Data Roles and Data Types

Aggregated Data Aggregated data is data a vendor combines from many customers and strips of identity. Contracts often let the vendor own and use it freely, even after you leave. Anonymized Data Anonymized data is data changed so that no one can reasonably identify the person it was about. Under the GDPR it is no longer personal data, but pseudonymized data still is. Customer Data Customer data is the contract term for the data you put into a vendor's service. Most vendor promises about use, deletion and AI training apply only to data inside this definition. Data Controller A data controller is the company that decides why and how personal data is used. For your own users and customers, that is usually you, not your vendors. Data Minimization Data minimization means collecting and keeping only the personal data you need for a purpose. With vendors, it means sending each tool only the data its job requires and turning off collection you do not use. Data Ownership Data ownership is the part of a SaaS contract that says who holds the rights to your data. The license you give the vendor matters more, because it decides what the vendor can actually do with it. Data Processor A data processor is a company that handles personal data on behalf of another business, following that business's instructions. Most SaaS vendors are processors for the data you put into their products. Data Protection Officer (DPO) A data protection officer (DPO) is the person who advises a company on the GDPR, monitors how it handles personal data and is the contact point for regulators and individuals. The GDPR requires one only in specific cases, such as large-scale monitoring of people. Data Subject A data subject is the living person that personal data is about, such as your users, your customers' employees or your own staff. The GDPR gives data subjects rights over their data, and those rights reach the vendors that hold it. De-Identified Data De-identified data is information changed so it can no longer reasonably be linked to a person. Under the CCPA, data that meets the legal test falls outside most of the law's protections. Joint Controller Joint controllers are two or more companies that decide together why and how personal data is used. Under GDPR Article 26 they must agree who handles which privacy duties, and each stays answerable to the people concerned. Lawful Basis and Legitimate Interest A lawful basis is the legal reason the GDPR requires for each use of personal data. Legitimate interest is one of the six bases: it allows a use that serves a real interest, unless the person's interests or rights override it. License to Customer Data The license to customer data is the permission you give a vendor to use your data. Its purpose, length and scope decide what the vendor can do beyond running your account. Personal Data Personal data is any information about a person who can be identified, directly or by combining details. Under the GDPR it can include names, work emails, IP addresses and cookie IDs. Personal Information Personal information is the CCPA term for information that can reasonably be linked to a California resident or household. It excludes public, deidentified and aggregate information. Personally Identifiable Information (PII) Personally identifiable information (PII) is a US term for data that can identify a person, such as a name, email address, ID number or IP address. Its exact meaning depends on the law or contract that uses it. Purpose Limitation Purpose limitation is the rule that personal data collected for one purpose should not be reused for an unrelated one. It is the privacy principle most directly tied to vendors training AI on your data. Sensitive Personal Information Sensitive personal information is personal data that can cause serious harm if misused, such as ID numbers, health data, precise location or message contents. Privacy laws give it stricter rules. Usage Data Usage data is information a vendor collects about how you and your team use its product, such as features used, logins, devices and IP addresses. Vendors often claim broad rights over it, including for AI training and marketing.