[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F13":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","13","Article 13","Information to be provided where personal data are collected from the data subject",182,"General Data Protection Regulation","**What it asks for.** When personal data are collected directly from individuals, the controller must tell them, at the time of collection, who the controller is, the contact details of any data protection officer, the purposes and lawful basis, recipients, any international transfers, the retention period and their rights, among other items. Information about whether providing the data is a requirement and about automated decision-making must also be given where relevant.\n\n**In practice.** Organisations maintain layered privacy notices that are accurate for each collection point, such as web forms, apps, recruitment and customer service. Notices are reviewed when processing changes. Evidence includes current notices, version history, a mapping from notice content to the record of processing activities and screenshots showing notices presented at collection.\n\n**Common gaps.** Notices are often generic, out of date or inconsistent with actual processing. Retention periods and recipients are commonly described vaguely rather than specifically.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_13","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},179,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"ai-hiring-tools-trigger-gdpr-scrutiny-over-missing-risk-assessments","AI Hiring Tools Trigger GDPR Scrutiny Over Missing Risk Assessments","2026-10-14T10:20:18.748+00:00",{"slug":24,"title":25,"published_at":26},"croatian-gambling-operator-fined-259m-for-unlawful-biometric-data-collection","Croatian Gambling Operator Fined €2.59M for Unlawful Biometric Data Collection","2026-10-13T16:21:00.119+00:00",{"slug":28,"title":29,"published_at":30},"croatian-gambling-operator-fined-259m-for-gdpr-consent-and-biometric-data-failures","Croatian Gambling Operator Fined €2.59M for GDPR Consent and Biometric Data Failures","2026-10-13T14:20:51.771+00:00",{"slug":32,"title":33,"published_at":34},"italian-dpa-fines-controller-for-unlawful-processing-of-sensitive-patient-data-without-legal-basis","Italian DPA Fines Controller for Unlawful Processing of Sensitive Patient Data Without Legal Basis","2026-10-12T12:20:22.886+00:00",{"slug":36,"title":37,"published_at":38},"croatian-gambling-operator-fined-259m-for-gdpr-biometric-and-consent-violations","Croatian Gambling Operator Fined €2.59M for GDPR Biometric and Consent Violations","2026-10-11T22:20:30.87+00:00",{"slug":40,"title":41,"published_at":42},"croatian-gambling-operator-fined-259m-for-biometric-data-gdpr-violations","Croatian Gambling Operator Fined €2.59M for Biometric Data GDPR Violations","2026-10-11T22:20:17.238+00:00",{"slug":44,"title":45,"published_at":46},"iqvia-fined-7m-for-inadequate-anonymization-and-unlawful-health-data-processing","IQVIA Fined €7M for Inadequate Anonymization and Unlawful Health Data Processing","2026-10-09T10:22:39.265+00:00",{"slug":48,"title":49,"published_at":50},"emirates-fined-180k-for-mishandling-passenger-health-data-under-gdpr","Emirates Fined €180K for Mishandling Passenger Health Data Under GDPR","2026-10-09T08:20:42.529+00:00",{"slug":52,"title":53,"published_at":54},"ai-hiring-tool-triggers-gdpr-warning-over-lack-of-dpias-and-transparency","AI Hiring Tool Triggers GDPR Warning Over Lack of DPIAs and Transparency","2026-10-08T16:21:43.317+00:00",{"slug":56,"title":57,"published_at":58},"uber-fined-825m-for-opaque-automated-driver-deactivations","Uber Fined €825M for Opaque Automated Driver Deactivations","2026-10-08T14:20:56.047+00:00",{"slug":60,"title":61,"published_at":62},"austrian-agency-fined-25500-for-unlawful-recording-of-job-applicant-interviews","Austrian Agency Fined €25,500 for Unlawful Recording of Job Applicant Interviews","2026-10-08T10:21:43.221+00:00",{"slug":64,"title":65,"published_at":66},"data-broker-fined-for-unlawful-resale-of-personal-data-without-consent","Data Broker Fined for Unlawful Resale of Personal Data Without Consent","2026-10-08T10:21:09.857+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",62,{"slug":74,"name":75,"problem":76,"stories":77},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",55,{"slug":79,"name":80,"problem":81,"stories":82},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",14,{"slug":84,"name":85,"problem":86,"stories":87},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",12,{"slug":89,"name":90,"problem":91,"stories":92},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",11,{"slug":94,"name":95,"problem":96,"stories":97},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",8,[99,105,111,116,120,126,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","3","Control 3","Data Protection",155,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",141,{"family":5,"item":112,"code":113,"title":114,"together":115},"5","Article 5(1)(f)","Principles relating to processing of personal data",116,{"family":117,"item":107,"code":118,"title":118,"together":119},"itil","ITIL",104,{"family":121,"item":122,"code":123,"title":124,"together":125},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",99,{"family":5,"item":127,"code":128,"title":129,"together":130},"6","Article 6","Lawfulness of processing",79,{"family":5,"item":132,"code":133,"title":134,"together":135},"35","Article 35","Data protection impact assessment",68,{"family":137,"item":138,"code":139,"title":140,"together":141},"nist-800-53","pt-2","PT-2","Authority to Process Personally Identifiable Information",50]