SECAI Core · phase 8 of 15 · noun

General Data Protection Regulation

Provisions and requirements protecting the personal data of European Union (EU) citizens. Transfers of personal data outside the EU Single Market are restricted unless protected by like-for-like regulations, such as the US's Privacy Shield requirements.

The Explain card

Plain English
The GDPR sets out the rules for protecting the personal data of EU citizens. Moving that data outside the EU Single Market is restricted unless equivalent protections are in place.
Example
A European retailer wants to fine-tune a model on customer support transcripts using a US-hosted AI service. Because the transcripts contain personal data, the transfer needs a lawful basis and adequate safeguards, and the processing itself may need to be disclosed to customers.
Why it matters
AI systems ingest, memorise and sometimes regurgitate personal data. Defenders need to know where prompts, embeddings and training sets physically live, and whether that location is allowed.
Hook
Personal data has a passport, and it does not travel freely.

Word knowledge

How the word is built, where it came from, and what it sits beside in memory.

In a sentence

The privacy review maps each training-set field against the General Data Protection Regulation lawful-basis list before the model is approved.

Why these words
  • general Latin generalis, of a whole class, from genus, kind marks the named instrument as the horizontal rule rather than a sector-specific one
  • data Latin data, things given, plural of datum, from dare, to give names the material the phrase is written about
  • protection Latin protectio, a covering in front, from protegere, to cover names the covering activity the phrase assigns to the instrument
  • regulation Latin regulatio, a controlling by rule, from regula, a straight stick supplies the head noun, the kind of EU legal act
Where it came from
Origin
English official short title of Regulation (EU) 2016/679, from Latin generalis (of a whole class), data (things given), protectio (a covering in front), and regulatio (control by rule)
Entered the language
2012
What changed
General had meant of a whole class. Data had meant things given, then facts, then computer records. Protection had meant covering in front, then legal safeguarding. Regulation had meant a carpenter's rule, then a rule of law, then an EU act that binds directly. The Commission joined the four words in 2012 as the English short title of the proposal that became law in 2016.
How it is spelled
Pattern
g before e in general is said like the g in giant
Pattern
-tion nouns sit beside -t verbs and -ate verbs
Pattern
Data keeps the Latin -a ending
Pattern
Latin regula keeps g, never a j
Breaks the pattern
the four-word title stays unhyphenated; GDPR is the initialism, not a spelling of the phrase
Breaks the pattern
Data is historically plural but this title treats it as a mass noun
Breaks the pattern
each word is capitalised even mid-sentence because the phrase is an official short title

Spelled like

  • generation
  • information
  • regular
  • datum
Broken into chunks
  • gener
    • generate
    • generic
    • generation
  • al
    • cultural
    • original
    • typical
  • dat
    • datum
    • date
    • metadata
  • pro
    • proceed
    • progress
    • produce
  • tect
    • detect
    • protect
    • undetected
  • regul
    • regular
    • regulate
    • irregular
  • ation
    • information
    • formation
    • station
What it sits beside

Same subject

Same shape

EU digital laws

Privacy statutes

  • California Consumer Privacy Act
  • Health Insurance Portability and Accountability Act
  • Data Protection Directive

GRC frameworks

Where it sits in the deck

Phase 8: Governance, Risk, and Compliance Frameworks

Individual controls need a governance envelope — introduce the risk and compliance structures, standards bodies, and regulations that frame AI accountability at scale.

Neighbours in this phase