[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F30":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","30","Article 30","Records of processing activities",84,"General Data Protection Regulation","**What it asks for.** Controllers must keep a written record of processing activities under their responsibility, including the purposes, categories of individuals and data, recipients, international transfers, retention periods where possible and a general description of security measures. Processors keep a similar record of processing carried out for each controller. Records must be available to the supervisory authority on request. A limited exemption exists for organisations with fewer than 250 employees, but it does not apply in many common situations.\n\n**In practice.** The record is maintained as a living inventory, owned by named people and updated when systems or purposes change. Good records link to lawful bases, DPIAs, retention rules and vendor contracts. Evidence includes the record itself, review dates and change history.\n\n**Common gaps.** Records are often compiled for a project and then left to go stale. Shadow IT and new SaaS tools are frequently absent.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_30","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"norway-fines-xandr-for-unlawful-personal-data-processing-tied-to-grindr","Norway Fines Xandr for Unlawful Personal Data Processing Tied to Grindr","2026-10-14T14:21:53.44+00:00",{"slug":23,"title":24,"published_at":25},"iqvia-fined-7m-by-italys-dpa-for-gdpr-violations-exposing-3780-patients-health-data","IQVIA Fined €7M by Italy's DPA for GDPR Violations Exposing 3,780 Patients' Health Data","2026-10-14T10:20:50.218+00:00",{"slug":27,"title":28,"published_at":29},"cjeu-loss-of-control-over-personal-data-qualifies-as-compensable-harm-under-gdpr-article-82","CJEU: Loss of Control Over Personal Data Qualifies as Compensable Harm Under GDPR Article 82","2026-10-12T14:20:50.134+00:00",{"slug":31,"title":32,"published_at":33},"italian-dpa-fines-controller-for-unlawful-processing-of-sensitive-patient-data-without-legal-basis","Italian DPA Fines Controller for Unlawful Processing of Sensitive Patient Data Without Legal Basis","2026-10-12T12:20:22.886+00:00",{"slug":35,"title":36,"published_at":37},"xandr-fined-85m-for-unlawful-data-processing-under-gdpr","Xandr Fined €8.5M for Unlawful Data Processing Under GDPR","2026-10-12T06:20:19.858+00:00",{"slug":39,"title":40,"published_at":41},"croatian-gambling-operator-fined-259m-for-gdpr-biometric-and-consent-violations","Croatian Gambling Operator Fined €2.59M for GDPR Biometric and Consent Violations","2026-10-11T22:20:30.87+00:00",{"slug":43,"title":44,"published_at":45},"google-ordered-to-provide-complete-data-copy-after-incomplete-gdpr-access-request","Google Ordered to Provide Complete Data Copy After Incomplete GDPR Access Request","2026-10-09T12:21:26.776+00:00",{"slug":47,"title":48,"published_at":49},"google-ordered-to-provide-full-gdpr-data-access-after-excluding-cookie-and-tracking-data","Google Ordered to Provide Full GDPR Data Access After Excluding Cookie and Tracking Data","2026-10-09T12:21:11.713+00:00",{"slug":51,"title":52,"published_at":53},"austrian-agency-fined-25500-for-unlawful-recording-of-job-applicant-interviews","Austrian Agency Fined €25,500 for Unlawful Recording of Job Applicant Interviews","2026-10-08T10:21:43.221+00:00",{"slug":55,"title":56,"published_at":57},"data-broker-fined-for-unlawful-resale-of-personal-data-without-consent","Data Broker Fined for Unlawful Resale of Personal Data Without Consent","2026-10-08T10:21:09.857+00:00",{"slug":59,"title":60,"published_at":61},"cjeu-rules-vague-partners-consent-invalid-under-gdpr","CJEU Rules Vague 'Partners' Consent Invalid Under GDPR","2026-10-08T10:20:54.336+00:00",{"slug":63,"title":64,"published_at":65},"irish-high-court-shifts-gdpr-compliance-burden-to-data-controllers","Irish High Court Shifts GDPR Compliance Burden to Data Controllers","2026-10-06T14:20:38.429+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",19,{"slug":73,"name":74,"problem":75,"stories":76},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",14,{"slug":78,"name":79,"problem":80,"stories":81},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",11,{"slug":83,"name":84,"problem":85,"stories":86},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",7,{"slug":88,"name":89,"problem":90,"stories":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",4,{"slug":93,"name":94,"problem":95,"stories":96},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",2,[98,104,110,115,121,125,130,135],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","3","Control 3","Data Protection",75,{"family":105,"item":106,"code":107,"title":108,"together":109},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",68,{"family":5,"item":111,"code":112,"title":113,"together":114},"5","Article 5(1)(f)","Principles relating to processing of personal data",60,{"family":116,"item":117,"code":118,"title":119,"together":120},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",54,{"family":122,"item":106,"code":123,"title":123,"together":124},"itil","ITIL",51,{"family":5,"item":126,"code":127,"title":128,"together":129},"35","Article 35","Data protection impact assessment",36,{"family":5,"item":131,"code":132,"title":133,"together":134},"6","Article 6","Lawfulness of processing",35,{"family":5,"item":136,"code":137,"title":138,"together":139},"13","Article 13","Information to be provided where personal data are collected from the data subject",32]