[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F21":3},{"item":4,"lessons":16,"controls":65,"related":94},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","21","Article 21","Right to object",24,"General Data Protection Regulation","**What it asks for.** Individuals have the right to object, on grounds relating to their particular situation, to processing based on public interest or legitimate interests, including profiling. The controller must then stop unless it demonstrates compelling legitimate grounds that override the individual's interests, or the processing is for legal claims. Where data are processed for direct marketing, the right to object is absolute, and the right must be explicitly brought to the individual's attention.\n\n**In practice.** Organisations provide easy ways to object, assess objections promptly and keep suppression lists so that marketing objections are honoured everywhere. Evidence includes notices that mention the right clearly, request logs, records of the balancing decision for non-marketing objections and suppression records.\n\n**Common gaps.** Marketing objections are often honoured in one channel but not others. Objections to legitimate interests processing are sometimes refused without a documented assessment.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_21","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"wind-tre-fined-167m-for-unlawful-telemarketing-and-consent-failures","Wind Tre Fined €16.7M for Unlawful Telemarketing and Consent Failures","2026-10-12T12:20:36.995+00:00",{"slug":23,"title":24,"published_at":25},"bbva-fined-55m-for-ignoring-customer-marketing-opt-out-for-seven-months","BBVA Fined €5.5M for Ignoring Customer Marketing Opt-Out for Seven Months","2026-10-09T08:20:27.832+00:00",{"slug":27,"title":28,"published_at":29},"cjeu-rules-individuals-can-demand-erasure-from-church-baptismal-records-under-gdpr","CJEU Rules Individuals Can Demand Erasure from Church Baptismal Records Under GDPR","2026-10-06T16:21:42.897+00:00",{"slug":31,"title":32,"published_at":33},"cjeu-opinion-gdpr-right-to-erasure-applies-to-church-baptismal-registers","CJEU Opinion: GDPR Right to Erasure Applies to Church Baptismal Registers","2026-10-06T08:20:36.043+00:00",{"slug":35,"title":36,"published_at":37},"greek-dpa-fines-dei-and-call-center-partners-880k-for-gdpr-marketing-violations","Greek DPA Fines DEI and Call-Center Partners €880K for GDPR Marketing Violations","2026-10-05T10:20:23.718+00:00",{"slug":39,"title":40,"published_at":41},"greek-energy-supplier-fined-880k-for-unlawful-marketing-calls-and-processor-oversight--1790151773088","Greek Energy Supplier Fined €880K for Unlawful Marketing Calls and Processor Oversight Failures","2026-09-23T08:22:52.898+00:00",{"slug":43,"title":44,"published_at":45},"bbva-italy-fined-55m-for-ignoring-gdpr-opt-out-requests","BBVA Italy Fined €5.5M for Ignoring GDPR Opt-Out Requests","2026-09-16T10:21:59.106+00:00",{"slug":47,"title":48,"published_at":49},"bbva-italy-fined-55m-for-ignoring-user-opt-out-preferences-1789489386466","BBVA Italy Fined €5.5M for Ignoring User Opt-Out Preferences","2026-09-15T16:23:06.047+00:00",{"slug":51,"title":52,"published_at":53},"dormeo-home-fined-for-ignoring-gdpr-opt-out-requests","Dormeo Home Fined for Ignoring GDPR Opt-Out Requests","2026-09-15T14:21:24.393+00:00",{"slug":55,"title":56,"published_at":57},"romanian-dpa-fines-dormeo-home-for-ignoring-customer-opt-out-requests","Romanian DPA Fines Dormeo Home for Ignoring Customer Opt-Out Requests","2026-09-15T14:21:09.558+00:00",{"slug":59,"title":60,"published_at":61},"bbva-italy-fined-55m-for-ignoring-user-opt-out-requests","BBVA Italy Fined €5.5M for Ignoring User Opt-Out Requests","2026-09-14T14:21:10.04+00:00",{"slug":63,"title":48,"published_at":64},"bbva-italy-fined-55m-for-ignoring-user-opt-out-preferences","2026-09-10T12:21:37.358+00:00",[66,71,76,81,86,90],{"slug":67,"name":68,"problem":69,"stories":70},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",8,{"slug":72,"name":73,"problem":74,"stories":75},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",7,{"slug":77,"name":78,"problem":79,"stories":80},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",5,{"slug":82,"name":83,"problem":84,"stories":85},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",1,{"slug":87,"name":88,"problem":89,"stories":85},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":91,"name":92,"problem":93,"stories":85},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[95,101,106,112,117,121,126,131],{"family":96,"item":97,"code":98,"title":99,"together":100},"cis","3","Control 3","Data Protection",22,{"family":102,"item":103,"code":104,"title":104,"together":105},"itil","overview","ITIL",19,{"family":107,"item":108,"code":109,"title":110,"together":111},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",16,{"family":5,"item":113,"code":114,"title":115,"together":116},"6","Article 6","Lawfulness of processing",14,{"family":5,"item":118,"code":119,"title":120,"together":116},"17","Article 17","Right to erasure ('right to be forgotten')",{"family":5,"item":122,"code":123,"title":124,"together":125},"5","Article 5(1)(f)","Principles relating to processing of personal data",13,{"family":5,"item":127,"code":128,"title":129,"together":130},"7","Article 7","Conditions for consent",10,{"family":132,"item":103,"code":133,"title":134,"together":130},"nist-privacy","Privacy Framework","NIST Privacy Framework"]