[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F12":3},{"item":4,"lessons":16,"controls":67,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","12","Article 12","Transparent information, communication and modalities for the exercise of the rights of the data subject",65,"General Data Protection Regulation","**What it asks for.** Controllers must provide information and communications to individuals in a concise, transparent, intelligible and easily accessible form, using clear and plain language. They must facilitate the exercise of rights and respond to requests without undue delay and within one month, extendable by two further months for complex or numerous requests with notice. Requests are generally free, although manifestly unfounded or excessive requests may be charged for or refused.\n\n**In practice.** Organisations publish clear notices, provide easy request channels and track every rights request from receipt to response, including identity checks proportionate to the risk. Evidence includes request logs, response times, extension notices and documented reasoning for any refusal.\n\n**Common gaps.** Deadlines are often missed because requests arrive through channels nobody monitors. Organisations also ask for more identification than is proportionate, which can itself breach the rules.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_12","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},62,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"belgian-dpa-fines-company-for-accidental-personal-data-disclosure-via-email","Belgian DPA Fines Company for Accidental Personal Data Disclosure via Email","2026-10-12T10:20:36.922+00:00",{"slug":24,"title":25,"published_at":26},"court-orders-gambling-operator-to-honour-gdpr-data-access-request-after-unlawful-refusal","Court Orders Gambling Operator to Honour GDPR Data Access Request After Unlawful Refusal","2026-10-12T10:20:23.374+00:00",{"slug":28,"title":29,"published_at":30},"bbva-fined-55m-for-ignoring-customer-marketing-opt-out-for-seven-months","BBVA Fined €5.5M for Ignoring Customer Marketing Opt-Out for Seven Months","2026-10-09T08:20:27.832+00:00",{"slug":32,"title":33,"published_at":34},"austria-dsb-rules-us-streaming-service-violated-gdpr-transparency-requirements","Austria DSB Rules US Streaming Service Violated GDPR Transparency Requirements","2026-10-02T10:21:23.507+00:00",{"slug":36,"title":37,"published_at":38},"extia-fined-300k-for-failing-to-honor-gdpr-data-erasure-requests","EXTIA Fined €300K for Failing to Honor GDPR Data Erasure Requests","2026-09-29T16:21:21.431+00:00",{"slug":40,"title":41,"published_at":42},"300k-gdpr-fine-for-mishandling-75-of-erasure-requests","€300K GDPR Fine for Mishandling 75% of Erasure Requests","2026-09-29T14:20:25.731+00:00",{"slug":44,"title":45,"published_at":46},"extia-fined-300k-for-failing-to-honor-gdpr-erasure-requests","EXTIA Fined €300K for Failing to Honor GDPR Erasure Requests","2026-09-24T19:21:05.814+00:00",{"slug":48,"title":49,"published_at":50},"estonian-dpa-orders-website-to-add-safeguards-after-republishing-restricted-personal-data","Estonian DPA Orders Website to Add Safeguards After Republishing Restricted Personal Data","2026-09-23T19:20:24.925+00:00",{"slug":52,"title":53,"published_at":54},"italian-dpa-fines-company-20000-for-ignoring-employee-data-access-rights-and-gps-transparency-failur","Italian DPA Fines Company €20,000 for Ignoring Employee Data Access Rights and GPS Transparency Failures","2026-09-23T11:20:23.2+00:00",{"slug":56,"title":57,"published_at":58},"italian-dpa-fines-la-patria-39k-for-ignoring-employee-gdpr-access-rights","Italian DPA Fines La Patria €39K for Ignoring Employee GDPR Access Rights","2026-09-23T08:20:24.768+00:00",{"slug":60,"title":61,"published_at":62},"securitas-direct-fined-100k-for-obstructing-gdpr-data-subject-rights-via-chargeable-helpline","Securitas Direct Fined €100K for Obstructing GDPR Data Subject Rights via Chargeable Helpline","2026-09-22T12:21:33.821+00:00",{"slug":64,"title":65,"published_at":66},"italian-dpa-fines-la-patria-20000-for-mishandling-gdpr-data-subject-access-requests","Italian DPA Fines La Patria €20,000 for Mishandling GDPR Data Subject Access Requests","2026-09-21T14:21:19.953+00:00",[68,73,78,83,88,92],{"slug":69,"name":70,"problem":71,"stories":72},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",20,{"slug":74,"name":75,"problem":76,"stories":77},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",12,{"slug":79,"name":80,"problem":81,"stories":82},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",11,{"slug":84,"name":85,"problem":86,"stories":87},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":89,"name":90,"problem":91,"stories":87},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",{"slug":93,"name":94,"problem":95,"stories":87},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[97,103,109,114,119,124,129,134],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","3","Control 3","Data Protection",55,{"family":104,"item":105,"code":106,"title":107,"together":108},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",43,{"family":110,"item":111,"code":112,"title":112,"together":113},"itil","overview","ITIL",42,{"family":115,"item":111,"code":116,"title":117,"together":118},"nist-privacy","Privacy Framework","NIST Privacy Framework",41,{"family":5,"item":120,"code":121,"title":122,"together":123},"15","Article 15","Right of access by the data subject",35,{"family":5,"item":125,"code":126,"title":127,"together":128},"5","Article 5(1)(f)","Principles relating to processing of personal data",31,{"family":5,"item":130,"code":131,"title":132,"together":133},"17","Article 17","Right to erasure ('right to be forgotten')",15,{"family":5,"item":135,"code":136,"title":137,"together":138},"13","Article 13","Information to be provided where personal data are collected from the data subject",14]