Nordic Countries

Geopolitical

Denmark, Finland, Iceland, Norway, and Sweden. Known for high digital literacy and strong data protection traditions. Early adopters of electronic identification systems. Relevant for Personnummer-style national identifiers and Nordic DPA cooperation.

Numéro d’Inscription au Répertoire

NIR

Data Types & Entities

13-digit French national identification number (also called numéro de sécurité sociale). Encodes gender, year/month of birth, department, and commune. Used for social security, healthcare, and tax purposes.

Office Add-in

Products & Ecosystem

Microsoft Office integration enabling PII detection and anonymization within Word, Excel, and Outlook. Allows users to process documents and emails without leaving the Office environment.

Office for Civil Rights

HHS OCR

Regulatory Bodies

US Department of Health and Human Services division responsible for enforcing HIPAA. Investigates complaints, conducts compliance reviews, and provides education on health information privacy. Can impose civil monetary penalties and refer criminal cases to DOJ.

Office of the Australian Information Commissioner

OAIC

Regulatory Bodies

Australian federal privacy regulator responsible for enforcing the Privacy Act 1988 (including the Australian Privacy Principles). Handles complaints, conducts investigations, and promotes privacy awareness.

Optical Character Recognition

OCR

NLP & AI Technologies

Technology that converts images of text (scanned documents, photos) into machine-readable text. Often a preprocessing step before NLP-based anonymization of scanned documents. Tesseract is a widely-used open-source OCR engine.

Pain Point

Research Framework

Specific privacy problem, frustration, or unmet need identified through community research. anonym.community catalogs 1,478 pain points across 14 tracks with severity ratings, source attribution, and solution mapping.

Part-of-Speech Tagging

POS Tagging

NLP & AI Technologies

NLP task of labeling each word in a sentence with its grammatical category (noun, verb, adjective, etc.). Helps disambiguate named entities and improve NER accuracy.

Payment Card Industry Data Security Standard

PCI DSS

Regulations & Compliance

Global security standard for organizations handling branded credit cards. Mandates 12 requirements across 6 control objectives including network security, data protection, vulnerability management, access control, monitoring, and security policies.

PDF Anonymization

Anonymization & De-identification

Process of detecting and redacting PII from PDF documents including text layers, images, metadata, and embedded objects. Challenges include scanned documents (requiring OCR), multi-layer PDFs, and metadata leakage.

Personal Data

Data Types & Entities

Under GDPR, any information relating to an identified or identifiable natural person (data subject). Broader than PII — includes online identifiers, location data, and factors specific to physical, genetic, mental, economic, cultural, or social identity.

Personal Data Protection Act

PDPA

Regulations & Compliance

Data protection legislation adopted by several Asian jurisdictions including Singapore, Thailand, and Malaysia. Each variant establishes consent-based frameworks for personal data processing with varying enforcement mechanisms.

Personal Information Protection and Electronic Documents Act

PIPEDA

Regulations & Compliance

Canada’s federal private-sector privacy law governing the collection, use, and disclosure of personal information in commercial activity. Based on fair information principles. Being replaced by the proposed Consumer Privacy Protection Act (CPPA).

Personal Information Protection Commission

PPC

Regulatory Bodies

Japanese data protection authority responsible for enforcing the APPI (Act on the Protection of Personal Information). Issues guidelines, conducts investigations, and cooperates internationally on cross-border data protection.

Personal Information Protection Law

PIPL

Regulations & Compliance

China’s comprehensive personal information protection law. Governs the processing of personal information of natural persons within China. Imposes strict cross-border data transfer requirements and consent obligations. Effective November 1, 2021.

Personally Identifiable Information

PII

Data Types & Entities

Any information that can be used to identify a specific individual, directly or in combination with other data. Includes names, addresses, phone numbers, email addresses, SSNs, biometric data, and IP addresses. Definition varies by jurisdiction.

Personnummer

Data Types & Entities

Swedish personal identity number in YYMMDD-XXXX format. Assigned at birth or immigration. Contains gender indicator and check digit. Used extensively in Swedish society for identification, banking, healthcare, and government services.

PESEL

Data Types & Entities

11-digit Polish national identification number (Powszechny Elektroniczny System Ewidencji Ludności). Encodes date of birth, gender, and sequential number with check digit. Required for public services, healthcare, and banking.

Phone Number

Data Types & Entities

Telephone number that can identify or contact an individual. International format: +[country code][number]. Considered PII across all major privacy regulations. Often used as a secondary identifier for two-factor authentication.

PII & Anonymization Techniques

Track: PII & Anon

Research Framework

Research track covering core PII detection, anonymization methods, and technical implementation challenges. Includes regex-based detection, NER, hybrid approaches, and format-preserving techniques.

Precision

NLP & AI Technologies

Proportion of true positive results among all positive predictions. In PII detection: of all entities flagged as PII, what fraction actually is PII. High precision means few false positives.

Privacy by Default

Privacy Concepts

Principle that the strictest privacy settings should apply automatically without user intervention. Under GDPR Article 25(2), only personal data necessary for each specific purpose should be processed by default.

Privacy by Design

PbD

Privacy Concepts

Approach requiring privacy to be embedded into system design from the outset rather than added retrospectively. Codified in GDPR Article 25 as “data protection by design and by default.” Seven foundational principles formulated by Ann Cavoukian.

Privacy Engineering

Privacy Concepts

Discipline of systematically applying engineering principles to achieve privacy protection throughout the data lifecycle. Encompasses privacy requirements, design patterns, implementation techniques, testing, and verification.

Privacy Fatigue

Privacy Concepts

Psychological state where individuals become overwhelmed by the volume of privacy decisions, notices, and consent requests, leading to disengagement and automatic acceptance. Results in reduced exercise of privacy rights.

Privacy Impact Assessment

PIA

Privacy Concepts

Broader term for systematic evaluation of privacy risks associated with a project, system, or process. Predates GDPR’s DPIA requirement. Used in many jurisdictions and frameworks to identify and mitigate privacy risks proactively.

Privacy Notice

Privacy Concepts

Document informing data subjects about how their personal data is collected, used, stored, and shared. GDPR Articles 13–14 specify required information including controller identity, purposes, lawful basis, retention period, and data subject rights.

Privacy Shield

Regulations & Compliance

Former framework for transatlantic exchanges of personal data between the EU and US. Invalidated by the CJEU in Schrems II (2020). Succeeded by the EU-US Data Privacy Framework (2023).

Privacy-Enhancing Technologies

PETs

Privacy Concepts

Broad category of technologies that protect personal data by minimizing collection, preventing unnecessary processing, and enabling privacy-preserving operations. Includes encryption, anonymization, differential privacy, federated learning, and secure computation.

Problem Domain

Research Framework

Broad area of privacy challenges encompassing related pain points and structural drivers. Organized by context (healthcare, finance, education) or mechanism (re-identification, cross-border, enforcement).

Profiling

Privacy Concepts

Automated processing of personal data to evaluate, analyze, or predict aspects of an individual’s behavior, preferences, health, economic situation, location, or movements. Subject to GDPR Article 22 restrictions when producing legal or similarly significant effects.

Protected Health Information

PHI

Data Types & Entities

Under HIPAA, individually identifiable health information held or transmitted by a covered entity or business associate. Includes medical records, lab results, insurance information, and any health data linkable to an individual.

Pseudonymization

Anonymization & De-identification

Replacing directly identifying data with artificial identifiers (pseudonyms) while maintaining a mapping table for re-identification. Under GDPR, pseudonymized data remains personal data. Provides a security measure but not anonymization.

Purpose Limitation

Privacy Concepts

GDPR principle (Article 5(1)(b)) requiring that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. Core data protection principle.

PyInstaller

Technical Architecture

Tool for packaging Python applications into standalone executables. Bundles the Python interpreter, libraries, and application code into a single directory or file. Used to create the Presidio sidecar binary in anonym.plus.

Python

Technical Architecture

High-level programming language widely used in data science, NLP, and machine learning. Used for the Presidio sidecar in anonym.plus. Rich ecosystem of NLP libraries (spaCy, Stanza, transformers).

Quasi-Identifier

QI

Anonymization & De-identification

Attributes that are not unique identifiers alone but can be combined to uniquely identify individuals. Examples: ZIP code + date of birth + gender can uniquely identify 87% of the US population (Sweeney, 2000). Key concept in k-anonymity.

Re-identification

Anonymization & De-identification

Process of matching anonymized or de-identified data back to specific individuals using auxiliary information. Demonstrates that supposed anonymization was insufficient. Motivates stronger privacy techniques like differential privacy.

Re-identification Risks

Track: Re-identification

Research Framework

Research track analyzing methods and risks of re-identifying individuals from supposedly anonymous data. Covers linkage attacks, inference attacks, and the limits of anonymization techniques.

Recall

NLP & AI Technologies

Proportion of actual positives correctly identified. In PII detection: of all actual PII in the text, what fraction was detected. High recall means few false negatives (missed PII).

Record of Processing Activities

ROPA

Privacy Concepts

Documentation required under GDPR Article 30 that controllers and processors must maintain. Must include purposes of processing, data categories, recipients, transfers, retention periods, and security measures. Exemption for organizations with fewer than 250 employees (with exceptions).

Regex Engine

Technical Architecture

Software component that evaluates regular expressions against input text. Implementations vary in features and performance (backtracking NFA vs. DFA). Used in PII detection for structured patterns like phone numbers, emails, and national IDs.

Regular Expression

Regex

NLP & AI Technologies

Sequence of characters defining a search pattern for string matching. Used in rule-based PII detection for structured patterns like phone numbers, email addresses, credit card numbers, and national IDs.

Reinforcement Cycle

Research Framework

Pattern where multiple structural drivers mutually amplify each other, creating self-sustaining privacy problems. Example: regulatory complexity → compliance costs → enforcement gaps → reduced trust → more regulation.

Research Track

Research Framework

One of 14 thematic categories used by anonym.community to organize privacy problem analysis. Each track focuses on a specific domain of privacy challenges with dedicated pain points and structural drivers.

REST API

Products & Ecosystem

Representational State Transfer Application Programming Interface provided by anonym.legal for programmatic access to anonymization services. Enables integration with third-party applications, pipelines, and workflows.

Reversible Anonymization

Anonymization & De-identification

Anonymization approach that allows authorized re-identification using encryption keys or mapping tables. Enables workflows where data must be de-identified for processing but later re-identified by authorized parties. Core feature of anonym.legal.

Right of Access

Privacy Concepts

Data subject right under GDPR Article 15 to obtain confirmation whether their personal data is being processed and, if so, access to the data and supplementary information including purposes, categories, recipients, and retention periods.

Right to be Forgotten

RTBF

Privacy Concepts

Concept originating from the 2014 CJEU Google Spain ruling requiring search engines to delist results about individuals under certain conditions. Codified more broadly in GDPR Article 17 as the right to erasure.

Right to Erasure

Privacy Concepts

Data subject right under GDPR Article 17 (also known as “right to be forgotten”) to request deletion of personal data when it is no longer necessary, consent is withdrawn, or processing is unlawful. Subject to exceptions for legal obligations and public interest.

Right to Object

Privacy Concepts

Data subject right under GDPR Article 21 to object to processing based on legitimate interests or public interest, including profiling. For direct marketing, the right is absolute. Controller must stop processing unless demonstrating compelling legitimate grounds.

robots.txt

Technical Architecture

Text file at the root of a website that tells search engine crawlers which pages to crawl or not crawl. Standard protocol for web crawler access control. Can also specify sitemap location and crawl-delay directives.

Rust

Technical Architecture

Systems programming language focused on safety, concurrency, and performance. Used in anonym.plus (Tauri backend), security-critical components, and high-performance data processing. Memory safety without garbage collection.

Safe Harbor Method

Safe Harbor

Anonymization & De-identification

One of two HIPAA de-identification methods. Requires removal of 18 specified identifiers (names, geographic data smaller than state, dates except year, phone numbers, etc.) and that the covered entity has no actual knowledge that remaining information could identify an individual.

Schema.org

Technical Architecture

Collaborative vocabulary for structured data on the web. Founded by Google, Microsoft, Yahoo, and Yandex. Provides types and properties for describing entities (Organization, Person, WebPage, FAQPage, DefinedTerm) in JSON-LD, Microdata, or RDFa.

Schrems II

Regulations & Compliance

2020 CJEU ruling (Case C-311/18) that invalidated the EU-US Privacy Shield framework for transatlantic data transfers. Confirmed SCCs remain valid but require supplementary measures. Named after Austrian privacy activist Max Schrems.

Sector-Specific Regulations

Track: Sector Regulations

Research Framework

Research track covering industry-specific privacy rules beyond general data protection laws. Includes healthcare (HIPAA), financial (GLBA), education (FERPA), telecommunications, and emerging sector-specific AI regulations.

Secure Multi-Party Computation

SMPC

Cryptography & Security

Cryptographic protocol enabling multiple parties to jointly compute a function over their inputs while keeping those inputs private. No party learns anything except the output. Used in privacy-preserving analytics, auctions, and machine learning.

Sensitive Personal Information

SPI

Data Types & Entities

Category of personal data requiring heightened protection. Under GDPR Article 9: racial/ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, and sexual orientation. Processing generally prohibited except under specific conditions.

Sentiment Analysis

NLP & AI Technologies

NLP task of determining the emotional tone or opinion expressed in text. Categories typically include positive, negative, and neutral. Used in social media monitoring, customer feedback analysis, and market research.

SEO

Technical Architecture

Search Engine Optimization — practices for improving website visibility in search engine results. Includes technical aspects (structured data, sitemaps, meta tags) and content aspects (keyword optimization, quality content). JSON-LD structured data enhances SEO.

Severity Rating

Research Framework

Classification system used by anonym.community to prioritize pain points: Critical (immediate regulatory/security risk), High (significant operational impact), Medium (notable friction), Low (minor inconvenience).

Sidecar Process

Sidecar

Technical Architecture

Auxiliary process running alongside a main application to provide supplementary functionality. In anonym.plus, a Python-based Presidio sidecar handles NLP processing while the Rust-based Tauri main process manages the UI and encryption.

Sitemap

Technical Architecture

XML file listing URLs on a website to help search engines discover and index content. Includes metadata like last modification date, change frequency, and priority. Submitted to search engines via robots.txt or search console.

Social Security Number

SSN

Data Types & Entities

Nine-digit identification number issued by the US Social Security Administration. Primary individual identifier in the US for tax, employment, and benefits purposes. One of the most sensitive PII elements due to identity theft risk.

Solution Finder

Research Framework

Interactive tool on anonym.community that helps users identify the appropriate anonymization approach based on their specific requirements, jurisdiction, data type, and use case.

Solutions & Market Landscape

Track: Solutions

Research Framework

Research track surveying the privacy technology market, comparing anonymization tools, and analyzing adoption patterns, pricing models, and feature gaps in existing solutions.

Source Attribution

Research Framework

Documentation of where each pain point, finding, or data point was identified. Sources include Reddit communities, Discord servers, academic papers, enforcement databases, and professional forums.

spaCy

NLP & AI Technologies

Industrial-strength NLP library in Python. Provides pre-trained models for tokenization, POS tagging, NER, dependency parsing, and more in 70+ languages. Used as a backend NLP engine in anonymization tools like Presidio.

Standard Contractual Clauses

SCCs

Regulations & Compliance

Pre-approved contractual terms adopted by the European Commission for transferring personal data from the EU/EEA to third countries. Provide appropriate safeguards under GDPR Article 46(2)(c) as an alternative to adequacy decisions.

Stanza

NLP & AI Technologies

NLP library developed by Stanford NLP Group. Provides pre-trained models for 70+ languages with tokenization, POS tagging, NER, dependency parsing, and sentiment analysis. Offers high accuracy multilingual NER.

Steuer-Identifikationsnummer

Steuer-ID

Data Types & Entities

11-digit tax identification number assigned to every person registered in Germany. Permanent lifetime identifier used for tax administration. German equivalent of SSN for tax purposes.

Storage Limitation

Privacy Concepts

GDPR principle (Article 5(1)(e)) requiring that personal data be kept in identifiable form for no longer than necessary for the purposes of processing. Requires data retention policies and regular review.

Structural Driver

Research Framework

Systemic factor that creates, amplifies, or sustains privacy pain points across multiple contexts. Identified through cross-referencing community research across Reddit, Discord, and academic sources. anonym.community tracks 98 structural drivers across 14 research tracks.

Structured Data

Technical Architecture

Machine-readable information embedded in web pages that helps search engines understand content. Formats include JSON-LD (recommended), Microdata, and RDFa. Enables rich results in search engines and knowledge graph integration.

Student Data

Data Types & Entities

Educational records and personal information of students. Protected under FERPA in the US and GDPR in the EU. Includes grades, attendance, disciplinary records, special education status, and demographic information.

Subject Access Request

SAR

Privacy Concepts

Formal request by a data subject exercising their right of access under GDPR Article 15. Controllers must respond within one month (extendable by two months for complex requests). Must be provided free of charge.

Suppression

Anonymization & De-identification

Anonymization technique that removes data values entirely. Can be applied at the record level (removing entire rows), attribute level (removing columns), or cell level (removing individual values). Most aggressive anonymization approach.

Symmetric Encryption

Cryptography & Security

Cryptographic system using the same key for both encryption and decryption. Faster than asymmetric encryption but requires secure key exchange. AES is the most widely used symmetric cipher.

Synthetic Data

Anonymization & De-identification

Artificially generated data that preserves statistical properties and patterns of real data without containing actual personal information. Created using generative models (GANs, VAEs, diffusion models). Used for testing, training, and sharing without privacy risk.

t-Closeness

Anonymization & De-identification

Privacy model extending l-diversity by requiring the distribution of sensitive attributes in each equivalence class to be within distance t of the overall distribution. Uses Earth Mover’s Distance as the distance metric.

Tauri

Technical Architecture

Framework for building lightweight, secure desktop applications using web technologies (HTML, CSS, JavaScript) with a Rust backend. Uses the system’s webview instead of bundling Chromium, resulting in smaller binary sizes than Electron. Used by anonym.plus.

Text Classification

NLP & AI Technologies

NLP task of assigning predefined categories or labels to text documents. Includes spam detection, topic categorization, language identification, and content moderation. Often uses transformer-based models.

Tokenization

Anonymization & De-identification

Replacing sensitive data with non-sensitive substitutes (tokens) that retain essential format characteristics. Unlike encryption, tokens have no mathematical relationship to the original data. Used in payment processing (PCI DSS) and data anonymization.

Tokenization (NLP)

NLP & AI Technologies

Process of splitting text into smaller units (tokens) such as words, subwords, or characters. First step in most NLP pipelines. Subword tokenization (BPE, WordPiece, SentencePiece) handles unknown words and morphological variation.

Tracking

Data Types & Entities

Monitoring user behavior across websites, apps, or devices for analytics, advertising, or profiling purposes. Methods include cookies, device fingerprints, pixels, and link decoration. Subject to consent requirements under ePrivacy Directive and GDPR.

Transformer

NLP & AI Technologies

Neural network architecture based on self-attention mechanisms, introduced in the paper "Attention Is All You Need" (2017). Foundation of modern LLMs including GPT, BERT, and T5. Enables parallel processing of sequences unlike RNNs.

Transparency

Privacy Concepts

GDPR principle (Article 5(1)(a)) requiring that personal data be processed lawfully, fairly, and in a transparent manner. Data subjects must be able to understand how their data is processed in clear, plain language.

Transport Layer Security

TLS

Cryptography & Security

Cryptographic protocol providing secure communication over networks. Successor to SSL. TLS 1.3 (2018) reduces handshake latency and removes obsolete cipher suites. Provides confidentiality, integrity, and authentication for data in transit.

Trusted Execution Environment

TEE

Cryptography & Security

Secure area within a processor that guarantees code and data loaded inside are protected with respect to confidentiality and integrity. Intel SGX, ARM TrustZone, and AMD SEV are implementations. Used for confidential computing.

United Kingdom General Data Protection Regulation

UK GDPR

Regulations & Compliance

The UK’s post-Brexit version of the EU GDPR, retained as domestic law via the European Union (Withdrawal) Act 2018. Supplemented by the UK Data Protection Act 2018. Enforced by the ICO.

User Behavior & Consent

Track: User Behavior

Research Framework

Research track examining how users interact with privacy controls, consent mechanisms, and privacy settings. Covers dark patterns, privacy fatigue, and the gap between stated and actual privacy preferences.

Virginia Consumer Data Protection Act

Virginia CDPA

Regulations & Compliance

US state privacy law providing Virginia consumers with data rights including access, correction, deletion, portability, and opt-out. Effective January 1, 2023.

Web App

Products & Ecosystem

Browser-based interface for anonym.legal accessible at https://anonym.legal. Requires no installation. Processes data client-side with zero-knowledge architecture ensuring no plaintext data reaches the server.

WebAssembly

Wasm

Technical Architecture

Binary instruction format designed as a portable compilation target for high-level languages. Enables near-native performance in web browsers. Potential for client-side anonymization processing without server round-trips.

Webhook

Technical Architecture

HTTP callback mechanism where a server sends real-time notifications to a specified URL when events occur. Used for asynchronous integrations, event-driven architectures, and automated workflows.

XLM-RoBERTa

XLM-R

NLP & AI Technologies

Cross-lingual pre-trained transformer model by Meta AI. Trained on 2.5TB of CommonCrawl data in 100 languages. State-of-the-art performance on cross-lingual NER, classification, and question answering. Used for multilingual PII detection.

Zero-Knowledge Architecture

ZKA

Cryptography & Security

System design where the service provider has no ability to access user data in plaintext. All encryption/decryption occurs client-side with keys derived from user credentials that never leave the device. The server only stores encrypted blobs.