[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F26":3},{"item":4,"lessons":16,"controls":65,"related":94},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","26","Article 26","Joint controllers",15,"General Data Protection Regulation","**What it asks for.** Where two or more controllers jointly determine the purposes and means of processing, they are joint controllers. They must set out their respective responsibilities for compliance, in particular for individuals' rights and the provision of information, in a transparent arrangement, unless these are determined by law. The essence of the arrangement must be made available to individuals, who may exercise their rights against each controller.\n\n**In practice.** Organisations identify joint controllership in partnerships, group arrangements and some platform integrations, then document an arrangement covering who handles notices, rights requests, security and breaches. Evidence includes signed arrangements, a published summary for individuals and processes showing requests are routed correctly.\n\n**Common gaps.** Joint controllership often goes unrecognised, for example with embedded social media plugins or shared marketing activities. Arrangements may exist but fail to say who does what in practice.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_26","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,37,41,45,49,53,57,61],{"slug":19,"title":20,"published_at":21},"xandr-fined-86m-for-processing-grindr-users-sensitive-data-without-consent","Xandr Fined €8.6M for Processing Grindr Users' Sensitive Data Without Consent","2026-10-16T10:20:42.098+00:00",{"slug":23,"title":24,"published_at":25},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-re-1791908476956","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent in Real-Time Bidding","2026-10-13T16:21:16.914+00:00",{"slug":27,"title":28,"published_at":29},"xandr-fined-85m-for-unlawful-processing-of-sensitive-grindr-user-data-in-real-time-bidding","Xandr Fined €8.5M for Unlawful Processing of Sensitive Grindr User Data in Real-Time Bidding","2026-10-13T14:20:35.881+00:00",{"slug":31,"title":32,"published_at":33},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent","2026-10-13T12:20:47.783+00:00",{"slug":35,"title":24,"published_at":36},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-real-time-biddin","2026-10-13T12:20:33.036+00:00",{"slug":38,"title":39,"published_at":40},"polish-dpa-fines-company-for-obstructing-gdpr-investigation-and-hiding-identity","Polish DPA Fines Company for Obstructing GDPR Investigation and Hiding Identity","2026-09-30T08:21:39.198+00:00",{"slug":42,"title":43,"published_at":44},"vague-consent-language-violates-gdpr-eu-court-rules","Vague Consent Language Violates GDPR, EU Court Rules","2026-09-22T12:22:23.843+00:00",{"slug":46,"title":47,"published_at":48},"bgh-ruling-third-party-embeds-can-trigger-national-injunctions-under-gdpr","BGH Ruling: Third-Party Embeds Can Trigger National Injunctions Under GDPR","2026-09-22T10:21:31.555+00:00",{"slug":50,"title":51,"published_at":52},"munich-court-rules-employee-email-privacy-can-override-gdpr-access-rights","Munich Court Rules Employee Email Privacy Can Override GDPR Access Rights","2026-09-01T08:20:21.987+00:00",{"slug":54,"title":55,"published_at":56},"spanish-dpa-fines-film-company-60000-for-ignoring-gdpr-corrective-order","Spanish DPA Fines Film Company €60,000 for Ignoring GDPR Corrective Order","2026-08-24T08:21:20.289+00:00",{"slug":58,"title":59,"published_at":60},"ramona-films-fined-for-ignoring-gdpr-corrective-order-on-data-processing-agreement","Ramona Films Fined for Ignoring GDPR Corrective Order on Data Processing Agreement","2026-08-21T14:20:39.044+00:00",{"slug":62,"title":63,"published_at":64},"german-court-orders-social-media-platform-to-cease-unlawful-third-party-data-collection-via-business","German Court Orders Social Media Platform to Cease Unlawful Third-Party Data Collection via Business Tools","2026-07-27T08:20:21.507+00:00",[66,71,76,81,85,90],{"slug":67,"name":68,"problem":69,"stories":70},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",9,{"slug":72,"name":73,"problem":74,"stories":75},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",6,{"slug":77,"name":78,"problem":79,"stories":80},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",2,{"slug":82,"name":83,"problem":84,"stories":80},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",{"slug":86,"name":87,"problem":88,"stories":89},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",1,{"slug":91,"name":92,"problem":93,"stories":89},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[95,101,107,113,116,120,126,131],{"family":96,"item":97,"code":98,"title":99,"together":100},"cis","3","Control 3","Data Protection",12,{"family":102,"item":103,"code":104,"title":105,"together":106},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",11,{"family":108,"item":109,"code":110,"title":111,"together":112},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",10,{"family":114,"item":103,"code":115,"title":115,"together":112},"itil","ITIL",{"family":5,"item":117,"code":118,"title":119,"together":70},"6","Article 6","Lawfulness of processing",{"family":121,"item":122,"code":123,"title":124,"together":125},"nist-800-53","pt-2","PT-2","Authority to Process Personally Identifiable Information",8,{"family":96,"item":127,"code":128,"title":129,"together":130},"15","Control 15","Service Provider Management",7,{"family":5,"item":132,"code":133,"title":134,"together":135},"35","Article 35","Data protection impact assessment",5]