[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F24":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","24","Article 24","Responsibility of the controller",44,"General Data Protection Regulation","**What it asks for.** Taking into account the nature, scope, context and purposes of processing and the risks to individuals, the controller must implement appropriate technical and organisational measures to ensure, and be able to demonstrate, that processing complies with the regulation. Measures must be reviewed and updated where necessary and, where proportionate, include data protection policies. Adherence to approved codes of conduct or certifications can help demonstrate compliance.\n\n**In practice.** Organisations treat this as the operational form of accountability: a governance structure with owners, policies, training, risk assessment and monitoring of compliance. Evidence includes approved policies, a privacy risk register, management reporting, internal audit results and records showing measures were reviewed after changes or incidents.\n\n**Common gaps.** Policies often exist without monitoring to show they are followed. Reviews are also skipped, so measures fall behind changes in processing and risk.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_24","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"telco-found-liable-for-gdpr-breach-after-identity-fraud-enabled-by-weak-verification","Telco Found Liable for GDPR Breach After Identity Fraud Enabled by Weak Verification","2026-10-14T18:20:33.817+00:00",{"slug":23,"title":24,"published_at":25},"wind-tre-fined-167m-for-unlawful-telemarketing-and-consent-failures","Wind Tre Fined €16.7M for Unlawful Telemarketing and Consent Failures","2026-10-12T12:20:36.995+00:00",{"slug":27,"title":28,"published_at":29},"belgian-dpa-fines-company-for-accidental-personal-data-disclosure-via-email","Belgian DPA Fines Company for Accidental Personal Data Disclosure via Email","2026-10-12T10:20:36.922+00:00",{"slug":31,"title":32,"published_at":33},"cjeu-rules-annotation-is-not-erasure-gdpr-applies-to-baptismal-registers","CJEU Rules Annotation Is Not Erasure: GDPR Applies to Baptismal Registers","2026-10-06T16:20:54.673+00:00",{"slug":35,"title":36,"published_at":37},"irish-high-court-shifts-gdpr-compliance-burden-to-data-controllers","Irish High Court Shifts GDPR Compliance Burden to Data Controllers","2026-10-06T14:20:38.429+00:00",{"slug":39,"title":40,"published_at":41},"irish-high-court-shifts-compliance-burden-to-microsoft-in-gdpr-real-time-bidding-case","Irish High Court Shifts Compliance Burden to Microsoft in GDPR Real-Time Bidding Case","2026-10-05T10:21:22.914+00:00",{"slug":43,"title":44,"published_at":45},"irish-high-court-clarifies-gdpr-compliance-burden-of-proof-for-data-controllers","Irish High Court Clarifies GDPR Compliance Burden of Proof for Data Controllers","2026-10-02T10:21:37.022+00:00",{"slug":47,"title":48,"published_at":49},"extia-fined-300k-for-failing-to-honor-gdpr-data-erasure-requests","EXTIA Fined €300K for Failing to Honor GDPR Data Erasure Requests","2026-09-29T16:21:21.431+00:00",{"slug":51,"title":52,"published_at":53},"estonian-dpa-orders-website-to-add-safeguards-after-republishing-restricted-personal-data","Estonian DPA Orders Website to Add Safeguards After Republishing Restricted Personal Data","2026-09-23T19:20:24.925+00:00",{"slug":55,"title":56,"published_at":57},"greek-energy-supplier-fined-880k-for-unlawful-marketing-calls-and-processor-oversight--1790151773088","Greek Energy Supplier Fined €880K for Unlawful Marketing Calls and Processor Oversight Failures","2026-09-23T08:22:52.898+00:00",{"slug":59,"title":60,"published_at":61},"edpb-harmonises-gdpr-fining-methodology-and-dsa-overlap-guidelines","EDPB Harmonises GDPR Fining Methodology and DSA Overlap Guidelines","2026-09-21T12:22:08.05+00:00",{"slug":63,"title":64,"published_at":65},"bbva-italy-fined-55m-for-ignoring-gdpr-opt-out-requests","BBVA Italy Fined €5.5M for Ignoring GDPR Opt-Out Requests","2026-09-16T10:21:59.106+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",12,{"slug":73,"name":74,"problem":75,"stories":76},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",11,{"slug":78,"name":79,"problem":80,"stories":81},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",10,{"slug":83,"name":84,"problem":85,"stories":86},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",6,{"slug":88,"name":89,"problem":90,"stories":91},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",4,{"slug":93,"name":94,"problem":95,"stories":91},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[97,102,107,112,117,123,127,131],{"family":5,"item":98,"code":99,"title":100,"together":101},"5","Article 5(1)(f)","Principles relating to processing of personal data",37,{"family":103,"item":104,"code":105,"title":105,"together":106},"itil","overview","ITIL",25,{"family":108,"item":104,"code":109,"title":110,"together":111},"nist-privacy","Privacy Framework","NIST Privacy Framework",24,{"family":113,"item":114,"code":115,"title":116,"together":111},"cis","3","Control 3","Data Protection",{"family":118,"item":119,"code":120,"title":121,"together":122},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",22,{"family":5,"item":124,"code":125,"title":126,"together":71},"32","Article 32","Security of processing",{"family":5,"item":128,"code":129,"title":130,"together":71},"28","Article 28","Processor",{"family":5,"item":132,"code":133,"title":134,"together":71},"6","Article 6","Lawfulness of processing"]