GDPRtEXT
type: Ontology
version IRI: https://w3id.org/GDPRtEXT/v/0.7
creator: Harshvardhan J. Pandit
description: The General Data Protection Regulation (GDPR) is comprised of several articles, each with points that refer to specific concepts. The general convention of referring to these points and concepts is to quote the specific article or point using a human-readable reference. This ontology provides a way to refer to the points within the GDPR using the EurLex ontology published by the European Publication Office. It also defines the concepts defined, mentioned, and requried by the GDPR using the Simple Knowledge Organization System (SKOS) ontology.
abstract: The General Data Protection Regulation (GDPR) defines legal obligations over the use of personal data by organisations. This ontology aims to identify and model such terms and obligations as an OWL vocabulary and to directly link the terms to their occurence, usage, and influence in the GDPR text.
created: 2017-08-15
creator: http://purl.org/adaptcentre/people/HJP
description: This ontology extends the canonical (official) GDPR text with additional annotations
modified: 2020-03-31
publisher: ADAPT
source: http://eur_lex.europa.eu/legal_content/EN/ALL/
status: draft
preferred namespace prefix: gdprtext
comment: GDPRtEXT provides a SKOS glossary of terms associated with GDPR and an ontology to represent the GDPR text as a set of RDF resources
label: GDPR text EXTensions
see also: "GDPRtEXT - GDPR as a Linked Data Resource" by Harshvardhan J. Pandit*, Kaniz Fatema, Declan O'Sullivan, Dave Lewis. Published in Proceedigns of 15th European Semantic Web Conference (ESWC), Resource Track. Crete, Heraklion, Greece. 2018. https://doi.org/10.1007/978-3-319-93417-4_31
backwards compatible with: https://w3id.org/GDPRtEXT/v/0.6
prior version: https://w3id.org/GDPRtEXT/v/0.6
version info: 0.7

involves
type: AnnotationProperty
comment: It signifies that two concepts are related within the context of the GDPR.

has Article
type: ObjectProperty
sub property of: has part
type: FunctionalProperty
domain: LegalResourceSubdivision
range: Article
comment: indicates the legal resource has the Article

has Chapter
type: ObjectProperty
sub property of: has part
type: FunctionalProperty
domain: LegalResource
range: Chapter
comment: indicates the legal resource has the Chapter

has Citation
type: ObjectProperty
sub property of: has part
domain: LegalResourceSubdivision
range: Citation
comment: indicates that the legal resource has the referenced citation

has Point
type: ObjectProperty
sub property of: has part
type: FunctionalProperty
domain: LegalResourceSubdivision
range: Point
comment: indicates the legal resource has the Point

has Recital
type: ObjectProperty
sub property of: has part
type: FunctionalProperty
domain: LegalResourceSubdivision
range: Regulation
comment: indicates the legal resource has the Recital

has Section
type: ObjectProperty
sub property of: has part
type: FunctionalProperty
domain: LegalResourceSubdivision
range: Section
comment: indicates the legal resource has the Section

has SubPoint
type: ObjectProperty
sub property of: has part
type: FunctionalProperty
domain: LegalResourceSubdivision
range: SubPoint
comment: indicates the legal resource has the SubPoint

is part of Article
type: ObjectProperty
sub property of: is part of
type: FunctionalProperty
domain: LegalResourceSubdivision
range: Article
comment: represents a legal resource subdivision to be part of a article

is part of Chapter
type: ObjectProperty
sub property of: is part of
type: FunctionalProperty
domain: LegalResourceSubdivision
range: Chapter
comment: represents a legal resource subdivision to be part of a chapter

is part of Point
type: ObjectProperty
sub property of: is part of
type: FunctionalProperty
domain: LegalResourceSubdivision
range: Point
comment: represents a legal resource subdivision to be part of a point

is part of Section
type: ObjectProperty
sub property of: is part of
type: FunctionalProperty
domain: LegalResourceSubdivision
range: Section
comment: represents a legal resource subdivision to be part of a section

Principle of Accountability
type: Class
subclass of: Principle
comment: The principle of accountability states that the controller shall be responsible for, and be able to demonstrate compliance with the processing of personal data as defined by the justifications permissible under the GDPR
involves: Compliance
involves: Controller Responsibility
involves: Lawful Basis
involves: Processing

Principle of Accuracy
type: Class
subclass of: Principle
comment: The principle of accuracy states that personal data must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
involves: Erase Data
involves: Kept up to date
involves: Personal Data
involves: Rectify Data
involves: Rectify Inaccuracies

Accuracy is contested
type: Class
subclass of: Right to restrict processing
comment: The data subject can exercise the right to restrict processing of their personal data when the accuracy of personal data is contested
involves: Personal Data

Accurate Collection
type: Class
subclass of: Obligation for data collection
comment: This obligation specifies that the collection of (or collected) personal data should in an accurate form - i.e. the personal data should be accurate.
involves: Collection of Personal Data
involves: Personal Data

Activity
type: Class
subclass of: Concept
comment: An Activity signifies some process(es) or step(s) towards specific deed(s), action(s), function(s), or sphere(s) of action.

Adequate for processing
type: Class
subclass of: Data Retention
comment: Only the personal data adequat for required processing should be maintained
involves: Processing
involves: Store Data

Adherence
type: Class
subclass of: Awarding Seals and Certifications
comment: The seal or certification does not reduce or impact the responsiblity of the controller or processor for compliance with the GDPR

Anonymous Data
type: Class
subclass of: Data
comment: Data is termed to be anonymous if it cannot be connected or associated with individual person or persons that have provided or are associated with it.
involves: Personal Data

Appointing Sub-Processors
type: Class
subclass of: Processor Obligations
comment: These are the obligations for Processors over appointing sub-processors
involves: Processor
involves: Sub-Processor

Appointment of Processors
type: Class
subclass of: Activity
subclass of: Controller Obligation
comment: These are the obligations specified by the GDPR for the appointment of Processors by Controllers.
involves: Controller
involves: Processor

Archive Data
type: Class
subclass of: Data Activity
comment: An activity where personal data is archived
involves: Personal Data

Article
type: Class
subclass of: LegalResourceSubdivision
comment: Article in GDPR text
example: gdpr:article10 a eli:LegalResourceSubdivision, GDPRtEXT:Article ; eli:is_part_of gdpr:GDPR, gdpr:chapterII ; eli:number "10"^^xsd:string ; eli:title_alternative "Article 10"^^xsd:string ; GDPRtEXT:hasPoint gdpr:article10-1 ; GDPRtEXT:isPartOfChapter gdpr:chapterII .

Assist in complying with rights
type: Class
subclass of: Processor Obligations
comment: Processors must assist Controllers in complying with the various rights provided by the GDPR to data subjects which can be exercised at any time.
involves: Compliance
involves: Controller
involves: Processor
involves: Data Subject's Rights

Automatic decision making with significant effect
type: Class
subclass of: Automated Processing
subclass of: Factors for Impact Assessment
comment: Automated decision making with significant effect
comment: This type of processing involves automated processing that does decision making having significant effects on the data subject.
involves: Data Subject
involves: Personal Data

Automated Processing
type: Class
subclass of: Processing
comment: This is automated processing of data subject's personal data.
involves: Personal Data

Can be withdrawn easily
type: Class
subclass of: Obligation for obtaining consent
comment: This obligation states that the data subject should be able to withdraw the consent as easily as it was to give it.
involves: Given Consent
involves: Withdrawing Given Consent

Certification
type: Class
subclass of: Seals and Certifications
comment: A certification pertaining to GDPR compliance

Certification Body
type: Class
subclass of: Entity
comment: A Certification Body is an entity that can award/issue/renew a certification pertaining to compliance towards the GDPR.
involves: Certification
involves: Seal

Chapter
type: Class
subclass of: LegalResourceSubdivision
comment: Chapter in GDPR text
example: gdpr:chapterI a eli:LegalResourceSubdivision, GDPRtEXT:Chapter ; eli:is_part_of gdpr:GDPR ; eli:number "I"^^xsd:string ; eli:title "General provisions"^^xsd:string ; eli:title_alternative "Chapter I"^^xsd:string ; GDPRtEXT:hasArticle gdpr:article1, gdpr:article2, gdpr:article3, gdpr:article4 .

Citation
type: Class
subclass of: LegalResourceSubdivision
comment: Citation in GDPR text
example: gdpr:citation1 a eli:LegalResourceSubdivision, GDPRtEXT:Citation ; eli:description "OJ C 229, 31.7.2012, p. 90."^^xsd:string ; eli:is_part_of gdpr:GDPR ; eli:number "1"^^xsd:string .

Clear explanation
type: Class
subclass of: Obligation for obtaining consent
comment: Obtaining consent must provide clear explanations of the processing involved over the personal data
involves: Processing

Code of Conduct
type: Class
subclass of: Concept
comment: A Code of Conduct for the purpose of specifying the application of GDPR which may be monitored, evaluated, or processed by a third party appointed by the organisation.

Collection Mechanism
type: Class
subclass of: Collection of Personal Data
comment: Specifies collection mechanism used to collect personal data

Collection of Personal Data
type: Class
subclass of: Data Activity
comment: Collection of Personal Data is an Activity that deals with acquiring data subject's personal data through some model of interaction.
involves: Personal Data

Compliance
type: Class
subclass of: Concept
comment: Represents the act of complying with the obligations and actions specified by the GDPR.

Compliance with Controller's instructions
type: Class
subclass of: Processor Obligations
comment: The processor has an obligation to comply with the controller's instructions
involves: Controller
involves: Processor

Awarding Seals and Certifications
type: Class
subclass of: Seals and Certifications
comment: GDPR mentions some conditions or criterion for the creation and issuing of seals and certifications pertaining to GDPR compliance
involves: Adherence
involves: Maximum validty 3 years
involves: Voluntary accredition

Confirming or matching datasets
type: Class
subclass of: Factors for Impact Assessment
subclass of: Processing
comment: This type of processing involves matching data subject's identity or personal data in different datasets.
involves: Personal Data

Consent
type: Class
subclass of: Concept
comment: Consent in the context of the GDPR refers to the assent or agreement by the data subject in relation to their personal data for the proposed processing activities associated with one or more organisations.

Consent Activity
type: Class
subclass of: Activity
comment: An activity involving data subject's consent.
involves: Consent

Context of data collection
type: Class
subclass of: Purpose of new processing
comment: The purpose of new processing should take the context of how the original data was collected into consideration
involves: Collection of Personal Data

Contract with Data Subject
type: Class
subclass of: Lawful Basis
comment: The lawful basis for processing personal data is provided through a contract with the data subject.
involves: Data Subject

Controller
type: Class
subclass of: Entity
comment: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Controller Accountability
type: Class
subclass of: Controller Obligation
comment: These obligations specify the accountability of the Controller.
involves: Controller

Controller has taken action
type: Class
subclass of: Exceptions on reporting data breach
comment: The data subjects were not notified about the data breach because the controller had already taken action regarding the data breach.
involves: Controller
involves: Data Breach

Controller Obligation
type: Class
subclass of: Obligation
comment: These are the obligations specified by the GDPR as being specifically the responsbility of the Controller.
involves: Controller

Controller Representative
type: Class
subclass of: Entity
comment: A natural or legal person established in the Union who, designated by the controllerin writing, represents the controller with regard to their respective obligations under the GDPR.
involves: Controller

Controller Responsibility
type: Class
subclass of: Controller Obligation
comment: These obligations specify the responsiblity of the Controller
involves: Controller

Co-operate with DPA
type: Class
subclass of: Controller Obligation
subclass of: Processor Obligations
comment: This obligation specifies the Controller/Processor must co-operate with the Data Protection Authority (DPA).
involves: DPA

Crime data
type: Class
subclass of: Sensitive Personal Data
comment: Personal data related to criminal convictions and offences.
involves: Data Subject

Cross-border Transfer
type: Class
subclass of: Data Activity
subclass of: Factors for Impact Assessment
comment: Cross-border data transfer refers to data transfer crossing the boundaries of EU (legislative) region.
involves: Personal Data

DPA
type: Class
subclass of: Entity
comment: The Data Protection Authority (DPA) is a public institution responsible for monitoring the application of data protection laws.

DPO
type: Class
subclass of: Entity
comment: The Data Protection Officer (DPO) is an individual(s) appointed by the organisation to monitor compliance and assist in complying with the GDPR.
involves: Controller
involves: Monitor Compliance
involves: Notify about DPO
involves: Processor

DPO Obligation
type: Class
subclass of: Obligation
comment: These are the obligations specified for the Data Protection Office (DPO) within the GDPR
involves: DPO

Data
type: Class
subclass of: Concept
comment: A generic term to refer to Data.

Data Activity
type: Class
subclass of: Activity
comment: An activity involving personal data of data subject(s).
involves: Personal Data

Data Breach
type: Class
subclass of: Concept
comment: A data breach is the intentional or unintentional release of secure or private/confidential information to an untrusted environment.
involves: Personal Data

Principle of Data Minimisation
type: Class
subclass of: Principle
comment: The principle of data minimisation states that personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
involves: Accurate Collection
involves: Explicit Purpose
involves: Personal Data
involves: Processing
involves: Specified purpose

Data no longer needed for original purpose
type: Class
subclass of: Right to restrict processing
comment: The data subject can exercise the right to restrict processing of their personal data when the personal data is no longer required for the original purpose it was collected under
involves: Collection of Personal Data
involves: Personal Data

Data protection by design and default
type: Class
subclass of: Controller Obligation
comment: This obligation requires Controllers to follow data protection by design and by default.
involves: Controller

Data Security
type: Class
subclass of: Controller Obligation
subclass of: Processor Obligations
comment: These are obligations regarding security of data managed by the Controllers.
involves: Controller
involves: Personal Data
involves: Security of Personal Data

Data Subject
type: Class
subclass of: Entity
comment: An individual or entity to whom their personal data relates.

Data inferred or derived
type: Class
subclass of: Exlcusions and Exceptions
comment: The obligation or activity coult not be completed because the data was inferred or derived, and therefore did not come from the data subject or other sources.
involves: Data

Demonstrating Consent
type: Class
subclass of: Activity
subclass of: Compliance
comment: The act of demonstrating consent is an activity whereby previously acquired consent is provided as sufficient justification for processing activities involving data subject's personal information.
involves: Given Consent
involves: Valid Consent

Direct Marketing
type: Class
subclass of: Marketing
comment: Type of Marketing that reaches data subjects directly by communications directly addressed to the data subject.
involves: Data Subject

Employment Law
type: Class
subclass of: Lawful Basis
comment: Lawful basis for processing is provided by Employment Law

Entity
type: Class
subclass of: Concept
comment: A general term for any institution, company, corporation, partnership, government agency, university, or any other organization including individuals.

Erase Data
type: Class
subclass of: Data Activity
comment: An activity that erases data
involves: Personal Data

Erase if conesnt was withdrawn
type: Class
subclass of: Right of Erasure
comment: The right of erasure applies when the data subject withdraws given consent
involves: Erase Data
involves: Given Consent
involves: Withdrawing Given Consent

Erase if no longer needed for original purpose
type: Class
subclass of: Right of Erasure
comment: The right to erasure applies where data is no longer needed for original purposes for which it was collected
involves: Collection of Personal Data
involves: Erase Data
involves: Explicit Purpose

Evaluation of data subjects
type: Class
subclass of: Factors for Impact Assessment
comment: Whether the proposed activity involves the evaluation of the data subject.
involves: Data Subject

Exceptions on reporting data breach
type: Class
subclass of: Exlcusions and Exceptions
comment: Exceptions associated with compliance for reporting data breach to the affected data subjects.
involves: Report Data Breach

Exlcusions and Exceptions
type: Class
subclass of: Concept
comment: Exclusions and Exemptions provided by the GDPR for not complying with the specified obligations.

Exempted by National Law
type: Class
subclass of: Lawful Basis
comment: Lawful basis for processing is provided by National Law

Exempted without identity
type: Class
subclass of: Exlcusions and Exceptions
comment: The request or activity could not or was not completed because there was no sufficient proof of the data subject's identity.
involves: Identification of Data Subject

Exercise Rights
type: Class
subclass of: Activity
comment: The activity represents exercising of rights provided by GDPR by the data subject.
involves: Data Subject
involves: Data Subject's Rights

Existence of safeguards
type: Class
subclass of: Purpose of new processing
comment: The purpose of new processing should take into context the existence of appropriate safeguards
involves: Personal Data
involves: Security of Personal Data

Explicit Purpose
type: Class
subclass of: Obligation for data collection
comment: This obligation specifies that the collected (or collection) of personal data should be for/with explicit purposes.
involves: Collection of Personal Data

Factors for Impact Assessment
type: Class
subclass of: Concept
comment: These are the factors stated by the GDPR for Impact Assessment.
involves: Impact Assessment

Rights protection
type: Class
subclass of: Exlcusions and Exceptions
comment: The stated obligation could not be completed as it concerns rights protection.

Freely given
type: Class
subclass of: Valid Consent
comment: GDPR obligation that specifies consent must be freely given by the data subject for it to be valid.
involves: Given Consent
involves: Obtaining Consent from Data Subject

Genetic Data
type: Class
subclass of: Sensitive Personal Data
comment: Personal data relating to the inherited or acquired genetic characteristics of a natural person which result from the analysis of a biological sample from the natural person in question, in particular chromosomal, deoxyribonucleic acid (DNA) or ribonucleic acid (RNA) analysis, or from the analysis of another element enabling equivalent information to be obtained.
involves: Data Subject

Given Consent
type: Class
subclass of: Consent
subclass of: Lawful Basis
comment: Given Consent refers specifically to the form of consent given by the data subject in relation to their personal data and the proposed usage by activities.
involves: Data Subject
involves: Personal Data
involves: Processing

Harm was remote
type: Class
subclass of: Exceptions on reporting data breach
comment: The data subjects were not notified about the data breach because the harm was deemed to be remote.
involves: Data Breach

Health data
type: Class
subclass of: Sensitive Personal Data
comment: Personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.
involves: Data Subject

Historic, Statistical, or Scientific purposes
type: Class
subclass of: Lawful Basis
comment: Lawful basis if provided by the GDPR for processing related to historic, statistical, or scientific purposes.

Identifiable for required processing
type: Class
subclass of: Data Retention
comment: Retention of personal data should be identifiable for the requried processing
involves: Identification of Data Subject
involves: Store Data

Identification of Data Subject
type: Class
subclass of: Activity
comment: Activity where the data subject is explicitly identified through direct or indirect means.
involves: Data Subject

If and where Controller is processing
type: Class
subclass of: Right to Access Personal Data
comment: The right to access personal data also includes information about whether and where the controller is processing the data subject's personal data
involves: Controller
involves: Personal Data
involves: Processing

Impact Assessment
type: Class
subclass of: Activity
comment: The activity wherein the controller carries out an assessment of the impact of the envisaged processing operations on the protection of personal data.
involves: Factors for Impact Assessment
involves: Personal Data
involves: Processing

Implement technical measures
type: Class
subclass of: Controller Responsibility
comment: This obligation requires Controllers to implement the required technical measures necessary for compliance of the GDPR
involves: Compliance
involves: Controller

Impose confidentiality obligations on personnel
type: Class
subclass of: Processor Obligations
comment: The processor must impose confidentiality agreements on its personnel in relation to handling of personal data
involves: Processor

Information about automated processing with significant effects
type: Class
subclass of: Right to Access Personal Data
comment: The right to access personal data also includes information about automated processing that has significant effects on the data subject.
involves: Automated Processing
involves: Data Subject

Information about categories of recipients
type: Class
subclass of: Right to Access Personal Data
comment: The right to access personal data also includes information about the categories of recipients the data is shared with.
involves: Personal Data
involves: Record categories of recipients
involves: Share Personal Data with Third Party

Information about categories of data being processed
type: Class
subclass of: Right to Access Personal Data
comment: The right to access personal data also includes information about categories of data being processed
involves: Personal Data
involves: Processing

Information about rights
type: Class
subclass of: Right to Access Personal Data
comment: The right to access personal data also includes information about the existence of rights provided by the GDPR to the data subject
involves: Data Subject's Rights

Information about processing
type: Class
subclass of: Right to Access Personal Data
comment: The right to access personal data also includes information about the processing of personal data of the data subject
involves: Personal Data
involves: Processing

Information about data source
type: Class
subclass of: Right to Access Personal Data
comment: The right to access personal data also includes information about the source of the personal data
involves: Collection of Personal Data
involves: Personal Data

Information about storage period
type: Class
subclass of: Right to Access Personal Data
comment: The right to access personal data also includes information about the storage period of the data subject's personal data
involves: Personal Data
involves: Store Data

Inform Controller of conflict with law
type: Class
subclass of: Processor Obligations
comment: In case of conflict with the controller's intructions and the law, the processor must immediately inform the controller of this conflict
involves: Controller

Information about third parties
type: Class
subclass of: Right to basic information about processing of personal data
comment: The right to basic information also provides data subject's with information about third parties involved in the processing.
involves: Controller
involves: Processor
involves: Share Personal Data with Third Party

Concise
type: Class
subclass of: Right to Transparency
comment: The information provided under the right to transparency should be concise
involves: Right to Transparency

Easily Accessible
type: Class
subclass of: Right to Transparency
comment: The information provided under the right to transparency should be easily accessible
involves: Right to Transparency

Intelligible
type: Class
subclass of: Right to Transparency
comment: The information provided under the right to transparency should be intelligible
involves: Right to Transparency

Transparent
type: Class
subclass of: Right to Transparency
comment: The information provided under the right to transparency should be transparent and clear (i.e. not umambigious or vague)
involves: Principle of Lawfulness, Fairness, and Transparency
involves: Right to Transparency

Informed
type: Class
subclass of: Valid Consent
comment: GDPR obligation that specifies consent must be informed for it be valid.
involves: Data Activity
involves: Given Consent
involves: Obtaining Consent from Data Subject
involves: Personal Data

Principle of Integrity and Confidentiality
type: Class
subclass of: Principle
comment: The principle of integrity and confidentiality states that personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
involves: Data Security
involves: Personal Data
involves: Processing
involves: Protection against accidental loss
involves: Protection against damage
involves: Protection against destruction

Is impossible
type: Class
subclass of: Exlcusions and Exceptions
comment: The obligation or activity could not be completed as it was deemed to be impossible.

Joint Controller
type: Class
subclass of: Controller
comment: A joint controller is two or more controllers jointly determine the purposes and means of processing.
involves: Controller

Kept up to date
type: Class
subclass of: Data Retention
comment: Retained personal data must be kept up-to-date
involves: Personal Data

Large scale processing
type: Class
subclass of: Factors for Impact Assessment
subclass of: Processing
comment: The processing of personal data at a large scale of quantity or significant proportions.
involves: Personal Data
involves: Processing

Lawful Basis
type: Class
subclass of: Obligation
comment: This provides the basis for lawful processing of personal data.
involves: Processing

Principle of Lawfulness, Fairness, and Transparency
type: Class
subclass of: Principle
comment: The principle of lawfulness, fairness, and transparency states that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.
involves: Data
involves: Lawful Basis
involves: Processing

Legal Claims
type: Class
subclass of: Lawful Basis
comment: Lawful basis for processing is provided by legal claims.

Legal Obligations
type: Class
subclass of: Lawful Basis
comment: Lawful basis for processing is covered by legal obligation(s).

Legitimate Interests
type: Class
subclass of: Lawful Basis
comment: Lawful basis for processing is provided through the legitimate interests pursued by the Controller or by a third party
involves: Data Subject

Legitimate purpose
type: Class
subclass of: Obligation for data collection
comment: This specifies that the collection (or collected) personal data should be used/specified to be used for legitimate purposes.
involves: Collection of Personal Data

Liability of Joint-Controllers
type: Class
subclass of: Controller Obligation
comment: These specify the liability of Joint Controllers, i.e. cases where more than one Controller share the responsiblity.
involves: Joint Controller

Limited for processing
type: Class
subclass of: Data Retention
comment: Personal data retained should be limited in its use only for the requried processing
involves: Personal Data
involves: Processing

Lnk between new and old processing
type: Class
subclass of: Purpose of new processing
comment: Whether there is a link between the new and old purposes of processing
involves: Processing
involves: Purpose of new processing

Made Public
type: Class
subclass of: Lawful Basis
comment: Lawful basis is provided through the data being publicly made available by the data subject
involves: Data Subject

Maintain Record of Breach
type: Class
subclass of: Report Data Breach
comment: GDPR mandates the recording of data breaches and its effects.
involves: Data Breach

Maintain records for processing
type: Class
subclass of: Controller Obligation
subclass of: Processor Obligations
comment: This obligation requires the Controller/Processor to maintain adequate records about their processing activities.
involves: Processing

Marketing
type: Class
subclass of: Activity
comment: The process or technique of promoting, selling, and distributing a product or service.

Maximum validty 3 years
type: Class
subclass of: Awarding Seals and Certifications
comment: The maximum validity for all seals and certifications should be 3 years from the date of issue.

Medical or Diagnostics
type: Class
subclass of: Lawful Basis
comment: Lawful basis for processing is provided by the GDPR for medical or diagnostics purposes pertaining to the data subject
involves: Data Subject

Monitor Compliance
type: Class
subclass of: Activity
subclass of: Compliance
subclass of: DPO Obligation
comment: The activity or process of overseeing an organisation's compliance.
involves: Obligation
involves: Principle
involves: Data Subject's Rights

National Security
type: Class
subclass of: Exlcusions and Exceptions
comment: The stated obligation could not be completed as it concerns national security.

Nature of data involved
type: Class
subclass of: Purpose of new processing
comment: The nature of the personal data involved, whether it is sensitive or confidential.
involves: Personal Data

No charges levied
type: Class
subclass of: Right to Access Personal Data
comment: The right to access personal data should not incur any undue charge levied on the data subject for exercising their right
involves: Data Subject's Rights

Not-for-profit organisation
type: Class
subclass of: Lawful Basis
comment: Lawful basis is provided by the GDPR for activities of/for not-for-profit organisations

Not from silence or inactivity
type: Class
subclass of: Obligation for obtaining consent
comment: Consent should not be obtained from silence or inactivity of the data subject
involves: Given Consent

Not further processed
type: Class
subclass of: Obligation for data collection
comment: This obligation specifies that the collected personal data should not be processed beyond the purpose for which it was originally collected without an updated consent for the proposed purposes.
involves: Processing

Notification requires disproportionate efforts
type: Class
subclass of: Exceptions on reporting data breach
subclass of: Requires disproportionate efforts
comment: The data subjects were not notified about the data breach because it required disproportionate efforts.
involves: Report Data Breach

Notify consequences of breach
type: Class
subclass of: Notify Data Subject of Breach
comment: Affected data subject's must be notified about the consequences of the data breach.
involves: Data Breach

Notify about DPO
type: Class
subclass of: Notify Data Subject of Breach
comment: Affected data subjects must be notified with the name and contact of the DPO responsible/handling for the data breach.
involves: Data Breach
involves: Data Subject

Notify Data Subject of Breach
type: Class
subclass of: Report Data Breach
comment: Affected data subjects must be notified of the data breach and its effects.
involves: Data Breach
involves: Data Subject

Notify measures taken
type: Class
subclass of: Notify Data Subject of Breach
comment: Affect data subjets must be notified of the measures taken against the data breach.
involves: Data Breach
involves: Data Subject

Obligation
type: Class
subclass of: Concept
comment: These are the obligations specified by the GDPR. Following the obligations is necessary for compliance.

Obligation for data collection
type: Class
subclass of: Obligation
comment: Collection of Personal Data is an Activity that deals with acquiring data subject's personal data through some model of interaction.
involves: Collection of Personal Data

Obligation for obtaining consent
type: Class
subclass of: Obligation
comment: These are the obligations specified by the GDPR for obtaining consent
involves: Obtaining Consent from Data Subject

Obtaining Consent from Data Subject
type: Class
subclass of: Consent Activity
comment: The act of getting a data subject's consent.
involves: Data Subject
involves: Given Consent

Only act on Controller instructions
type: Class
subclass of: Processor Obligations
comment: The processor must only act on the intructions provided and documented by the controller
involves: Controller

Outside Material Scope
type: Class
subclass of: Exlcusions and Exceptions
comment: The activity was deemed to be outside the material scope of the GDPR.

Personal Data
type: Class
subclass of: Data
comment: Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
involves: Data Subject

Point
type: Class
subclass of: LegalResourceSubdivision
comment: Point in GDPR text
example: gdpr:article27-2 a eli:LegalResourceSubdivision, GDPRtEXT:Point ; eli:description "The obligation laid down in paragraph 1 of this Article shall not apply to:"^^xsd:string ; eli:is_part_of gdpr:GDPR, gdpr:article27, gdpr:chapterIV, gdpr:chapterIV-1 ; eli:number "2"^^xsd:string ; eli:title_alternative "Article27(2)"^^xsd:string ; GDPRtEXT:hasSubPoint gdpr:article27-2-a, gdpr:article27-2-b ; GDPRtEXT:isPartOfArticle gdpr:article27 ; GDPRtEXT:isPartOfChapter gdpr:chapterIV ; GDPRtEXT:isPartOfSection gdpr:chapterIV-1 .

Consequences for data subjects
type: Class
subclass of: Purpose of new processing
comment: The possible consequences of the change in processing for the data subject
involves: Data Subject

Principle
type: Class
subclass of: Concept
comment: A Principle is a rule or standard defined by the GDPR which is essential to be followed for compliance

Privacy by Design
type: Class
subclass of: Controller Obligation
comment: Privacy by Design is the approach of taking privacy into consideration throughout the whole planning and execution processes.

Processing
type: Class
equivalent class: Use Data
subclass of: Activity
comment: Processing here refers to an Activity that acts on the Data Subject's personal information.
involves: Personal Data

Processing affected or vulnerable individuals
type: Class
subclass of: Factors for Impact Assessment
subclass of: Processing
comment: This type of processing involves data subjects that are vulnerable, such as children, or people with disabilities.
involves: Data Subject
involves: Personal Data

Processing is unlawful
type: Class
subclass of: Right to restrict processing
comment: The data subject can exercise the right to restrict processing of their personal data when the processing is unlawful
involves: Personal Data
involves: Unlawful Processing

Processing sensitive data
type: Class
subclass of: Factors for Impact Assessment
subclass of: Processing
comment: This involves processing involving sensitive personal data.
involves: Sensitive Personal Data

Processing using untested technologies
type: Class
subclass of: Factors for Impact Assessment
subclass of: Processing
comment: This type of processing uses technologies that are new or have not yet been deemed to be fit or stable for usage.
involves: Personal Data

Processor
type: Class
subclass of: Entity
comment: A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
involves: Controller

Agreement between Processor and Controller
type: Class
subclass of: Concept
comment: Signifies the agreement between Controller and Processors for processing of personal data
involves: Appointment of Processors
involves: Controller
involves: Processor

Processor Obligations
type: Class
subclass of: Obligation
comment: These are the obligations specified by the GDPR in the context of Processors
involves: Processor

Processor Representative
type: Class
subclass of: Entity
comment: A natural or legal person established in the Union who, designated by the processor in writing, represents the processor with regard to their respective obligations under the GDPR.
involves: Processor

Propogate rights to Third Parties
type: Class
subclass of: Activity
subclass of: Controller Obligation
subclass of: Processor Obligations
comment: To propogate a data subject's right once they have been exercised to other third parties that are involved through the data subject's personal data.
involves: Controller
involves: Processor
involves: Data Subject's Rights

Protection against accidental loss
type: Class
subclass of: Security of Personal Data
comment: Protection of data subject's personal data against accidental loss.
involves: Data Security
involves: Personal Data

Protection against damage
type: Class
subclass of: Security of Personal Data
comment: Protection of data subject's personal data against damage to the data.
involves: Data Security
involves: Personal Data

Protection against destruction
type: Class
subclass of: Security of Personal Data
comment: Protection of data subject's personal data against destruction of data.
involves: Data Security
involves: Personal Data

Protection against unlawful processing
type: Class
subclass of: Security of Personal Data
comment: Protection of data subject's personal data against unlawful processing of data.
involves: Data Security
involves: Personal Data
involves: Unlawful Processing

Provide information for compliance
type: Class
subclass of: Processor Obligations
comment: The processor must provide the controller with the information necessary to demonstrate compliance
involves: Compliance
involves: Controller

Provide copy of Personal Data
type: Class
subclass of: Data Activity
subclass of: Right of Data Portability
comment: The right of data portability requries providing a copy of the data subject's personal data
involves: Personal Data

Pseudo-anonymous data
type: Class
subclass of: Data
comment: Personal data that can no longer be attributed to a specific data subject without the use of additional information.
involves: Data Subject

Public Interest
type: Class
subclass of: Lawful Basis
comment: Lawful basis is provided by the GDPR as being in the interest of the public

Principle of Purpose Limitation
type: Class
subclass of: Principle
comment: The principle of purpose limitation states that personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1) of the GDPR, not be considered to be incompatible with the initial purposes.
involves: Archive Data
involves: Collection of Personal Data
involves: Explicit Purpose
involves: Historic, Statistical, or Scientific purposes
involves: Legitimate purpose
involves: Not further processed
involves: Personal Data
involves: Specified purpose

Purpose of new processing
type: Class
subclass of: Lawful Basis
comment: These are the obligations over determining the new or changed purposes of processing
involves: Processing

Regulation (EC) No 45/2001
type: Class
subclass of: Exlcusions and Exceptions
comment: Related to Regulation (EC) No. 45/2001

Personal or Household activity
type: Class
subclass of: Exlcusions and Exceptions
comment: Exempted as the GDPR does not apply to personal or household activity that does not have a professional or commercial activity associated with it.

Covered by Directive (EU) 2016/680
type: Class
subclass of: Exlcusions and Exceptions
comment: Exempted as it involves areas covered by Directive (EU) 2016/680

Racial origin data
type: Class
subclass of: Sensitive Personal Data
comment: Personal data revealing racial or ethnic origin.
involves: Data Subject

Regulation
type: Class
subclass of: LegalResourceSubdivision
comment: Regulation in GDPR text
example: gdpr:recital1 a eli:LegalResourceSubdivision, GDPRtEXT:Recital ; eli:description "The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her."^^xsd:string ; eli:is_part_of gdpr:GDPR ; eli:number "1"^^xsd:string .

Categories of data subjects and personal data
type: Class
subclass of: Maintain records for processing
comment: This obligation requires Controllers to record the categories of data subjects and the personal data involved in processing/activities.
involves: Data Subject
involves: Personal Data

Record categories of recipients
type: Class
subclass of: Maintain records for processing
comment: This obligation requires Controllers to record the categories of recipients the personal data was shared with.
involves: Share Personal Data with Third Party

Record cross-border transfers
type: Class
subclass of: Maintain records for processing
comment: This obligation requires Controllers to record the cross-border data transfers.
involves: Cross-border Transfer

Record data retention periods
type: Class
subclass of: Maintain records for processing
comment: This obligation requires Controllers to record the data retention period of personal data.
involves: Store Data

Record purpose of processing
type: Class
subclass of: Maintain records for processing
comment: This obligation requires Controllers to record the purpose of processing associated with personal data and the given consent.
involves: Processing

Record security measures
type: Class
subclass of: Maintain records for processing
comment: This obligation requires Controllers to record the measures taken to ensure adequate safety measures of personal data and the involved activities.
involves: Security of Personal Data

Rectify Data
type: Class
subclass of: Data Activity
comment: An activity that rectifies data
involves: Personal Data

Rectify Inaccuracies
type: Class
subclass of: Data Retention
comment: Any inaccuracies or discrepancies in the retained data must be rectified
involves: Personal Data

Regulatory Authority
type: Class
subclass of: Entity
comment: The authority responsible for regulating data protection laws.

Relevant for processing
type: Class
subclass of: Data Retention
comment: Any retained personal data must be relevant for subsiquent processing
involves: Personal Data
involves: Processing

Report Data Breach
type: Class
subclass of: Activity
subclass of: Compliance
subclass of: Controller Obligation
comment: The act of reporting a data breach to entities mentioned within the GDPR. These are the Data Protection Authority (DPA), and in the case of Processors, the Controller they have an agreement with.
involves: Data Breach
involves: Maintain Record of Breach
involves: Notify Data Subject of Breach
involves: Report breach to DPA within 72 hours

Report data breach to Controller
type: Class
subclass of: Processor Obligations
subclass of: Report Data Breach
comment: The occurence of a data breach must be reported to the Controller.
involves: Controller
involves: Data Breach
involves: Processor
involves: Report Data Breach

Report breach to DPA within 72 hours
type: Class
subclass of: Report Data Breach
comment: The occurence of a data breach must be reported to the Data Protection Authority (DPA) within 72 hours
involves: DPA
involves: Data Breach

Requires disproportionate efforts
type: Class
subclass of: Exlcusions and Exceptions
comment: The stated obligation or activity could not be completed as it requires disproportionate efforts to complete.

Written consent of Controller
type: Class
subclass of: Appointing Sub-Processors
comment: Appointing a sub-processor requires the written consent of the controller specifying permission or consent
involves: Consent
involves: Controller
involves: Sub-Processor

Restrictions on cross-border transfers
type: Class
subclass of: Processor Obligations
comment: These provide restrictions on cross-border transfers for Processors
involves: Cross-border Transfer
involves: Processor

Data Retention
type: Class
subclass of: Obligation
comment: These are the obligations specified by the GDPR on the retention of personal data
involves: Personal Data
involves: Store Data

Return or destroy data
type: Class
subclass of: Processor Obligations
comment: The processor must return or destroy personal data at the end of term (of its agreement with the controller)
involves: Erase Data
involves: Processor
involves: Agreement between Processor and Controller

Right of Data Portability
type: Class
subclass of: Data Subject's Rights
comment: The data subject has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.
involves: Collection of Personal Data
involves: Data Subject
involves: Personal Data
involves: Provide copy of Personal Data
involves: Copy should be in a commonly used format
involves: Copy should be in a machine readable format
involves: Should be structured
involves: Shoud support reuse

Right of Erasure
type: Class
subclass of: Data Subject's Rights
comment: The data subject has the right to obtain erasure of their personal data
involves: Data Subject
involves: Erase Data
involves: Personal Data

Right to Access Personal Data
type: Class
subclass of: Data Subject's Rights
comment: The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data along with additional information about it.
involves: Data Subject
involves: Personal Data
involves: Processing
involves: Provide copy of Personal Data

Right to basic information about processing of personal data
type: Class
subclass of: Data Subject's Rights
comment: The right to basic information about processing provides data subjects with information about the processing activities involving their personal data
involves: Data Subject
involves: Processing

Right to not be evaluated through automated processing
type: Class
subclass of: Data Subject's Rights
comment: The data subject has a right to not be evaluated through automated processing
involves: Automated Processing
involves: Data Subject

Right to object direct marketting
type: Class
subclass of: Data Subject's Rights
comment: The data subject has a right to object to direct marketting based on their personal data
involves: Data Subject
involves: Direct Marketing

Right to object processing
type: Class
subclass of: Data Subject's Rights
comment: The data subject has the right to object to processing of their personal data
involves: Data Subject
involves: Personal Data
involves: Processing

Right to rectify
type: Class
subclass of: Data Subject's Rights
comment: The data subject has a right to recitify their personal data
involves: Data Subject
involves: Rectify Data

Right to restrict processing
type: Class
subclass of: Data Subject's Rights
comment: The data subject has the rights to restrict the processing of their personal data
involves: Accuracy is contested
involves: Data no longer needed for original purpose
involves: Data Subject
involves: Processing
involves: Processing is unlawful

Right to Transparency
type: Class
subclass of: Data Subject's Rights
comment: The right to transparency requires controllers to provide information about the processing activities as well as personal data and its usage in a transparent manner
involves: Controller
involves: Data Subject
involves: Concise
involves: Easily Accessible
involves: Intelligible
involves: Transparent
involves: Principle of Lawfulness, Fairness, and Transparency
involves: Personal Data
involves: Processing

Data Subject's Rights
type: Class
subclass of: Concept
comment: The GDPR provides several rights to the data subjects which may be exercised at any time by the data subject and which are mandatory for the organisation to provide, comply with, and inform the data subject about.

Freedoms protection
type: Class
subclass of: Exlcusions and Exceptions
comment: The stated obligation could not be completed as it concerns freedoms protection.

Seal
type: Class
subclass of: Seals and Certifications
comment: A seal pertaining to GDPR compliance

Seals and Certifications
type: Class
subclass of: Concept
comment: GDPR provides for the creation and provision of seals and certificates pertaining to compliance or related activities
involves: Awarding Seals and Certifications

Section
type: Class
subclass of: LegalResourceSubdivision
comment: Section in GDPR text
example: gdpr:chapterIV-5 a eli:LegalResourceSubdivision, GDPRtEXT:Section ; eli:is_part_of gdpr:GDPR, gdpr:chapterIV ; eli:number "5"^^xsd:string ; eli:title "Codes of conduct and certification"^^xsd:string ; eli:title_alternative "Section 5"^^xsd:string ; GDPRtEXT:hasArticle gdpr:article40, gdpr:article41, gdpr:article42, gdpr:article43 ; GDPRtEXT:isPartOfChapter gdpr:chapterIV .

Security of Personal Data
type: Class
subclass of: Activity
subclass of: Obligation
comment: This activity refers to security of data subject's personal data.
involves: Data Security
involves: Personal Data

Sensitive Personal Data
type: Class
subclass of: Personal Data
comment: Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.
involves: Data Subject

Share Personal Data with Third Party
type: Class
subclass of: Data Activity
comment: This activity represents the sharing of data subject's personal data with a third party.
involves: Controller
involves: Personal Data
involves: Processor

Copy should be in a commonly used format
type: Class
subclass of: Provide copy of Personal Data
comment: The provided copy of personal data should be in a commonly used format

Demonstrable
type: Class
subclass of: Obligation for obtaining consent
comment: Obtained consent should be in a demonstrable form
involves: Demonstrating Consent
involves: Given Consent

Distinguishable from other matters
type: Class
subclass of: Obligation for obtaining consent
comment: Obtained consent should be distinguishable from other related matters (in the context of the process)
involves: Given Consent

Copy should be in a machine readable format
type: Class
subclass of: Provide copy of Personal Data
comment: The provided copy of personal data should be machine readable

Should be structured
type: Class
subclass of: Provide copy of Personal Data
comment: The provided copy of personal data should be structured

Shoud support reuse
type: Class
subclass of: Provide copy of Personal Data
comment: The provided copy of personal data should support reuse

Specific
type: Class
subclass of: Valid Consent
comment: GDPR obligation that specifies consent must be specific for it to be valid.
involves: Given Consent

Specified purpose
type: Class
subclass of: Obligation for data collection
comment: This obligation states that the collection of personal data should happen only for the specified purposes (for which the data subject has consented).
involves: Collection of Personal Data
involves: Processing

Principle of Storage Limitation
type: Class
subclass of: Principle
comment: The principle of storage limitation states that personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject.
involves: Archive Data
involves: Historic, Statistical, or Scientific purposes
involves: Identifiable for required processing
involves: Identification of Data Subject
involves: Personal Data
involves: Public Interest
involves: Store Data

Store Data
type: Class
subclass of: Data Activity
comment: An activity where personal data is being stored
involves: Personal Data

SubPoint
type: Class
subclass of: LegalResourceSubdivision
comment: SubPoint in GDPR text
example: gdpr:article12-5-b a eli:LegalResourceSubdivision, GDPRtEXT:SubPoint ; eli:description "refuse to act on the request."^^xsd:string ; eli:is_part_of gdpr:GDPR, gdpr:article12, gdpr:article12-5, gdpr:chapterIII, gdpr:chapterIII-1 ; eli:number "b"^^xsd:string ; eli:title_alternative "Article12(5)(b)"^^xsd:string ; GDPRtEXT:isPartOfArticle gdpr:article12 ; GDPRtEXT:isPartOfChapter gdpr:chapterIII ; GDPRtEXT:isPartOfPoint gdpr:article12-5 ; GDPRtEXT:isPartOfSection gdpr:chapterIII-1 .

Sub-Processor
type: Class
subclass of: Processor
comment: A sub-processor is a processor acting under another processor.
involves: Controller
involves: Processor

Follow same terms
type: Class
subclass of: Appointing Sub-Processors
comment: Sub-processors must follow the same rules and obligations (or terms) as the agreement between processor and controller.
involves: Agreement between Processor and Controller
involves: Sub-Processor

Systematic Monitoring
type: Class
subclass of: Activity
subclass of: Factors for Impact Assessment
comment: This activity provides a systematic monitoring or overview of processes/activities taking place within the context of the organisation.
involves: Processing

Unlawful Processing
type: Class
subclass of: Processing
comment: Processing of personal data that is termed to be unlawful in the context of the GDPR or other relevant laws and regulations

Use Data
type: Class
subclass of: Data Activity
comment: An activity that uses personal data
involves: Personal Data

Valid Consent
type: Class
subclass of: Given Consent
subclass of: Obligation for obtaining consent
comment: Consent is termed to be valid if it passes all the criteria or obligations laid down by the GDPR.
involves: Freely given
involves: Given Consent
involves: Informed
involves: Specific

Vital Interests
type: Class
subclass of: Lawful Basis
comment: These are obligations pertaining to the vital interests of the data subjects
involves: Data Subject

Voluntary & Opt-in
type: Class
subclass of: Valid Consent
comment: Consent must be obtained through the data subject's voluntary action and should be opt-in and not opt-out or by default.
involves: Given Consent

Voluntary accredition
type: Class
subclass of: Awarding Seals and Certifications
comment: The seals and certifications should be a voluntary system of accredition

Withdrawing Given Consent
type: Class
subclass of: Consent Activity
comment: This activity represents the data subject withdrawing given consent.
involves: Data Subject
involves: Given Consent

comment: TEST
comment: TEST2

comment: An ontology for representing provenance traces pertainining to GDPR compliance. It uses concepts from GDPRtEXT along with extending PROV and P-Plan.

comment: TEST
comment: TEST2