Compliance & governance standards

Under GDPR Art. 4(12), a personal data breach is a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It covers confidentiality, integrity and availability failures, not just theft.

GDPR Art. 4(11) requires consent to be freely given, specific, informed and unambiguous, expressed by a statement or clear affirmative action. A pre-ticked box records the controller's choice, not the person's act, so Recital 32 excludes it.

Under GDPR Art. 15, the person gets confirmation that their data is processed, a copy of it, and context: purposes, categories, recipients, retention, source, rights and automated decisions. Art. 12(3) requires a reply within one month of receipt, extendable by two further months.

GDPR Art. 6(1) lists consent, contract, legal obligation, vital interests, public task and legitimate interests. None ranks above the others; consent fits only when the person has a real choice, because it can be withdrawn and processing must then stop.

Yes. A hashed email is a stable identifier that anyone holding the address can recompute and match, so under the GDPR it is pseudonymised data, which Recital 26 treats as personal data. Only data rendered anonymous leave the Regulation's scope.

Under the CCPA, the notice at collection lists the personal and sensitive personal information categories, their purposes, whether each is sold or shared and how long each is kept, shown at or before collection (Civil Code 1798.100(a); 11 CCR 7012).

Under Civil Code 1798.110 and 1798.115, a consumer can learn the categories of personal information collected, its sources, purposes and recipients by category, what was sold, shared or disclosed, and the specific pieces: the actual data values held.

Under Civil Code 1798.140, selling is making personal information available to a third party for monetary or other valuable consideration; sharing is making it available to a third party for cross-context behavioural advertising, whether or not anything is paid.

Under Civil Code 1798.140(d), a CCPA business is a for-profit entity that collects consumers' personal information, determines its purposes and means, does business in California and meets any one of three thresholds: revenue, data volume or data revenue.

Under the GDPR, processing is unlawful until one of six Art. 6(1) bases applies, so consent-based features start off; under the CCPA, collection with notice is allowed and consumers opt out of sale, sharing and some sensitive-data uses.

In BPMN 2.0 the task type says who performs the work: a user task is human work the engine tracks, a manual task is human work it does not, service, script and business-rule tasks are automated, and send and receive tasks exchange messages.

In BPMN 2.0 a start event (thin circle) only catches the trigger that creates a process instance, an end event (thick circle) only throws a result as it consumes a token, and an intermediate event (double circle) may catch or throw.

In BPMN 2.0 a sequence flow (solid line, solid arrowhead) orders flow nodes inside one process and carries the token; a message flow (dashed, open circle to open arrowhead) passes a message between pools; an association (dotted) only attaches information.

In BPMN 2.0 an exclusive gateway takes exactly one branch and merges without waiting; an inclusive gateway takes every branch whose condition is true and joins those still expected; a parallel gateway takes all branches and waits for all.

In BPMN 2.0 a pool is the graphical form of a participant, such as the employer or the candidate, and contains at most one process; a lane is a sub-partition inside that process, such as Recruiting or Hiring manager.

Certification means an independent body audits you against a standard and issues a certificate, as with ISO/IEC 27001. Attestation means a CPA practitioner gives an opinion against criteria, as in SOC 2. Self-assessment means you evaluate yourself and an official affirms it.

The CIS Controls v8.1 are a prescriptive, prioritized set of 18 security Controls broken into 153 Safeguards. They tell an organization what to do first, starting with asset and software inventory, rather than serving as a certification standard.

The HIPAA Security Rule protects electronic PHI through administrative (164.308), physical (164.310) and technical (164.312) safeguards. The required risk analysis in 164.308(a)(1) comes first because every choice of reasonable and appropriate measures rests on it.

ISO/IEC 27001 states the requirements for an information security management system, including the Annex A control list, and is the standard organizations are certified against. ISO/IEC 27002 is guidance on implementing each of those controls and cannot be certified.

NIST CSF 2.0 organizes outcomes under six Functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern, new in 2.0, covers risk strategy, roles, policy, oversight and supply chain risk, and informs how the other five are implemented.