[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F25":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","25","Article 25","Data protection by design and by default",689,"Regulation (EU) 2016\u002F679 (General Data Protection Regulation)","**What it asks for.** Controllers must build data protection into the way processing is designed, using appropriate technical and organisational measures such as pseudonymisation and data minimisation. By default, only the personal data necessary for each specific purpose should be processed, which covers the amount collected, the extent of processing, the storage period and accessibility.\n\n**In practice.** Privacy requirements are considered at the start of projects and changes, not added at the end. Concrete practice includes privacy checks in the development lifecycle, minimal default settings, limited data fields, role based access and automatic deletion. Evidence includes design reviews, privacy requirements in tickets or specifications, and configuration showing restrictive defaults.\n\n**Common gaps.** Privacy review often happens too late to influence design. Defaults in products and internal tools frequently expose more data, to more people, for longer than the purpose requires.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_25","Read the official text on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},688,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"government-encryption-backdoors-threaten-global-data-security","Government Encryption Backdoors Threaten Global Data Security","2026-10-17T14:20:19.334+00:00",{"slug":24,"title":25,"published_at":26},"ad-network-used-as-zero-click-spyware-delivery-channel-via-real-time-bidding","Ad Network Used as Zero-Click Spyware Delivery Channel via Real-Time Bidding","2026-10-17T12:20:32.316+00:00",{"slug":28,"title":29,"published_at":30},"governing-open-weight-ai-models-requires-structured-enterprise-risk-frameworks","Governing Open-Weight AI Models Requires Structured Enterprise Risk Frameworks","2026-10-16T18:21:38.63+00:00",{"slug":32,"title":33,"published_at":34},"zero-click-ad-spyware-bypasses-user-interaction-to-compromise-devices","Zero-Click Ad Spyware Bypasses User Interaction to Compromise Devices","2026-10-16T18:20:36.559+00:00",{"slug":36,"title":37,"published_at":38},"ai-model-misappropriates-third-party-crypto-funds-to-complete-task","AI Model Misappropriates Third-Party Crypto Funds to Complete Task","2026-10-16T16:20:58.749+00:00",{"slug":40,"title":41,"published_at":42},"burger-king-japan-breach-exposes-11m-app-users-personal-data","Burger King Japan Breach Exposes 11M App Users' Personal Data","2026-10-16T15:20:48.695+00:00",{"slug":44,"title":45,"published_at":46},"ai-models-act-autonomously-to-bypass-auth-and-raid-crypto-wallets","AI Models Act Autonomously to Bypass Auth and Raid Crypto Wallets","2026-10-16T12:21:09.736+00:00",{"slug":48,"title":49,"published_at":50},"ai-agents-accessed-live-sensitive-data-during-testing-due-to-exposed-credentials-and-excessive-permi","AI Agents Accessed Live Sensitive Data During Testing Due to Exposed Credentials and Excessive Permissions","2026-10-16T08:20:59.754+00:00",{"slug":52,"title":53,"published_at":54},"uk-legal-aid-agency-breach-exposes-decades-of-sensitive-records","UK Legal Aid Agency Breach Exposes Decades of Sensitive Records","2026-10-15T10:21:06.955+00:00",{"slug":56,"title":57,"published_at":58},"telco-found-liable-for-gdpr-breach-after-identity-fraud-enabled-by-weak-verification","Telco Found Liable for GDPR Breach After Identity Fraud Enabled by Weak Verification","2026-10-14T18:20:33.817+00:00",{"slug":60,"title":61,"published_at":62},"telco-fined-for-failing-to-verify-identities-enabling-gdpr-violating-fraud","Telco Fined for Failing to Verify Identities, Enabling GDPR-Violating Fraud","2026-10-14T18:20:19.96+00:00",{"slug":64,"title":65,"published_at":66},"iqvia-fined-7m-by-italys-dpa-for-gdpr-violations-exposing-3780-patients-health-data","IQVIA Fined €7M by Italy's DPA for GDPR Violations Exposing 3,780 Patients' Health Data","2026-10-14T10:20:50.218+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",232,{"slug":74,"name":75,"problem":76,"stories":77},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",165,{"slug":79,"name":80,"problem":81,"stories":82},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",132,{"slug":84,"name":85,"problem":86,"stories":87},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",93,{"slug":89,"name":90,"problem":91,"stories":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",82,{"slug":94,"name":95,"problem":96,"stories":97},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",73,[99,105,110,115,120,126,132,137],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","3","Control 3","Data Protection",446,{"family":5,"item":106,"code":107,"title":108,"together":109},"32","Article 32","Security of processing",419,{"family":100,"item":111,"code":112,"title":113,"together":114},"6","Control 6","Access Control Management",338,{"family":5,"item":116,"code":117,"title":118,"together":119},"5","Article 5(1)(f)","Principles relating to processing of personal data",204,{"family":121,"item":122,"code":123,"title":124,"together":125},"nist-800-53","ac-2","AC-2","Account Management",186,{"family":127,"item":128,"code":129,"title":130,"together":131},"nist-csf","pr-ds","PR.DS-1","Data Security",162,{"family":133,"item":134,"code":135,"title":135,"together":136},"itil","overview","ITIL",155,{"family":138,"item":134,"code":139,"title":140,"together":141},"nist-ai-rmf","AI RMF 1.0","AI Risk Management Framework (AI RMF 1.0)",148]