Data Controller

A [=DataController=] is the entity responsible for the determination of processing of personal data. The exact meaning of 'responsible' and 'determination' varies across jurisdictions and laws. For example, [[GDPR]] defines a controller as the entity that determines 'means' and 'purposes' of processing personal data i.e. the entity that not only determine which data is being processed, but also the why and how of it. DPV does not prescribe to any particular jurisdictional definition, and the term 'Controller' here is analogous to the ISO term 'PII Controller'.

To indicate the name, address, and contact details for a controller, the properties `hasName`, `hasAddress`, and `hasContact` are provided. Other properties can also be used to provide this as well as additional details, such as [[[FOAF]]] or Schema.org.

To indicate an entity acting as the representative of the controller, the concept [=Representative=] and relation [=hasRepresentative=] are provided. Representatives can be present to maintain presence in multiple jurisdictions without the controller having to open new units in those divisions. The location or jurisdiction of representatives can be expressed by using the DPV concepts e.g. `hasLocation` and `hasJurisdiction`.

Data Processor

A Data Processor is an entity which processes personal data on behalf of the controller i.e. the controller provides instructions to the processor for what processing activities to perform. The processor is only responsible for carrying out the processing as stipulated by the controller. The term 'Processor' is analogous to the ISO term 'PII Processor'. Name, address, and contact details of a processor can be specified using the same properties as that of a controller. Similarly, representatives of a processor can also be indicated by using the [=Representative=] and [=hasRepresentative=] concepts.

The instructions from a Controller to a Processor typically take the form of a `ControllerProcessorAgreement` which is a contract between the two entities. The contract can specify which entity takes on which role, what activities are to be performed by whom, and any other pertinent details regarding processing of personal data.

Data Recipient

[=Recipient=] represents the entity that receives data i.e. is the recipient for data. Recipients receive data through processing operations such as collect, share, and transfer. The relation [=hasRecipient=] indicates the entity that receives data. Recipients can be the controller, processor, or third party in use-cases. Processors are defined as a subcategory of Recipient as they need to receive data in order to process it. To explicitly denote that the recipient is a controller, the relation [=hasRecipientDataController=] is provided. It is useful in situations such as clarifying where the data controller receives data, or to indicate recipients in a joint controller relationships. To indicate a third party is the recipient, the relation [=hasRecipientThirdParty=] is provided.

Third Party

A [=ThirdParty=] is an entity other than the data subject, data controller, data processor, or authority associated with a context or process. The nature of third parties' roles in such contexts are not defined in DPV.

Data Protection Officer

A [=DataProtectionOfficer=] (DPO) is an entity within or authorised by an organisation to monitor internal compliance, inform and advise on data protection obligations and act as a contact point for data subjects and the supervisory authority. It is indicated by using the relation [=hasDataProtectionOfficer=]. A DPO is a legal entity and a representative of the organisation, and their name, address, and contact details can be specified using the same properties as any other representative or legal entity.

Data Importer/Exporter

When data is being transferred, especially across jurisdictions, the entity sending the data is called the [=DataExporter=] and the entity receiving it is called the [=DataImporter=]. When the exporter and importer are in different jurisdictions, the data transfer is indicated to be `CrossBorderDataTransfer`. Exporters and Importers are indicated by using the relations [=hasDataExporter=] and [=hasDataImporter=].

Data Protection Authority

A [=DataProtectionAuthority=] (DPA) is responsible for regulating laws associated with data protection and privacy. It is associated by using the relation [=hasAuthority=]. The [[LEGAL]] extensions provide authorities for jurisdictions, such as the DPAs responsible for enforcing [[GDPR]] in EU. For jurisdictional aspects such as 'lead' supervisory authority, see [[EU-GDPR]] extension.

Organisational Units

An [=OrganisationalUnit=] is a unit or department or division within an organisation which does not have its own separate legal identity. Such units enable accurately representing how an organisation functions and where the responsibility and accountability within an organisation is located. To indicate an organisation has a unit, the relations [=hasOrganisationalUnit=] and [=isOrganistionalUnitOf=] are used.

Subsidiaries

[=SubsidiaryLegalEntity=] is a company (organisation) owned or controller by another company (organisation). To indicate a subsidiary for an entity, the relations [=hasSubsidiary=] and [=isSubsidiaryOf=] are used. For jurisdictional aspects associated with subsidiaries such as 'establishments' under the GDPR, see the [[EU-GDPR]] extension.

Classes

Properties