Global Alphabet Soup

Global Screening often involves a lot of acronyms. When I first started in global, I had no idea what most of these meant. And I didn’t want to look uneducated in the eyes of the world, so I muddled through.

Here is a list of the more the more often used global acronyms in use today, so that you don’t have to wonder as I did.

BCR: This stands for Binding Corporate Rules. If you have been following anything about data transfer restrictions from the EU to the US, you may have come across the BCR term. It’s an inter-company contractual arrangement for data protection and is one of the few mechanisms left currently to legitimize the transfer of data from the EU to the US. See the European Commission’s description for more details:

CDGDC: This one doesn’t roll off of a tongue very easiliy, does it? This is the China Academic Degrees and Graduate Education Development Center. It is under the joint leadership of the Ministry of Education and the Academic Degrees Committee of the State Council (ADCSC). This is one of several sources of education history, specifically degree verification, in China.

DPA: Data Protection Authority. This is the regulator in a country that governs that country’s data protection. To find a country’s DPA search the web for “<country name> data protection authority>. Many DPAs have excellent websites with guidance on how to follow the country’s privacy regulation. They may even have items specific to hiring and even screening.

Here are some additional resources to find a country’s data protection authority:

EEA: This is the European Economic Area. It is the EU countries plus Iceland, Liechtenstein and Norway. The last three countries are allowed to be part of the EU’s market without being full members of the EU.

EMEA: This stands for the region covered by Europe, Middle East, Africa.

EU: European Union. Currently 28 member countries in Europe. A list of the member countries is at:

FCRA: Global screening also includes the United States. Remember, to a company located in Asia, Europe, Africa, Canada, … the United States is an “international” location. The FCRA stands for the Fair Credit Reporting Act. Regardless of the name, this is not just something pertaining to credit reports. It pertains to information provided by a Consumer Reporting Agency. It’s riveting reading and if you are processing background screens in the US, you should be familiar with it. Here is the FCRA text: And the companion document 40 Years of Experience with the Fair Credit Reporting Act: If you are a background screening company, then review the information on the FTC’s business blog:

FTC: The FTC goes hand in hand with the FCRA, as they are one of the entities regulating background screeners. They are in active enforcement mode, in addition to providing helpful information to candiates (aka “consumers”), employers, and background screeners (aka “CRA”).

GDPR: General Data Protection Regulation: This is the new data protection regulation for the EU that will come into force May 2018; It will replace the current EU Data Protection Directive ( See the European Commission’s web page for more information: Several web pages from EU DPAs also have infomration related to the GDPR. The Information Commissioner’s Office from the UK is a good resource for English speakers:,

ICO: Information Commissioner’s Office. This is the data privacy regulator for the UK. The ICO has a lot of great support information for employers that even covers background screening. The main website for the ICO is: Screening guidance is found here: . There are several DPAs with websites but the ICO is one that provides a great deal of helpful information, especially for English speakers. It’s a good intro if you need to understand data protection in the EU. Be aware that each EU member has their own data protection regulation, which may differe significantly from the UK’s regulations. What you learn from the ICO applies specifically to the UK and may help you to understand other EU member’s requirements but will not pertain 100% to all EU members.

OPC: Office of the Privacy Commissioner of Canada. This is Canada’s Federal privacy regulator. Note that Provinces and Territories may have their own regulators: As with so many privacy regulators, the OPC and many of the Provinces and Territories have excellent guidance on their websites for help with adhering to the local privacy regulations and even cover topics such as screening.

PDPA: Personal Data Protection Act. This could refer to several country’s privacy regulations but often it refers to Singapore’s privacy regulation ( Another great resource if you are processing background checks in or from Singapore.

PII: Personally Identifiable Information. This is information that identifies an individual. Different privacy regulations have different definitions. In some cases it is not only information that identifies an individual but it may information that CAN identify an individual. Information identifying an individual would be something that points to a specific individual, such as a person’s person’s name and identity number together. It directly identifies that person. Identifiable information would be information that indirectly identifies an individual. This could be through referenences that allow you to put “two and two together” or by combining two individual forms of information, such as two files. The OPC has a good discussion on the topic: Also see the OPC’s discussion on Personal Information (Section 1.1) in their Leading by Example publication: The US Department of Labor also has a nice explaination:

PIPEDA: This is the Canadian Federal privacy regulation: The Personal Information Protection and Electronic Documents Act. Provincial regulations may apply if they are considered substantially similar to PIPEDA. These are currently:

British Columbia’s Personal Information Protection Act.

SNAFU: Systems Normal, All Fouled Up. Couldn’t resist adding this as it seems so appropriate to data protection and global these days.

SPII: Sensitive Personally Identifable Information. Outside of the US it may be referred to as Special Personally Identifiable Information. This is PII that requires extra protection because it can be especially damaging to the individual. What is categorized as sensitive will vary by country and is quite different in the US than outside of the US. In the US, sensitive PII involves information most involved in identity theft, such as the combination of a person’s name, date of birth, and social security number. In the EU, and in countries who have privacy regulations modeled after the EU Data Protection Directive, sensitive data elements are those involved in high levels of discrimination, such as criminal history, religion, ethnicity. Some countries also add ID numbers and documents to their definition of sensitive PII. The ITLawWiki does a nice job of explaining SPII as it pertains to the US:

SSN: For readers outside of the United States, the SSN is usually referring to the US Social Security Number. This is our Tax ID number. It was never meant to be a country identification number but in many cases that is how it is used. The SSN is issued by the Social Security Administration (SSA): Interesting information about the history of SSA and the SSN is at:

Kerstin Bagus – Director, Global Initiatives



kerstinbagus - Global Alphabet Soup


Let’s start a conversation

contact Contact