| AADC |
The ICO’s Age Appropriate Design Code (“Children’s Code”): 15 standards for online services likely to be accessed by under-18s in the UK |
| Account-wide token |
A token that can change or delete anything in an account (every project, its databases and backups), not just one project or environment |
| ADM |
Automated decision-making: decisions made solely by automated means with legal or similarly significant effects |
| C0–C3 |
This blueprint’s data classes: public, internal, personal, sensitive (5.1) |
| Controller / processor |
The controller decides why and how data is processed; the processor acts on the controller’s instructions |
| CSP |
Content Security Policy: a browser-enforced allowlist of where scripts, styles, fonts and connections may come from |
| DCPMI |
Data Controller/Processor of Major Importance (Nigeria). Tiers: UHL, EHL, OHL. |
| DPA |
A data processing agreement with a vendor, or a data protection authority (a regulator), depending on context |
| DPCO |
Data Protection Compliance Organisation: licensed by the NDPC to audit and file returns |
| DPF / UK–US data bridge |
The EU–US Data Privacy Framework and its UK Extension for transfers to certified US companies |
| DPIA |
Data protection impact assessment (in the NDPA: data privacy impact assessment) |
| DSR / DSAR |
A data subject (access) request: a person exercising their rights |
| GAID |
NDPC’s General Application and Implementation Directive 2025 under the NDPA |
| IDTA / SCCs |
The UK International Data Transfer Agreement / the EU Standard Contractual Clauses |
| LIA |
Legitimate interests assessment |
| MCP |
Model Context Protocol: an open standard for connecting AI agents to outside tools and data. What an MCP server returns is data, not instructions (12.1) |
| OIDC (trusted publishing) |
OpenID Connect: CI proves who it is to a package registry or cloud and gets a short-lived token, so no long-lived secret is stored (7.4) |
| PECR |
UK Privacy and Electronic Communications Regulations: cookies and e-marketing |
| RLS |
Row-Level Security: Postgres policies that decide which rows a user may read or write |
| RoPA |
Record of Processing Activities |
| RPO / RTO |
The maximum acceptable data loss / time to restore after an incident |
| Soft opt-in |
The UK/EU exception allowing marketing to existing customers about similar products, with an opt-out every time |
| Special category data |
Health, biometric (for ID), genetic, sex life/orientation, religion, ethnicity, political opinions, trade-union membership |