DataRidge
LightNews LightNews
banner
dataridge.org
DataRidge
@dataridge.org
34 followers 38 following 33 posts
Precise guidance on data protection, governance, and privacy compliance.
Glossary, vendor directory and webinars at dataridge.org
Posts Replies Media Videos
Pinned
dataridge.org
DataRidge @dataridge.org · 20d
DataRidge: Precise guidance on data protection, governance, and privacy compliance.

Here we share terms from our glossary, plus our vendor directory and webinars.

dataridge.org

#DataProtection #privacy
dataridge.org
A Reprimand Isn't a Fix: Lessons From Staffordshire Police

#DataProtection #privacy
A Reprimand Isn't a Fix: Lessons From Staffordshire Police
Staffordshire Police's data breach exposed a domestic abuse victim’s address, showing that ICO reprimands without fines may not prevent sensitive data risks.
dataridge.org
November 2, 2026 at 8:06 PM
dataridge.org
Term of the day: AI Governance

AI governance is the set of policies, standards, controls, and oversight processes an organization uses to guide how it develops, deploys, and monitors artificial intelligence...

Full definition: dataridge.org/glossary/ai-governance

#DataProtection #privacy
AI Governance. AI governance is the set of policies, standards, controls, and oversight processes an organization uses to guide how it develops, deploys, and monitors artificial intelligence systems. Its aim is generally to support AI use that is safe, fair, ethical, and accountable, with defined responsibility for decisions about those systems. It is an organizational discipline rather than a single tool or regulation.
November 2, 2026 at 4:08 PM
dataridge.org
Which Vendor Oversight Model Fits Your Citizen Data?

#DataProtection #privacy
Which Vendor Oversight Model Fits Your Citizen Data?
Explore how local governments can select vendor oversight models to protect citizen data, balancing risk, legal compliance, and monitoring for breach prevention.
dataridge.org
November 1, 2026 at 8:05 PM
dataridge.org
Term of the day: 72-Hour Notification

A 72-hour notification is a requirement to report a defined event, such as a data breach, to a designated authority within 72 hours of becoming aware of it. The specific...

Full definition: dataridge.org/glossary/72-hour-notification

#DataProtection #privacy
72-Hour Notification. A 72-hour notification is a requirement to report a defined event, such as a data breach, to a designated authority within 72 hours of becoming aware of it. The specific meaning, who must report, and what triggers the clock depend entirely on the applicable regime, and the term is also used outside the privacy field in unrelated contexts such as certain U.S. Department of Veterans Affairs emergency care processes. Because the term appears across very different rules, the precise obligation should always be confirmed against the governing instrument.
November 1, 2026 at 4:07 PM
dataridge.org
Term of the day: ePrivacy Directive

The ePrivacy Directive is a European Union law that sets privacy rules specifically for electronic communications, covering areas such as cookies, unsolicited marketing...

Full definition: dataridge.org/glossary/eprivacy-directive

#DataProtection #privacy
ePrivacy Directive. The ePrivacy Directive is a European Union law that sets privacy rules specifically for electronic communications, covering areas such as cookies, unsolicited marketing emails (spam), and communications traffic data. It works alongside broader EU data protection rules rather than replacing them. Because it is a directive, its requirements are applied through the national laws of individual EU member states, so specific rules can vary from country to country.
October 31, 2026 at 3:07 PM
dataridge.org
Japan's Breach Epidemic: What 2.5 Million Exposed Records Tell You About Detection Lag

#DataProtection #privacy
Japan's Breach Epidemic: What 2.5 Million Exposed Records Tell You About Detection Lag
Japan's telecom breaches exposed millions of records, revealing critical detection delays and third-party risks that amplify data exposure and phishing threats.
dataridge.org
October 30, 2026 at 7:06 PM
dataridge.org
Term of the day: Zero-Knowledge Proof

A zero-knowledge proof is a cryptographic method that lets one party (the prover) convince another party (the verifier) that a particular statement is true without...

Full definition: dataridge.org/glossary/zero-knowledge-proof

#DataProtection #privacy
Zero-Knowledge Proof. A zero-knowledge proof is a cryptographic method that lets one party (the prover) convince another party (the verifier) that a particular statement is true without revealing any information beyond the fact that the statement is true. For example, it can allow someone to demonstrate they know a secret, or that a claim holds, without disclosing the secret or the underlying data itself. It is generally classified as a tool within privacy-enhancing cryptography rather than a compliance control in its own right.
October 30, 2026 at 3:09 PM
dataridge.org
University Breach Response: The 72-Hour Checklist

#DataProtection #privacy
University Breach Response: The 72-Hour Checklist
This checklist details the critical 72-hour steps universities must take after a data breach to comply with GDPR and protect sensitive information.
dataridge.org
October 29, 2026 at 7:05 PM
dataridge.org
Term of the day: Vital Interests

Vital interests is one of the legal grounds an organization can rely on to process someone's personal data under the GDPR, but it applies only in situations that are essential to...

Full definition: dataridge.org/glossary/vital-interests

#DataProtection #privacy
Vital Interests. Vital interests is one of the legal grounds an organization can rely on to process someone's personal data under the GDPR, but it applies only in situations that are essential to protect a person's life. In practice it generally covers matters of life and death, such as an emergency where processing is needed to protect someone who cannot give consent. It is intended to be a narrow basis and is not appropriate for routine processing.
October 29, 2026 at 3:09 PM
dataridge.org
Research Platforms Keep Making the Same Output Control Mistakes

#DataProtection #privacy
Research Platforms Keep Making the Same Output Control Mistakes
Research platforms repeatedly fail output controls, risking sensitive health data. Manual reviews, clear authority, and sanctions are vital to prevent breaches.
dataridge.org
October 28, 2026 at 7:05 PM
dataridge.org
Term of the day: Virginia Consumer Data Protection Act

The Virginia Consumer Data Protection Act (VCDPA) is a comprehensive state privacy law that gives people in Virginia more control over...

Full definition: dataridge.org/glossary/virginia-consumer-data-protection-act

#DataProtection #privacy
Virginia Consumer Data Protection Act. The Virginia Consumer Data Protection Act (VCDPA) is a comprehensive state privacy law that gives people in Virginia more control over their personal data and was enacted in 2021. It lets Virginia consumers make certain requests about their data, such as confirming whether a business is processing it, and requires businesses handling that data to protect it. It applies specifically to Virginia and differs from privacy laws in other US states and other jurisdictions.
October 28, 2026 at 3:08 PM
dataridge.org
Term of the day: Verifiable Consumer Request

A verifiable consumer request is a formal request made under California's consumer privacy laws where a person asks a business to act on their privacy...

Full definition: dataridge.org/glossary/verifiable-consumer-request

#DataProtection #privacy
Verifiable Consumer Request. A verifiable consumer request is a formal request made under California's consumer privacy laws where a person asks a business to act on their privacy rights, such as accessing, deleting, or correcting their personal information. Before acting, the business must take reasonable steps to confirm the request actually comes from the person it claims to be, so that data is not released to the wrong party. This verification step exists because releasing a consumer's file to an impostor can enable fraud, stalking, or other harm.
October 27, 2026 at 3:07 PM
dataridge.org
Cyber Insurance Won't Save You From a Breach

#DataProtection #privacy
Cyber Insurance Won't Save You From a Breach
Conduent's breach exposed 62M records and led to an $80M settlement, highlighting that cyber insurance covers costs but not delayed breach detection or trust loss.
dataridge.org
October 26, 2026 at 7:05 PM
dataridge.org
Term of the day: Vendor Security Rating

A vendor security rating is a score that represents how well a vendor protects information and manages its cybersecurity, similar in concept to a credit score for...

Full definition: dataridge.org/glossary/vendor-security-rating

#DataProtection #privacy
Vendor Security Rating. A vendor security rating is a score that represents how well a vendor protects information and manages its cybersecurity, similar in concept to a credit score for security. Organizations typically use these ratings to grade and compare the security posture of the third-party vendors they work with. A rating reflects an external assessment of security controls and does not, on its own, guarantee that a vendor is compliant with any particular regulation.
October 26, 2026 at 3:08 PM
dataridge.org
Capcom's 11.7 Million Account Breach: What Went Wrong

#DataProtection #privacy
Capcom's 11.7 Million Account Breach: What Went Wrong
Capcom's 11.7 million account breach exposed critical IAM weaknesses, stressing the need for MFA and real-time detection to protect centralized authentication systems.
dataridge.org
October 25, 2026 at 7:05 PM
dataridge.org
Term of the day: Vendor Risk Assessment Questionnaire

A vendor risk assessment questionnaire is a standardized set of questions that an organization sends to a third-party vendor to...

Full definition: dataridge.org/glossary/vendor-risk-assessment-questionnaire

#DataProtection #privacy
Vendor Risk Assessment Questionnaire. A vendor risk assessment questionnaire is a standardized set of questions that an organization sends to a third-party vendor to understand the risks of working with them. It generally covers areas such as the vendor's security practices, data handling, and compliance controls. It is a tool for gathering information and does not by itself guarantee that a vendor is safe or compliant.
October 25, 2026 at 3:07 PM
dataridge.org
State-Level Fines Can Exceed Federal Caps: A Consent Control Field Guide

#DataProtection #privacy
State-Level Fines Can Exceed Federal Caps: A Consent Control Field Guide
State-level fines can exceed federal caps, highlighted by Meta's $25B penalty. This guide covers consent controls to meet strict consumer protection laws.
dataridge.org
October 24, 2026 at 7:06 PM
dataridge.org
Term of the day: Use Limitation

Use limitation is the idea that personal data collected for a particular reason should generally not be used later for a different, incompatible reason. In practice, organisations...

Full definition: dataridge.org/glossary/use-limitation

#DataProtection #privacy
Use Limitation. Use limitation is the idea that personal data collected for a particular reason should generally not be used later for a different, incompatible reason. In practice, organisations are expected to be clear from the outset about why they are collecting personal data and to stick to those stated purposes. It is closely related to, and often discussed as part of, the purpose limitation principle.
October 24, 2026 at 3:08 PM
dataridge.org
When 11M Accounts Get Hit, What Do You Actually Do?

#DataProtection #privacy
When 11M Accounts Get Hit, What Do You Actually Do?
The Capcom breach exposed over 11 million accounts, underscoring the critical need for robust incident response and effective user notification strategies.
dataridge.org
October 23, 2026 at 7:05 PM
dataridge.org
Luis Licea, with 345 earlier cases in the archive, was among the month's plaintiffs, the highest repeat count.

#DataProtection #privacy
September 2026 website accessibility lawsuit report
148 federal website accessibility lawsuits were filed in September 2026 across 8 states. What the complaints alleged, who was sued, where, and by whom.
www.accessibility.com
October 23, 2026 at 6:10 PM
dataridge.org
Term of the day: Unstructured Data

Unstructured data is information that does not follow a predefined or easily machine-readable format, such as documents, images, audio, and video files. Unlike data organized...

Full definition: dataridge.org/glossary/unstructured-data

#DataProtection #privacy
Unstructured Data. Unstructured data is information that does not follow a predefined or easily machine-readable format, such as documents, images, audio, and video files. Unlike data organized neatly into rows and columns, it is stored in ways that are harder for machines to parse automatically. It typically makes up records that will not fit into a structured format.
October 23, 2026 at 3:08 PM
dataridge.org
A 12-Year-Old Test Account and 'Password1' Cost 3,300 Children Their Privacy

#DataProtection #privacy
A 12-Year-Old Test Account and 'Password1' Cost 3,300 Children Their Privacy
A 12-year-old test account using 'Password1' enabled attackers to breach Data Cymru, exposing personal data of 3,300 children and families.
dataridge.org
October 22, 2026 at 7:07 PM
dataridge.org
Term of the day: Universal Opt-Out Mechanism

A Universal Opt-Out Mechanism is a tool or setting on a consumer's desktop or mobile device that automatically tells businesses the consumer wants to opt...

Full definition: dataridge.org/glossary/universal-opt-out-mechanism

#DataProtection #privacy
Universal Opt-Out Mechanism. A Universal Opt-Out Mechanism is a tool or setting on a consumer's desktop or mobile device that automatically tells businesses the consumer wants to opt out of certain uses of their personal data, such as the sale or sharing of that data. Instead of clicking an opt-out link on every website, the consumer configures the preference once and the signal is communicated automatically. The Global Privacy Control (GPC) is a commonly cited example of such a signal.
October 22, 2026 at 3:09 PM
dataridge.org
Term of the day: UK General Data Protection Regulation

The UK GDPR is the data protection law that governs how organisations handle personal information about people in the United Kingdom...

Full definition: dataridge.org/glossary/uk-general-data-protection-regulation

#DataProtection #privacy
UK General Data Protection Regulation. The UK GDPR is the data protection law that governs how organisations handle personal information about people in the United Kingdom. It is based on the EU's General Data Protection Regulation, which was written into UK law, and it works alongside the Data Protection Act 2018. It sets out rules and principles that organisations must follow when they collect and use personal data.
October 21, 2026 at 3:09 PM
dataridge.org
Term of the day: UK Addendum

The UK Addendum is a document issued by the UK's Information Commissioner's Office that attaches to the EU's standard contractual clauses so those EU clauses can be used to legitimise...

Full definition: dataridge.org/glossary/uk-addendum

#DataProtection #privacy
UK Addendum. The UK Addendum is a document issued by the UK's Information Commissioner's Office that attaches to the EU's standard contractual clauses so those EU clauses can be used to legitimise transfers of personal data out of the UK. It is one of two tools the ICO provides for this purpose, alongside the standalone UK International Data Transfer Agreement (IDTA). It is used only to provide safeguards for restricted international transfers and does not, on its own, set out broader terms such as the general roles of the parties.
October 20, 2026 at 3:09 PM