Glossary

Audit, compliance, and AI terms worth knowing.

12 terms

• DPO (Data Protection Officer)

  An organizational role responsible for overseeing data-protection strategy and ensuring compliance with privacy laws like PDPA and GDPR. Required when an organization processes sensitive personal data at scale or systematically monitors data subjects.

• Force majeure

  A contract clause that excuses a party from performance when extraordinary events outside their control prevent them from fulfilling obligations — wars, pandemics, natural disasters, government actions. Clauses vary widely in scope and specificity; a vague force majeure is nearly useless.

• Gap analysis

  A structured comparison between an organization's current state (policies, controls, evidence) and a target state defined by a standard or framework. Outputs a prioritized list of differences (gaps) and remediation actions.

• GDPR

  The General Data Protection Regulation (EU) 2016/679 — the European Union's comprehensive data-protection law. Applies extraterritorially to organizations outside the EU that offer goods/services to EU residents or monitor their behavior.

• Indemnification clause

  A contract provision where one party agrees to compensate the other for specified losses, damages, or third-party claims. The structure (mutual vs. one-sided, capped vs. uncapped) is one of the highest-impact terms to scrutinize before signing.

• IP assignment

  A contract clause specifying who owns intellectual property created during the engagement — work product, inventions, copyrights, and derivative works. Default rules vary by jurisdiction and contract type, so an explicit clause is almost always safer than silence.

• ISMS (Information Security Management System)

  A systematic approach to managing sensitive company information so that it remains secure. Includes policies, processes, people, and technology. Required structure for ISO 27001 certification.

• ISO 27001

  International standard specifying the requirements for an Information Security Management System (ISMS). The current revision is ISO/IEC 27001:2022, defining 93 controls across organizational, people, physical, and technological categories.

• Liability cap

  A contract term that limits the maximum financial exposure of a party for claims arising from the contract — typically expressed as a multiple of the contract value or fees paid. A reasonable cap is one of the most important protective clauses for individuals and small businesses.

• PDPA (Thailand)

  The Personal Data Protection Act B.E. 2562 (2019) — Thailand's comprehensive data-protection law. Applies to any organization processing personal data of people in Thailand, regardless of company size or country of registration.

• SOC 2

  An AICPA attestation report that evaluates a service organization's controls against one or more of the five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Comes in Type I (point-in-time) and Type II (period coverage).

• Termination for cause

  A contract clause allowing one party to terminate the agreement when the other party materially breaches it. Typically paired with a notice period and a cure window. Healthy contracts have both 'termination for cause' AND 'termination for convenience' clauses, each with reasonable triggers.