Corrective action
Action that eliminates the cause of a non-conformity, so that the problem does not happen again. It differs from a simple correction because it acts on the source and not just on the effect.
Knowledge · Glossary
Document management and HSE glossary
This document management glossary brings together the terms most often used in the documentation of companies, workers and equipment. It mainly covers document management, occupational health and safety (HSE/OSH), contractor approval, access control, data protection, cybersecurity and document AI. Each definition is short and neutral, so that HSE, procurement, operations and compliance teams use the same language.
A document management glossary is an organised list of terms and definitions that sets the meaning of the words used in document processes. As a result, it reduces ambiguity in requirements, contracts, procedures and audits. The terms are grouped by letter and, where the site has an article or page on the topic, the definition includes a link to find out more. To apply these concepts day to day, you can also download our free document management and HSE resources.
Accident at work
An event that occurs at the place and time of work and that directly or indirectly causes injury, illness or death to the worker. In Portugal, compensation for the damage has its own legal regime, so the employer must transfer that liability to an insurer. Document management contributes to prevention because it confirms training, fitness for work and equipment before the work starts.
API
Application programming interface: a set of rules that allows two systems to exchange data automatically. On a document platform, for example, it makes it possible to synchronise workers and compliance statuses with an ERP.
Qualified electronic signature
Electronic signature created with a qualified device and based on a qualified certificate, under Regulation (EU) No 910/2014 (eIDAS). In the European Union, it has the same legal effect as a handwritten signature.
Document audit
Systematic check of documents and records to confirm whether they meet the applicable requirements. It can be internal or external and focuses mainly on expiry dates, versions, approvals and evidence.
Multi-factor authentication (MFA)
Authentication method that requires two or more independent factors, such as a password and a code generated on a mobile phone. As a result, a stolen password is no longer enough to access the account.
Document automation
Use of rules and technology to carry out repetitive tasks without manual intervention, such as requests, alerts, routing or classification. However, it only brings gains when the underlying process is clearly designed.
Risk assessment
Process that identifies the hazards of an activity, estimates the risks and defines the prevention measures. In Portugal, it is a general obligation of the employer under Law no. 102/2009.
Backup
Copy of data, kept separately from the original, that allows information to be recovered after a failure, error or attack. However, it is only valuable if the organisation regularly tests the restore.
3-2-1 backup
Rule of thumb that recommends three copies of the data, on two different types of media, with one copy off site. In addition, the 3-2-1-1-0 variant adds an offline or immutable copy and zero errors when the restore is verified.
No-debt certificate
Document proving that a company's tax or social security situation is in order with the Portuguese Tax Authority or Social Security. It is usually part of the company document requirements and has a limited validity.
A1 certificate
Document that states which social security legislation applies to a worker who works in another EU Member State, in the EEA or in Switzerland. For this reason, companies often request it for posted workers.
Document classification
Assignment of each document to a class or type, according to criteria such as function, subject or confidentiality level. In this way, it makes searching, access control and the setting of retention periods easier.
Technical compilation (health and safety file)
Set of information that is useful for the future use of the works, as well as for any work carried out after completion. Decree-Law no. 273/2003, which regulates safety on temporary or mobile construction sites, provides for this document.
Document compliance
Status in which a company, worker or piece of equipment has all the required documents, valid and approved for a specific context. Therefore, compliance depends on the project, the role and the date, and not just on the document.
Access control
Set of rules and means that decides who can enter a site or use a system, and under what conditions. In an HSE context, for example, physical access can depend on the document compliance of the worker and the company.
Construction safety coordination
Role provided for in Decree-Law no. 273/2003 that ensures prevention principles are applied in the design and execution of the works. The coordinator acts on behalf of the project owner and mainly oversees the health and safety plan.
Credential
Means of personal identification, physical or digital, that links a worker to their access authorisation. It can include a photo, QR code, barcode or RFID tag, so that checks at the entrance happen without delay.
Personal data
Any information relating to an identified or identifiable natural person, according to the GDPR definition. It includes, for example, name, identification number, photo, health data or location data.
Dashboard
Visual panel that brings together indicators and statuses on a single screen, such as missing documents, documents about to expire or compliant companies. As a result, it supports decisions, but only when the source data is reliable.
Digitisation
Conversion of paper documents into digital format, usually with a scanner. On its own, it does not organise or validate information, because a PDF is still just an image of the document.
Project owner (client)
Natural or legal person on whose behalf the works are carried out, under Decree-Law no. 273/2003. Among other obligations, it must appoint the safety coordinators whenever the law requires it.
Data protection officer (DPO)
Person appointed by the controller or the processor to advise on and monitor compliance with the GDPR. In addition, they cooperate with the supervisory authority, which in Portugal is the CNPD.
Encryption
Technique that turns readable data into an unreadable format without the correct key. It protects information in transit and at rest, so it reduces the impact of unauthorised access or the theft of a device.
Issuing body
Organisation that issues a document and is responsible for its authenticity, such as an insurer, an occupational health service or a training provider. In validation, therefore, confirming the issuing body is as important as checking the expiry date.
Executing contractor
Natural or legal person that carries out all or part of the works, in accordance with the approved design and the applicable rules. It usually includes the contractor and subcontractors, who are responsible for the safety of their own workers.
PPE (personal protective equipment)
Equipment that workers use to protect themselves against risks that cannot be eliminated by other means, such as a helmet, gloves, a harness or hearing protection. For this reason, personal protection comes after collective measures in the hierarchy of prevention.
Documentary evidence
Record or document that demonstrates compliance with a requirement or that an activity was carried out. In an audit, a statement without evidence has little value, whereas a dated and traceable record makes it possible to prove it.
Data extraction
Automatic identification of fields in a document, such as name, expiry date, issuing body or policy number. It generally combines OCR with rules or AI models, but should include human review for low-confidence cases.
Medical fitness certificate (FAM)
Document issued by the occupational physician after a health examination, stating the result regarding fitness for the role, for example fit, fit with restrictions or unfit. It must not contain clinical data covered by medical confidentiality; however, it has a renewal deadline that should be monitored.
Contractor management
Set of processes to select, approve, monitor and assess the external companies that work for an organisation. It mainly includes document requirements, expiry dates, access and safety performance.
Document management
Set of rules, processes and tools that controls the life cycle of documents, from creation or receipt to retention or disposal. In an HSE context, it also includes validating requirements and expiry dates, because documentation determines whether work can go ahead.
Data governance
Set of responsibilities, policies and rules that defines who decides about data, how its quality is maintained and who can access it. As a result, it prevents each team from creating its own fields and criteria without coordination.
Contractor approval
Process that checks whether a contractor meets the legal, contractual and safety requirements before work starts. However, it does not end with the initial approval, because documents expire and requirements change.
Worker approval
Individual check of each external worker, based on documents such as identification, medical fitness certificate, training and safety induction. In this way, authorisation to work depends on the specific person and not just on the company.
HSE
Acronym for health, safety and environment. It refers to the area that manages risk prevention for people and the environment, as well as the related documentation and indicators.
Document AI
Application of artificial intelligence to document processing, for example to classify, extract data, compare against requirements or suggest decisions. In compliance processes, it should work with human oversight and a record of decisions, since errors have an operational impact.
IAM
Identity and access management: processes and tools that create, change and remove accounts and permissions. Above all, it ensures that each person has only the access they need.
Key performance indicator (KPI)
Metric that measures progress towards a relevant objective, such as the percentage of compliant contractors or the average validation time. However, a KPI is only useful when it has a clear definition, a reliable source and an owner.
Safety induction
Onboarding session that informs a worker about the risks, rules and procedures of a site before they start work. It can be in person or digital and usually ends with a questionnaire that records understanding.
Data integrity
Property that ensures data remains accurate, complete and free from unauthorised changes. To verify it, platforms use, for example, hash functions, version control and logs.
Interoperability
Ability of different systems to exchange and use information consistently, through APIs, standard formats or integrations. In this way, it avoids entering the same data repeatedly on several platforms.
ISO 27001
International standard that sets out the requirements for an information security management system (ISMS). Certification by an accredited body therefore shows that the system has passed an independent audit.
ISO 27701
International standard for privacy information management, which complements ISO 27001 with requirements and controls for processing personal data. For this reason, it helps demonstrate how GDPR principles are applied in practice.
ISO 45001
International standard that specifies the requirements for an occupational health and safety management system. Like other ISO management standards, it is based on the plan, do, check, act cycle.
Law no. 102/2009
Legislation that establishes the legal framework for promoting occupational safety and health in Portugal. For example, it defines the general obligations of the employer, the organisation of OSH services and health surveillance.
LGPD
Brazil's General Personal Data Protection Law (Law no. 13.709/2018), which regulates the processing of personal data. Although its principles are close to those of the GDPR, it has its own rules and supervisory authority, the ANPD.
Audit logs
Chronological records of actions in a system, such as logins, uploads, approvals or changes, with user, date and time. Therefore, they make it possible to reconstruct who did what and when.
Machine learning
Branch of artificial intelligence in which systems learn patterns from examples, instead of following only hand-written rules. In document management, it is used in particular to classify documents or detect anomalies.
Requirements matrix
Table that defines the documents required for each type of company, role, activity or project. As a result, the same worker can be compliant on one project and non-compliant on another.
Metadata
Data that describes a document, such as type, holder, issuing body, issue date, expiry date or version. Without consistent metadata, search and indexing become less reliable, because they depend on these fields.
Data migration
Transfer of data and documents from one system to another, for example when changing platform. It requires cleansing, field mapping and validation, because carrying over old errors creates new problems.
Large language model (LLM)
AI model trained on large volumes of text to understand and generate natural language. It can summarise, classify or answer questions about documents; however, it can make mistakes, so critical answers require verification.
Non-conformity
Failure to meet a legal, regulatory, contractual or internal requirement. In general, it should be recorded, its cause analysed and, whenever justified, a corrective action taken.
NIS 2
Directive (EU) 2022/2555, which strengthens the cybersecurity obligations of entities in critical and important sectors, such as energy. Above all, it requires risk management, incident reporting and attention to supply chain security.
No-code
Approach that allows forms, fields, rules and workflows to be configured through visual interfaces, without writing code. In this way, process changes depend less on custom development.
OCR
Optical character recognition: technology that converts text in scanned images or PDFs into searchable text. However, reading the text is not the same as understanding the document or validating it.
Configuration (parameterisation)
Setting up a platform according to the client's rules: document types, requirements, expiry dates, profiles, flows and notifications. A well-planned initial configuration therefore avoids rework and manual exceptions.
PDF/A
Version of the PDF format standardised by ISO 19005 for long-term preservation. It embeds in the file itself the elements needed for future display, such as fonts, and is therefore suitable for archiving.
Permit to work
Formal authorisation that defines the safety conditions for carrying out high-risk work. It applies, for example, to hot work, confined spaces or work on energised equipment. Before issuing it, the compliance of the team and of the documentation should be confirmed.
Phishing
Social engineering attack that uses fraudulent messages to trick the victim into revealing credentials, opening malicious attachments or making payments. In addition, there are variants by SMS (smishing) and by voice (vishing).
Document management plan
Document that defines how an organisation creates, classifies, approves, stores and disposes of its documentation. Ideally, it should exist before the platform is chosen, because it guides the configuration.
Health and safety plan (PSS)
Document that, for works covered by Decree-Law no. 273/2003, defines the prevention measures for the foreseeable risks. The project owner arranges for it to be drawn up at the design stage and, afterwards, the executing contractor develops it for the construction phase.
Document management platform
Software that centralises documents and their associated data, with access rules, versions, expiry dates, workflows and search. Unlike a shared folder, it controls the status and history of each document.
HSE platform
Digital platform that brings together safety, health and environment processes, such as document management, inspections, non-conformities, work permits and indicators. As a result, it replaces scattered spreadsheets and emails with traceable processes.
Retention period
Period during which a document must be kept, for legal, contractual or operational reasons. Once that period ends, the organisation must delete or anonymise the personal data, unless there is another basis for keeping it.
Principle of least privilege
Security rule under which each user receives only the permissions needed for their role. In this way, it limits the damage caused by an error or a compromised account.
Pseudonymisation
Processing that replaces direct identifiers, such as the name, with codes, so that the data can only be linked to the data subject using additional information kept separately. However, pseudonymised data is still covered by the GDPR.
Ransomware
Malicious software that encrypts or locks data and demands a ransom to release it. The best defence combines prevention, immutable or offline backups and restore tests, because paying does not guarantee recovery.
Traceability
Ability to reconstruct the history of a document or decision: who uploaded it, who validated it, when and on what criteria. In audits, it makes it possible to show that each decision was in fact well founded.
AI Act (Artificial Intelligence Regulation)
Regulation (EU) 2024/1689, which lays down harmonised rules on artificial intelligence in the European Union. It classifies systems by risk level and imposes documentation, transparency and human oversight obligations, especially on high-risk systems.
Document rejection
Decision not to accept a document because it is illegible, expired, incomplete or does not match the requirement. To avoid rework, the rejection should state the reason clearly.
Document requirements
List of documents that a company, worker or piece of equipment must provide to be compliant in a given context. They generally vary with the activity, the risk, the country and the client.
Data controller
Entity that determines the purposes and means of processing personal data, under the GDPR. It is therefore responsible for complying with the data protection principles and must be able to demonstrate it.
RFID
Radio-frequency identification: technology that reads tags without contact or a direct line of sight. In HSE, for example, it is used to identify workers at access control or equipment during inspections.
GDPR (RGPD)
General Data Protection Regulation, that is, Regulation (EU) 2016/679, applicable since May 2018. It defines principles, data subjects' rights and obligations for anyone who processes personal data in the European Union.
RPO and RTO
Business continuity metrics used in recovery planning. The RPO (recovery point objective) indicates the maximum acceptable data loss, measured in time. On the other hand, the RTO (recovery time objective) indicates the maximum acceptable time to restore the service.
SaaS
Software as a service: model in which the supplier hosts and maintains the application and the client accesses it over the internet through a subscription. As a result, infrastructure, updates and backups are generally the supplier's responsibility.
Occupational accident insurance
Compulsory insurance that transfers the employer's liability for compensating accidents at work to an insurer. In contractor approval, the policy, proof of payment and list of covered workers are usually checked.
Cross-platform synchronisation
Automatic or assisted updating of the same data in several systems, for example on the central platform and on the clients' platforms. It reduces manual errors, but requires clear rules on which system prevails.
SLA
Service level agreement: a contractual commitment that sets minimum service levels, such as availability, response time or resolution time. For this reason, it serves as a benchmark for measuring the supplier's performance.
SSO
Single sign-on: a mechanism that allows access to several applications with a single identity, usually the organisation's. It simplifies account management, because deactivating the central identity removes all the associated access.
OSH (SST)
Occupational safety and health: the area that prevents occupational risks and protects the physical and mental integrity of workers. In Portugal, the general legal framework is set out mainly in Law no. 102/2009.
Subcontracting
Situation in which a contractor hands over part of the work to another company, creating a chain (A → B → C). Each level must meet the document requirements, so that the client knows who is on site.
Processor (GDPR)
Entity that processes personal data on behalf of the controller, such as a SaaS platform provider. In this respect, the relationship requires a contract with the guarantees set out in Article 28 of the GDPR.
Human oversight
Principle under which a person can monitor, validate or correct the decisions of an AI system. In document validation, for example, the AI suggests and the validator decides in critical cases.
Restore test
Exercise that recovers data from a backup to confirm that the copy is intact and usable. Without this test, therefore, the organisation has no guarantee of recovery.
Document type
Type of document with its own characteristics and rules, such as insurance, fitness certificate, training certificate or declaration. Each document type defines, in particular, the mandatory fields, the validity period and the acceptance criteria.
Data subject
Natural person to whom the personal data relates, such as a worker going through the approval process. Under the GDPR, they have rights of access, rectification, erasure, objection and portability, among others.
Posted worker
Worker who, for a limited period, provides services in another Member State on behalf of their usual employer. For this reason, approval may require additional documents, such as the A1 certificate.
Document validation
Analysis of a document to confirm its authenticity, legibility, holder, issuing body, validity and fit with the requirement. Only after this analysis, therefore, does the document count towards compliance.
Document validity
Period during which a document has effect or is considered up to date. When it expires, the holder may lose compliance, so alerts should be issued before the deadline.
Versioning
Control of the successive versions of a document, recording changes, author and date. In this way, everyone uses the current version and the history remains available for audits.
Personal data breach
Security incident that leads to the unauthorised destruction, loss, alteration or disclosure of, or access to, personal data. Under the GDPR, the controller must, as a rule, notify the supervisory authority within 72 hours of becoming aware of it, unless there is no risk to the data subjects.
VPN
Virtual private network: an encrypted connection that creates a secure channel between a user or site and the organisation's network. However, it does not replace strong authentication or permission control.
Workflow
Defined sequence of steps, owners and rules for a process, such as the submission, validation, approval and notification of a document. As a result, every step is recorded and nobody depends on emails to know the status.
No term matches your search. Try another word or contact us.
How AISP helps
How AISP-GEDOC helps
AISP-GEDOC has worked in document management for more than 20 years and implements Glartek's document management and HSE platform. Beyond the technology, it helps teams apply these concepts in practice:
- Platform implementation and administration, with document types, requirements and workflows tailored to each client's process.
- Daily document validation and contractor approval, as well as specialist technical support.
- ID credentials (GEDOC ID) and digital safety inductions (GEDOC SafetyGo), so that only people who meet the requirements enter the site.
If you want to apply these concepts in your operation, book a presentation and discover AISP-GEDOC's document management and HSE services.
Frequently asked questions
Frequently asked questions
What is a document management glossary for?
A document management glossary sets the meaning of the terms used in requirements, procedures, contracts and audits. As a result, HSE, procurement, operations and contractor teams interpret concepts such as validity, approval or evidence in the same way. Therefore, it reduces requests for clarification, avoidable rejections and inconsistent decisions, especially when several companies and countries share the same process.
What is the difference between document validation and contractor approval?
Document validation analyses each document individually: authenticity, holder, issuing body, validity and fit with the requirement. Contractor approval, on the other hand, is a decision about the company or the worker, based on all the validations together. In other words, a contractor is only approved when it meets all the requirements that apply to its context, with valid documents.
Do the definitions in this glossary replace legislation or standards?
No. The definitions are neutral summaries for information only, designed to make communication between teams easier. However, if in doubt, the official text of the applicable legislation always prevails, such as Law no. 102/2009, Decree-Law no. 273/2003 or the GDPR, as well as the ISO standards in force. For specific situations, it is advisable to seek specialist legal or technical advice.
Articles on document management
A worker can be compliant on one project and non-compliant on another
Find out why a worker who is compliant on one project may not be on another, depending on the client, location, activity or risk.
GEDOC
21/09/2026
From document compliance to authorisation to work
Find out why valid documents are not enough and how HSE document management links requirements to authorisation to work.
GEDOC
14/09/2026
Supplier and subcontractor document management
Find out how to structure document control for suppliers and subcontractors to avoid non-compliance risks and loss of traceability.
GEDOC
13/07/2026
The importance of document requirements
Find out why document requirements are essential for legal compliance and discover best practices for effective document management.
GEDOC
28/01/2026
Best practices for naming digital folders
Discover best practices for naming digital folders to make searches easier, reduce ambiguity and keep a consistent structure.
GEDOC
18/03/2025
Best practices for organising digital documentation
Discover best practices for organising digital documentation, from naming conventions to folder hierarchies and efficient search.
GEDOC
04/03/2025
Shall we talk about your organisation's document management?
We don’t just implement platforms. We make sure they work: we implement, administer and operate document management for large organisations, in any country, from administration centres in Portugal.