Glossary

An awareness session is a short talk, 30 to 45 minutes, in which you tell the people who handle personal data what it is, how to look after it and who to tell when something goes wrong.

In Trident, you record each session in the Training Register in the Compliance Hub. See training record.

The band is where your Privacy Posture score sits: at risk, developing, adequate or strong.

In Trident, the band shows beside your score on the Privacy Posture page (Posture, under Overview).

The baseline check is a free set of questions on Privacy Lab Africa that gives your organisation its first privacy score. It takes about 10 minutes.

In Trident, a card on the Dashboard offers Start baseline check until your organisation has a Privacy Lab Africa score. The check opens on the Privacy Lab Africa site.

A breach, or incident, is personal data that is lost, stolen, sent to the wrong person or seen by someone who should not see it: a stolen laptop, an email to the wrong customer, a phishing click, ransomware.

In Trident, you log one with Report incident in the Breach & Incident Register in the Compliance Hub. When you confirm it is a breach, Trident tracks the 24-hour deadline to notify POTRAZ, counted from when you became aware of it.

Read more on Privacy Lab Africa: data breach (opens in a new tab) and the 24-hour breach rule (opens in a new tab).

A cross-border transfer is data leaving Zimbabwe, including to a cloud service hosted abroad, which covers many everyday tools.

In Trident, the Cross-Border Transfers register in the Compliance Hub lists them. On a RoPA activity, the Retention & security tab has a box to tick when personal data leaves Zimbabwe.

A data asset, or system, is a place personal data is kept: a laptop folder, Google Drive, a WhatsApp group, a filing cabinet.

In Trident, systems are called Data Assets and have their own register in the Compliance Hub.

Data categories are the kinds of personal data an activity uses: names, ID numbers, bank details, payslips, photos, CCTV images.

In Trident, you choose them under Categories of personal data on the Data tab of a RoPA activity.

A Data Controller licence is a licence POTRAZ issues to organisations that decide what personal data to collect and why.

In Trident, the Licensing page in the Assessments Hub prepares your application (Form DP1), and Assegai files it with POTRAZ for you. When you hold the licence, you record its number on the DPP page with Record registration.

Read more on Privacy Lab Africa: SI 155 in plain English (opens in a new tab) and the POTRAZ tier and DPO checker (opens in a new tab).

A data processing agreement, or DPA, is a written agreement with a vendor about how they protect your data.

In Trident, you attach a vendor's DPA to its record in the Relationships Register. The register's DPA column shows On file or Missing.

Read more on Privacy Lab Africa: working with vendors and processors (opens in a new tab) and the vendor and DPA checker (opens in a new tab).

Your Data Protection Plan, or DPP, is the list of data protection jobs Trident keeps for you, each with a due date.

In Trident, DPP under Overview opens your plan. Each item shows its task, and items with a due date get a task on the Tasks page in the Work Hub.

Your DPO, or data protection officer, is the person who answers for data protection in your organisation. In a small business that is often the owner or the admin.

In Trident, the DPO page in the Assessments Hub prepares your appointment filing (Form DP2), which Assegai files with POTRAZ. Your DPO is then shown on the Organisation page, under Consultant & DPO.

Read more on Privacy Lab Africa: data protection officer (opens in a new tab) and do you need a DPO? (opens in a new tab)

Data subjects are the people the data is about: staff, job applicants, customers, visitors.

In Trident, you choose them under Categories of data subject on the Data tab of a RoPA activity.

Read more on Privacy Lab Africa: data subject (opens in a new tab).

Draft means you have started a record. Approved means someone has checked it and signed it off. Missing marks something a record still needs: a to-do for you to fill in.

In Trident, a RoPA activity shows Draft until someone selects Approve; it then shows Active, and Under Review if it changes after approval. Missing appears in the Conditions card on an activity's Overview tab.

A hard gate is something that holds your Privacy Posture band down until you fix it, such as having no RoPA record.

In Trident, the Privacy Posture page lists your hard gates in its Hard gates section.

The legal basis is the reason you are allowed to use the data. If you are unsure which one applies, leave it unset and ask your DPO.

In Trident, Legal basis and Legal basis rationale are on the Core tab of a RoPA activity.

Read more on Privacy Lab Africa: consent, cookies and lawful basis (opens in a new tab).

Not yet on your RoPA is a list of the data assets and vendors that no activity uses yet. Linking means telling Trident which system or vendor an activity uses: your payroll provider supports Payroll, and your HR folder holds the staff files.

In Trident, the card sits on the RoPA register page in the Compliance Hub. Each entry has a Create activity button.

Personal data is any information about a person who can be picked out from it. A name with a phone number, a copy of a national ID, a payslip, a home address, a photo, a CCTV image, a medical aid number and bank details are all personal data. In your organisation that includes your staff files, your customer list, the numbers in a work WhatsApp group and the names in a visitors' book. Zimbabwe's Cyber and Data Protection Act calls it personal information.

In Trident, you record the personal data each activity uses on the Data tab of its RoPA record, under Categories of personal data.

Read more on Privacy Lab Africa: personal data (opens in a new tab).

POTRAZ is the regulator for data protection in Zimbabwe.

In Trident, the Authority Contact register in the Compliance Hub logs your filings and correspondence with POTRAZ. Licence applications are filed with POTRAZ, and a confirmed breach starts a 24-hour deadline to notify it.

A privacy notice is the page that tells people what you do with their data: who you are, what you collect, why, who gets it and how they can reach you.

In Trident, Policies in Policies & Plans drafts one for you: choose New policy / notice, then Privacy notice. Issue final marks it as issued.

Read more on Privacy Lab Africa: privacy notice (opens in a new tab) and do I need a privacy policy or notice? (opens in a new tab)

Your Privacy Posture is a score out of 100 that Trident works out from what you have recorded: your licence, your records, your policies, your training. It is a snapshot of what is recorded, not a verdict that your organisation is or is not compliant.

In Trident, Posture under Overview opens the Privacy Posture page, with your score, its band and any hard gates.

Processing means anything you do with personal data: collect it, store it, look at it, share it or delete it. An activity is one job that does this, such as paying staff.

In Trident, each activity is one record in the RoPA, with its own Activity name.

Read more on Privacy Lab Africa: processing (opens in a new tab).

The purpose is what an activity is for, in plain words: paying salaries, delivering orders, keeping visitors safe.

In Trident, Purpose is on the Core tab of a RoPA activity.

Retention is how long you keep the data and how you destroy it.

In Trident, the Retention & security tab of a RoPA activity holds the Retention period and the Deletion method.

Read more on Privacy Lab Africa: keeping and deleting data (opens in a new tab).

A Record of Processing Activities, or RoPA, is a list of the things you do with personal data, with a name for each: paying staff, taking orders, recording visitors. Later you add detail to each line: whose data, what data, why you may use it and how long you keep it. It is the record that shows you know what personal data you hold and why, and in Trident your other registers link back to it.

In Trident, the RoPA is a register in the Compliance Hub. Its How this works button opens a short summary, About the RoPA.

Read more on Privacy Lab Africa: what is a RoPA? (opens in a new tab) and the RoPA starter (opens in a new tab).

Sensitive data is personal data that needs extra care, such as health or biometric data.

In Trident, Sensitive categories is a separate list on the Data tab of a RoPA activity, with a box to tick when an activity involves sensitive personal information.

A training record is Trident's note that a session happened: who attended, when, the result and when to repeat it.

In Trident, New Training in the Training Register (Compliance Hub) adds one.

A vendor is a company outside your organisation that handles personal data for you, such as your accountant, payroll software, courier or alarm company. The Cyber and Data Protection Act calls these data processors.

In Trident, vendors are kept in the Relationships Register in the Compliance Hub, also called the Vendor Register, because a vendor is one kind of relationship.

Read more on Privacy Lab Africa: data processor (opens in a new tab).