What the industry's words mean, in plain English

When a contract, a standard or a guide uses a term you do not know, this page says what it means.

72-hour rule: The 72-hour rule is the UK GDPR time limit for reporting a personal data breach to the UK regulator. You must report without undue delay and, where feasible, within 72 hours of becoming aware of it. You do not need to report a breach that is unlikely to put people's rights and freedoms at risk. If you report after 72 hours, you must give the reasons for the delay.
AI assurance: AI assurance is checking whether an AI system works as intended and meets the rules and standards that apply to it. It includes audits, conformity assessments and bias testing. When a product is described as assured, it helps to ask who assured it and against what standard.
AI governance: AI governance is how an organisation manages its use of artificial intelligence: its policies, roles, registers and controls. It can be as small as a basic AI policy and a list of tools. It can be as large as a management system certified to ISO/IEC 42001.
AI policy: An AI policy is a document that says which uses of AI an organisation allows, what data may go into which tools, and who approves them. In a UK government survey, 17% of UK businesses that use AI said they have a policy or guidelines for it.
AIGP: Artificial Intelligence Governance Professional, the IAPP's credential for AI governance. You can check that a person holds it by contacting the IAPP with the certificate number.
Automated decision-making (Article 22): Automated decision-making means decisions about a person made by computer, with no meaningful human involvement, that have a legal or similarly significant effect on them. From 5 February 2026, the UK's Data (Use and Access) Act 2025 replaced the UK GDPR rules on these decisions. The new rules allow most of them, with safeguards. You must tell the person about the decision, and let them comment, ask for a human to step in and challenge it.
Certification body: A certification body is an organisation that audits a management system against a standard, such as ISO/IEC 42001, and issues the certificate. Under impartiality rules, an accredited certification body must not also offer consultancy on management systems. So the firm that prepares you and the body that certifies you are different organisations.
CIPM: Certified Information Privacy Manager, the IAPP's credential for running a privacy programme in practice (governance, operations, metrics).
CIPP/E: Certified Information Privacy Professional/Europe, the IAPP's credential for knowledge of European data protection law. You can check that a person holds it by contacting the IAPP with the certificate number.
CREST: CREST is a not-for-profit body that accredits security firms for services such as penetration testing and incident response. Like UKAS, it accredits the firms that do the work, not their clients. You can check a firm's accreditation on CREST's own marketplace.
Cyber Essentials: Cyber Essentials is the UK government-backed certification scheme for basic cyber security, developed by the NCSC and delivered by IASME, its delivery partner. It covers five technical controls. You answer a self-assessment, a board member or equivalent signs it off, and an assessor marks it.
Cyber Essentials Plus: Cyber Essentials Plus is the higher level of the UK's Cyber Essentials scheme: the same five controls, with an extra independent test of your systems to check that the controls work in practice. A contract may ask for either level, so it helps to check which one it names.
Cyber insurance: Cyber insurance is a policy that pays some of the costs of a cyber attack, such as response and recovery, and sometimes claims from others. Many policies set security controls you must have in place for a claim to pay, so it helps to read those terms. The policy pays costs. Your duties under UK GDPR stay with you.
Data (Use and Access) Act 2025 (DUAA): The Data (Use and Access) Act 2025 (DUAA) is a UK law that received Royal Assent on 19 June 2025. It changes UK data protection law in stages. One change, from 5 February 2026, is to the UK GDPR rules on decisions made by computer.
Data protection officer (DPO): A data protection officer (DPO) is the person who advises an organisation on data protection and checks that it complies. The DPO is also the contact point for the UK regulator and for the people whose data the organisation uses. UK law makes you appoint one in three cases. You are a public body, you track people at scale, or you handle sensitive data at scale. An employee or an outside provider can fill the role.
Digital Omnibus: The Digital Omnibus is a set of EU proposals, made on 19 November 2025, to simplify the EU's digital rules. Its AI part, the AI Omnibus, came into force on 27 July 2026. It moved the EU AI Act's high-risk dates to 2 December 2027 and 2 August 2028, so older advice may give earlier dates.
DPIA: A DPIA, or data protection impact assessment, is a check that UK GDPR requires before you start processing that is likely to result in a high risk to people's rights and freedoms. It describes the processing, weighs its necessity and risks, and sets out the steps you will take to reduce them.
DPO-as-a-service (outsourced DPO): DPO-as-a-service, or an outsourced DPO, means filling the DPO role through a contract with an outside provider, rather than with an employee. UK GDPR allows this. The same rules apply either way: the DPO must be independent, have the right expertise and be easy to reach.
EU AI Act: The EU AI Act is the EU's law on artificial intelligence, in force since 1 August 2024 and applying in stages. Bans on certain AI practices have applied since 2 February 2025, and transparency rules since August 2026. High-risk rules start on 2 December 2027 for listed areas and on 2 August 2028 for AI built into products. It can reach a UK business whose AI, or its output, is used in the EU.
GPAI: General-purpose AI, the EU AI Act's term for AI models that can do a wide range of tasks. Rules for the providers of these models have applied since 2 August 2025.
High-risk AI system: A high-risk AI system, under the EU AI Act, is AI used in sensitive areas, such as hiring, credit scoring, education and safety parts of products. It must meet strict duties before it goes on the market, including risk assessment, data quality, documentation and human oversight. The rules start on 2 December 2027 for listed areas and on 2 August 2028 for AI built into products.
IAPP: The International Association of Privacy Professionals, a not-for-profit professional body for people who work in privacy and AI governance. It awards certifications to individuals, including CIPP/E, CIPM, CIPT and AIGP. To check that a person holds one, contact its customer support team with the certificate number.
ICO: The ICO is the UK's data protection regulator. It was the Information Commissioner's Office until 30 September 2026, when it became the Information Commission, and it is still known as the ICO. It does the same work, such as enforcing UK GDPR and receiving breach reports.
Incident response retainer: An incident response retainer is an arrangement paid in advance, so that a response team is ready to help if you are attacked. The contract sets out how fast the team responds and in which hours, so it helps to read that clause. Some retainers let you use the fee as hours of work, and some do not.
ISO/IEC 27001: ISO/IEC 27001 is the international standard for managing information security in an organisation. UKAS accredits certification bodies to audit organisations against it and issue certificates.
ISO/IEC 27701: ISO/IEC 27701 is the international standard for managing privacy information, meaning how an organisation handles personal data. UKAS accredits certification bodies to audit organisations against it and issue certificates.
ISO/IEC 42001: ISO/IEC 42001 is the international standard for managing AI in an organisation, through its policies, roles, risks and controls. It was published in 2023 and works for AI the way ISO/IEC 27001 works for information security. A certification body can audit you against it. UKAS accredits each body for named standards, so check that a body is accredited for ISO/IEC 42001 itself.
Managed security service provider (MSSP): A managed security service provider (MSSP) is a firm that runs security controls for you on an ongoing basis, such as monitoring, alerts and often patching. It is a subscription with people attached, closer to the software products on this site than to the advisory firms. That matters when you compare a monthly fee with the price of a piece of advice.
NCSC: The UK's National Cyber Security Centre, part of GCHQ. It publishes advice and guidance, and it helps organisations recover from cyber attacks. It also checks firms against its own standards for some services, such as security consultancy, penetration testing and incident response. Its website lists the firms that meet them.
NIST AI RMF: The US National Institute of Standards and Technology's AI Risk Management Framework, released in January 2023. It helps organisations manage the risks of AI. It is for voluntary use and has no legal force in the UK.
Penetration test: A penetration test is an authorised attempt to break into a system, to find the weaknesses a real attacker could use. Each test covers a set scope on a set date. So when a supplier mentions a test, it helps to know what it covered and when it ran. It also helps to know who did it and what was fixed afterwards.
Personal data breach: A personal data breach is a breach of security that leads to personal data being destroyed, lost or altered, or disclosed or accessed without authority. It counts whether it happens by accident or unlawfully. You must keep a record of every breach. You must report one to the UK regulator unless it is unlikely to put people's rights and freedoms at risk.
PI insurance: PI insurance, or professional indemnity insurance, covers an adviser if a client claims that the adviser's advice or work caused it a loss. Some firms state on their website whether they hold it and the amount of cover. If a firm does not, you can ask.
Ransomware: Ransomware is malicious software that locks your files by encrypting them, so you cannot use your systems or data. The attackers then ask for payment, and they may also copy your data and threaten to leak it. If the attack reaches personal data, it is usually a personal data breach under UK GDPR as well.
ROPA: Record of processing activities (UK GDPR Article 30), the register of what personal data an organisation processes, why, and with whom it is shared. Part of the compliance record that belongs to you and travels with you when switching provider.
Security operations centre (SOC): A security operations centre (SOC) is the team and tools that watch for attacks and respond to them. An organisation can run its own or buy one as a service from a managed security service provider (MSSP). It is a different thing from SOC 2, which is an audit report.
Shadow AI: Shadow AI is staff using AI tools for work, often free public ones, without the organisation knowing or checking them. A basic AI policy deals with this first, by naming the tools staff may use and the data that may go into them.
SOC 2: SOC 2 is a US audit report on a supplier's controls, not a certificate, written by an accountancy firm to standards set by the AICPA. A Type 1 report checks how the controls were designed on one date. A Type 2 report also checks how they worked over a period. It can cover security, availability, processing integrity, confidentiality and privacy, so ask which type, period and areas a supplier's report covers.
Special-category data: Special-category data is personal data that UK GDPR protects more strictly, such as data about health, racial or ethnic origin, religious beliefs, sexual orientation or biometrics. You need an extra legal condition to use it. If your core work uses it at large scale, UK law makes you appoint a DPO.
Subject access request (SAR): A subject access request (SAR) is how a person uses their right to ask whether you use their personal data. They can also get a copy of it, with supporting information such as why you use it. If an outside provider handles these requests for you, check how its fee treats them.
Supplier assurance questionnaire: A supplier assurance questionnaire is the security questionnaire a customer sends you before it buys from you, or that you send to a supplier before you buy. For a smaller organisation, it can be the first time anyone asks for a certificate, a set of policies or evidence of its controls. Answers usually need evidence behind them, such as a policy, a certificate or a test report.
UK GDPR: UK GDPR is the UK's version of the EU General Data Protection Regulation. It sits alongside the UK's Data Protection Act 2018, and together they form the core of UK data protection law. The Data (Use and Access) Act 2025 amended it, and the UK regulator enforces it.
UKAS: The United Kingdom Accreditation Service, the UK's national accreditation body. It checks that certification bodies are competent to certify against named standards. Its public search shows which bodies it accredits, and for which standards.

Sources

UK GDPR Article 33, checked 29 September 2026
business data survey, checked 29 September 2026
AIGP, checked 29 September 2026
certification FAQ, checked 29 September 2026
SI 2026/82, checked 29 September 2026
section 80, checked 29 September 2026
European Accreditation, checked 29 September 2026
CIPP/E, checked 29 September 2026
website, checked 29 September 2026
marketplace, checked 29 September 2026
NCSC, checked 29 September 2026
Act, checked 29 September 2026
UK GDPR Articles 37 to 39, checked 29 September 2026
AI Omnibus notice, checked 29 September 2026
UK GDPR Article 35, checked 29 September 2026
European Commission, checked 29 September 2026
AI Act Service Desk, checked 29 September 2026
about, checked 29 September 2026
UK commencement regulations, S.I. 2026/1015, checked 2 October 2026
the ICO, checked 2 October 2026
UKAS, checked 29 September 2026
AI management systems, checked 29 September 2026
first accreditation, checked 29 September 2026
about, checked 29 September 2026
assured services, checked 29 September 2026
NIST, checked 29 September 2026
Article 4, checked 29 September 2026
NCSC, checked 29 September 2026
trust services criteria, checked 29 September 2026
notes on SOC reports, checked 29 September 2026
Article 9, checked 29 September 2026
UK GDPR Article 15, checked 29 September 2026
Data Protection Act 2018, checked 29 September 2026
about, checked 29 September 2026
search, checked 29 September 2026