[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F14":3},{"item":4,"lessons":16,"controls":67,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","14","Article 14","Information to be provided where personal data have not been obtained from the data subject",38,"General Data Protection Regulation","**What it asks for.** When personal data are obtained from a source other than the individual, the controller must provide information similar to Article 13, plus the categories of data and the source. This must be done within a reasonable period, at the latest within one month, or at first communication or disclosure if earlier. Exceptions apply, for example where providing the information proves impossible or would involve disproportionate effort, with safeguards.\n\n**In practice.** Organisations identify indirect collection, such as purchased lists, data shared by partners, public sources and threat intelligence, and plan how individuals will be informed. Where an exception is relied on, the reasoning is documented and alternative measures such as publishing information are taken. Evidence includes notices, timing records and documented exception assessments.\n\n**Common gaps.** Indirectly obtained data is often overlooked entirely. The disproportionate effort exception is sometimes relied on without assessment or compensating measures.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_14","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},37,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"uber-fined-825m-for-opaque-automated-driver-deactivations","Uber Fined €825M for Opaque Automated Driver Deactivations","2026-10-08T14:20:56.047+00:00",{"slug":24,"title":25,"published_at":26},"austrian-agency-fined-25500-for-unlawful-recording-of-job-applicant-interviews","Austrian Agency Fined €25,500 for Unlawful Recording of Job Applicant Interviews","2026-10-08T10:21:43.221+00:00",{"slug":28,"title":29,"published_at":30},"polish-dpa-fines-company-for-ignoring-gdpr-information-obligations-and-regulator-communications","Polish DPA Fines Company for Ignoring GDPR Information Obligations and Regulator Communications","2026-10-07T08:21:08.909+00:00",{"slug":32,"title":33,"published_at":34},"polish-company-fined-for-ignoring-gdpr-information-obligations-and-regulator-communications","Polish Company Fined for Ignoring GDPR Information Obligations and Regulator Communications","2026-10-06T14:21:41.61+00:00",{"slug":36,"title":37,"published_at":38},"austria-dsb-rules-us-streaming-service-violated-gdpr-transparency-requirements","Austria DSB Rules US Streaming Service Violated GDPR Transparency Requirements","2026-10-02T10:21:23.507+00:00",{"slug":40,"title":41,"published_at":42},"polish-dpa-fines-company-for-obstructing-gdpr-investigation-and-hiding-identity","Polish DPA Fines Company for Obstructing GDPR Investigation and Hiding Identity","2026-09-30T08:21:39.198+00:00",{"slug":44,"title":45,"published_at":46},"caixabank-fined-408k-for-gdpr-data-minimization-failures-in-inheritance-processes","CaixaBank Fined €408K for GDPR Data Minimization Failures in Inheritance Processes","2026-09-22T14:21:15.7+00:00",{"slug":48,"title":49,"published_at":50},"kfc-spain-fined-25000-for-gdpr-violations-over-vague-privacy-notices-and-missing-dpo","KFC Spain Fined €25,000 for GDPR Violations Over Vague Privacy Notices and Missing DPO","2026-09-16T08:21:53.801+00:00",{"slug":52,"title":53,"published_at":54},"cerved-fined-400k-for-blocking-data-subject-rights-under-gdpr","Cerved Fined €400K for Blocking Data Subject Rights Under GDPR","2026-09-02T14:22:10.783+00:00",{"slug":56,"title":57,"published_at":58},"cerved-group-fined-400k-for-failing-to-honor-gdpr-data-subject-rights","Cerved Group Fined €400K for Failing to Honor GDPR Data Subject Rights","2026-09-01T10:22:48.392+00:00",{"slug":60,"title":61,"published_at":62},"cerved-fined-400k-for-failing-to-honor-data-subject-rights-under-gdpr","Cerved Fined €400K for Failing to Honor Data Subject Rights Under GDPR","2026-09-01T10:22:28.543+00:00",{"slug":64,"title":65,"published_at":66},"experian-italia-fined-120k-for-opaque-credit-scoring-practices-under-gdpr","Experian Italia Fined €120K for Opaque Credit Scoring Practices Under GDPR","2026-09-01T10:21:31.064+00:00",[68,73,78,83,88,92],{"slug":69,"name":70,"problem":71,"stories":72},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",20,{"slug":74,"name":75,"problem":76,"stories":77},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",10,{"slug":79,"name":80,"problem":81,"stories":82},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",5,{"slug":84,"name":85,"problem":86,"stories":87},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":89,"name":90,"problem":91,"stories":87},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":93,"name":94,"problem":95,"stories":87},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[97,103,108,114,118,124,128,133],{"family":98,"item":99,"code":100,"title":101,"together":102},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",32,{"family":5,"item":104,"code":105,"title":106,"together":107},"13","Article 13","Information to be provided where personal data are collected from the data subject",30,{"family":109,"item":110,"code":111,"title":112,"together":113},"cis","3","Control 3","Data Protection",29,{"family":115,"item":99,"code":116,"title":116,"together":117},"itil","ITIL",24,{"family":119,"item":120,"code":121,"title":122,"together":123},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",22,{"family":5,"item":125,"code":126,"title":127,"together":72},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":129,"item":130,"code":131,"title":132,"together":77},"nist-800-53","pt-2","PT-2","Authority to Process Personally Identifiable Information",{"family":5,"item":134,"code":135,"title":136,"together":137},"22","Article 22","Automated individual decision-making, including profiling",9]