The vocabulary, without the consultancy fog.
24 entries. Each opens with a sentence you can quote in a meeting, then goes deeper.
24
terms explained
- Law10
- Technology6
- Practice6
- Policy2
24 of 24
- Law
Adequacy decision
An adequacy decision permits transfers to a third country without extra safeguards — until it is struck down.
- Technology
Certifications
A certificate examines operations, not the ownership chain.
- Law
Cyber Resilience Act
Software and connected devices will need security updates for a defined period — with CE marking.
- Practice
Data processing agreement
Three clauses decide it: sub-processors, place of processing, deletion after termination.
- Technology
Data residency
Data residency says where the data sits. Not who is allowed to reach it.
- Technology
Data trustee
A trustee only holds up if it is economically and legally independent of the provider.
- Law
Digital Markets Act
The DMA forces large platforms into portability and interoperability — a lever almost nobody uses.
- Practice
Digital sovereignty
Sovereignty is not a state but the answer to four questions: law, operations, data, capability.
- Law
DORA
In the financial sector a documented exit plan has been mandatory since 2025, not optional.
- Law
EU AI Act
The AI Act reaches mid-sized companies mainly through recruitment and worker monitoring.
- Law
EU Data Act
Your machine data belongs to you, and switching clouds may barely cost anything.
- Practice
Exit strategy
An exit plan that was never executed is a guess.
- Law
FISA 702
US intelligence agencies may access Europeans' data held by American providers, and those affected are not told.
- Policy
Gaia-X
Gaia-X is not a cloud but a framework for describing provider properties in a verifiable way.
- Technology
Key control
Encryption only helps if the provider does not hold the key.
- Law
NIS2
NIS2 may not cover you, but it covers your biggest customer — who passes the duties on.
- Technology
Open standards
A format is open when more than one implementation exists — anything else is documentation.
- Policy
Public money, public code
Software the public paid for should be software the public may use.
- Law
Schrems II
Since 2020 you must assess yourself whether data is safe in the recipient country — the provider cannot do it for you.
- Practice
Shadow IT
Shadow IT is rarely disobedience. It shows where the official tool fails to do a job.
- Technology
Sovereign cloud
Sovereign cloud is not a protected term. Ask which of the four layers the provider actually means.
- Practice
Sovereign workplace
A sovereign workplace is not a product but five stages in the right order.
- Law
US CLOUD Act
US providers must hand over data even when it sits in Frankfurt.
- Practice
Vendor lock-in
Lock-in is not a property of a product. It is a number: what leaving would cost you.
Tool 01
Where does your company hang?
From six minutes. No sign-up, computed in your browser.