Compliance glossary — ISO, PCI DSS, GDPR and VAT terms explained
Plain-English definitions of the terms that come up in every compliance, auditing and training conversation in Bahrain and the Gulf. New terms are added as we publish guides.
ISO and certification terms
| Term | Meaning |
|---|---|
| ISO 9001 | The quality management standard — processes, records and continual improvement. |
| ISO 27001 | The information security standard — an ISMS protecting data and systems. |
| ISO 14001 | The environmental management standard. |
| ISO 45001 | The occupational health and safety standard. |
| ISO 22000 / HACCP | Food safety management standards. |
| Gap analysis | Comparing current practice against the standard to find the difference. |
| Stage 1 / Stage 2 audit | The two-phase certification audit: documentation review, then full assessment. |
| Surveillance audit | The annual check that keeps certification valid between cycles. |
| Certification body | The accredited organisation that issues the certificate. |
PCI DSS terms
| Term | Meaning |
|---|---|
| PCI DSS | The Payment Card Industry Data Security Standard. |
| SAQ | Self-Assessment Questionnaire — how most merchants validate compliance. |
| ROC | Report on Compliance — the full QSA assessment for Level 1 merchants. |
| QSA | Qualified Security Assessor — an approved assessor for PCI DSS. |
| ASV | Approved Scanning Vendor — runs your required quarterly scans. |
| Cardholder data environment | The systems that store, process or transmit card data. |
GDPR and privacy terms
| Term | Meaning |
|---|---|
| GDPR | The EU General Data Protection Regulation. |
| PDPL | Bahrain’s Personal Data Protection Law (Law No. 30 of 2018). |
| RoPA | Records of processing activities — the inventory GDPR requires. |
| DPO | Data Protection Officer — required for some processing activities. |
| Lawful basis | The legal reason you may process personal data. |
VAT and financial terms
| Term | Meaning |
|---|---|
| VAT | Value Added Tax — 10% in Bahrain since January 2019. |
| NBR | The National Bureau for Revenue — Bahrain’s tax authority. |
| Input VAT | The VAT you pay on purchases and can reclaim. |
| Output VAT | The VAT you charge on sales. |
| Feasibility study | The analysis proving a venture is viable — required by banks and Tamkeen. |
Need the full picture?
Explore the learning hub for structured guides, or ask us directly — we answer in plain English.
