[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F10":3},{"item":4,"lessons":16,"controls":53,"related":59},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","10","Article 10","Processing of personal data relating to criminal convictions and offences",9,"General Data Protection Regulation","**What it asks for.** Processing of personal data relating to criminal convictions and offences or related security measures, based on Article 6(1), may only be carried out under the control of official authority or when authorised by Union or member state law providing appropriate safeguards. Any comprehensive register of criminal convictions may be kept only under official authority.\n\n**In practice.** Organisations identify where they process such data, for example background checks, fraud investigations or security incident records naming suspects, and confirm the specific national law that authorises it. Access is restricted and retention kept short. Evidence includes the legal basis analysis by country, procedures for background screening and access and retention controls.\n\n**Common gaps.** Background screening is often run uniformly across countries without checking national authorisation. Investigation records may hold such data longer than necessary.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_10","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,49],{"slug":19,"title":20,"published_at":21},"amazon-wins-appeal-over-gdpr-fine-for-driver-criminal-record-checks","Amazon Wins Appeal Over GDPR Fine for Driver Criminal Record Checks","2026-09-16T09:22:07.773+00:00",{"slug":23,"title":24,"published_at":25},"italian-dpa-fines-public-entity-for-unlawful-publication-of-sensitive-personal-data","Italian DPA Fines Public Entity for Unlawful Publication of Sensitive Personal Data","2026-09-08T14:20:23.38+00:00",{"slug":27,"title":28,"published_at":29},"spanish-court-overturns-2m-gdpr-fine-on-amazon-over-criminal-record-checks","Spanish Court Overturns €2M GDPR Fine on Amazon Over Criminal Record Checks","2026-08-04T12:20:35.551+00:00",{"slug":31,"title":32,"published_at":33},"cjeu-rules-member-states-must-clarify-legal-basis-for-law-enforcement-biometric-data-processing","CJEU Rules Member States Must Clarify Legal Basis for Law Enforcement Biometric Data Processing","2026-07-24T14:21:27.876+00:00",{"slug":35,"title":36,"published_at":37},"cjeu-rules-hungarys-criminal-records-law-breaches-gdpr-article-10","CJEU Rules Hungary's Criminal Records Law Breaches GDPR Article 10","2026-07-24T14:20:22.907+00:00",{"slug":39,"title":40,"published_at":41},"cjeu-rules-commercial-criminal-data-databases-cannot-claim-gdpr-journalism-exemption","CJEU Rules Commercial Criminal Data Databases Cannot Claim GDPR Journalism Exemption","2026-07-15T10:22:06.575+00:00",{"slug":43,"title":44,"published_at":45},"italian-health-authority-fined-20000-for-unlawful-publication-of-judicial-records-1784028021580","Italian Health Authority Fined €20,000 for Unlawful Publication of Judicial Records","2026-07-14T11:20:21.162+00:00",{"slug":47,"title":44,"published_at":48},"italian-health-authority-fined-20000-for-unlawful-publication-of-judicial-records","2026-07-14T10:22:52.76+00:00",{"slug":50,"title":51,"published_at":52},"cjeu-rules-member-states-cannot-expand-gdpr-derogations-beyond-article-852","CJEU Rules Member States Cannot Expand GDPR Derogations Beyond Article 85(2)","2026-07-14T08:20:23.108+00:00",[54],{"slug":55,"name":56,"problem":57,"stories":58},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",1,[60,65,70,75,79,85,89,93],{"family":61,"item":62,"code":63,"title":64,"together":9},"cis","3","Control 3","Data Protection",{"family":66,"item":67,"code":68,"title":68,"together":69},"itil","overview","ITIL",7,{"family":5,"item":71,"code":72,"title":73,"together":74},"5","Article 5(1)(f)","Principles relating to processing of personal data",6,{"family":5,"item":76,"code":77,"title":78,"together":74},"35","Article 35","Data protection impact assessment",{"family":80,"item":81,"code":82,"title":83,"together":84},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",5,{"family":5,"item":86,"code":87,"title":88,"together":84},"9","Article 9","Processing of special categories of personal data",{"family":90,"item":67,"code":91,"title":92,"together":84},"nist-privacy","Privacy Framework","NIST Privacy Framework",{"family":5,"item":94,"code":95,"title":96,"together":97},"6","Article 6","Lawfulness of processing",4]