[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F28":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","28","Article 28","Processor",235,"Regulation (EU) 2016\u002F679 (General Data Protection Regulation)","**What it asks for.** Controllers may only use processors that provide sufficient guarantees of appropriate technical and organisational measures. Processing must be governed by a contract or other legal act that sets out the subject matter, duration, nature and purpose of processing and includes specified obligations, such as acting only on documented instructions, confidentiality, security, controls on sub-processors, assistance to the controller, deletion or return of data and audit support.\n\n**In practice.** Organisations assess vendors before engagement, sign data processing agreements that cover the required terms and keep a register of processors and sub-processors. Evidence includes due diligence records, signed agreements, sub-processor change notifications and the results of audits or reviews of certifications and reports.\n\n**Common gaps.** Due diligence is often done at onboarding and not repeated. Sub-processor chains are poorly tracked, and audit rights exist on paper but are never exercised.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_28","Read the official text on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},233,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"shadow-ai-personal-chatgpt-use-at-work-creates-data-exposure-risk","Shadow AI: Personal ChatGPT Use at Work Creates Data Exposure Risk","2026-10-16T16:21:15.148+00:00",{"slug":24,"title":25,"published_at":26},"ransomware-negotiator-secretly-worked-for-the-attackers","Ransomware Negotiator Secretly Worked for the Attackers","2026-10-16T15:20:17.253+00:00",{"slug":28,"title":29,"published_at":30},"north-korean-it-worker-fraud-exposes-hiring-and-identity-verification-gaps","North Korean IT Worker Fraud Exposes Hiring and Identity Verification Gaps","2026-10-14T18:21:30.184+00:00",{"slug":32,"title":33,"published_at":34},"norway-fines-xandr-for-unlawful-personal-data-processing-tied-to-grindr","Norway Fines Xandr for Unlawful Personal Data Processing Tied to Grindr","2026-10-14T14:21:53.44+00:00",{"slug":36,"title":37,"published_at":38},"xandr-fined-86m-for-unlawfully-sharing-grindr-users-sexual-orientation-data","Xandr Fined €8.6M for Unlawfully Sharing Grindr Users' Sexual Orientation Data","2026-10-13T16:21:46.652+00:00",{"slug":40,"title":41,"published_at":42},"ransomware-negotiator-arrested-for-extortion-insider-threat-within-cybersecurity-industry","Ransomware Negotiator Arrested for Extortion: Insider Threat Within Cybersecurity Industry","2026-10-12T22:20:50.499+00:00",{"slug":44,"title":45,"published_at":46},"xandr-fined-96m-for-unlawful-sharing-of-grindr-users-sensitive-data","Xandr Fined $9.6M for Unlawful Sharing of Grindr Users' Sensitive Data","2026-10-12T22:20:35.997+00:00",{"slug":48,"title":49,"published_at":50},"finnish-healthcare-provider-fined-33k-for-sharing-patient-data-with-big-tech-via-tracking-tools","Finnish Healthcare Provider Fined €33K for Sharing Patient Data with Big Tech via Tracking Tools","2026-10-12T14:21:21.087+00:00",{"slug":52,"title":53,"published_at":54},"unpatched-contractor-software-opens-fbi-systems-to-shinyhunters-breach","Unpatched Contractor Software Opens FBI Systems to ShinyHunters Breach","2026-10-12T12:22:22.353+00:00",{"slug":56,"title":57,"published_at":58},"irhythm-breach-third-party-app-risk-exposes-360000-patients","iRhythm Breach: Third-Party App Risk Exposes 360,000 Patients","2026-10-12T12:21:39.014+00:00",{"slug":60,"title":61,"published_at":62},"wind-tre-fined-167m-for-unlawful-telemarketing-and-consent-failures","Wind Tre Fined €16.7M for Unlawful Telemarketing and Consent Failures","2026-10-12T12:20:36.995+00:00",{"slug":64,"title":65,"published_at":66},"xandr-fined-85m-for-unlawful-data-processing-under-gdpr","Xandr Fined €8.5M for Unlawful Data Processing Under GDPR","2026-10-12T06:20:19.858+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",94,{"slug":74,"name":75,"problem":76,"stories":77},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",57,{"slug":79,"name":80,"problem":81,"stories":82},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",50,{"slug":84,"name":85,"problem":86,"stories":87},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",29,{"slug":89,"name":90,"problem":91,"stories":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",23,{"slug":94,"name":95,"problem":96,"stories":97},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",22,[99,105,110,116,121,127,132,137],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","15","Control 15","Service Provider Management",149,{"family":106,"item":107,"code":108,"title":108,"together":109},"itil","overview","ITIL",102,{"family":111,"item":112,"code":113,"title":114,"together":115},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",95,{"family":100,"item":117,"code":118,"title":119,"together":120},"3","Control 3","Data Protection",83,{"family":122,"item":123,"code":124,"title":125,"together":126},"nist-800-53","sa-9","SA-9","External System Services",76,{"family":5,"item":128,"code":129,"title":130,"together":131},"32","Article 32","Security of processing",70,{"family":5,"item":133,"code":134,"title":135,"together":136},"5","Article 5(1)(f)","Principles relating to processing of personal data",69,{"family":122,"item":138,"code":139,"title":140,"together":141},"ac-2","AC-2","Account Management",63]