[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F31":3},{"item":4,"lessons":16,"controls":54,"related":77},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","31","Article 31","Cooperation with the supervisory authority",9,"General Data Protection Regulation","**What it asks for.** Controllers and processors, and their representatives where applicable, must cooperate on request with the supervisory authority in the performance of its tasks.\n\n**In practice.** Organisations designate an owner, often the DPO, for communication with authorities, maintain documentation that can be produced quickly and respond to inquiries accurately and on time. Cooperation is also a factor an authority considers when deciding on fines under Article 83. Evidence includes a procedure for regulator contact, a log of inquiries and responses, and the underlying records such as the record of processing activities, DPIAs and breach records.\n\n**Common gaps.** Requests from authorities are sometimes delayed while internal teams search for documents that should already exist. Inconsistent answers from different parts of the organisation can damage credibility.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_31","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50],{"slug":19,"title":20,"published_at":21},"gdpr-article-31-self-incrimination-rights-vs-regulatory-cooperation-obligations","GDPR Article 31: Self-Incrimination Rights vs. Regulatory Cooperation Obligations","2026-09-30T16:20:39.146+00:00",{"slug":23,"title":24,"published_at":25},"mep-fined-for-failing-to-cooperate-with-dpa-investigation-into-data-heavy-platform","MEP Fined for Failing to Cooperate with DPA Investigation into Data-Heavy Platform","2026-09-28T10:21:08.367+00:00",{"slug":27,"title":28,"published_at":29},"mep-fined-for-refusing-to-cooperate-with-gdpr-investigation-into-sensitive-data-platform","MEP Fined for Refusing to Cooperate with GDPR Investigation into Sensitive Data Platform","2026-09-28T10:20:53.794+00:00",{"slug":31,"title":32,"published_at":33},"catalan-council-fined-for-publishing-unredacted-social-housing-applicants-personal-data","Catalan Council Fined for Publishing Unredacted Social Housing Applicants' Personal Data","2026-09-23T08:22:34.482+00:00",{"slug":35,"title":36,"published_at":37},"pharma-company-fined-for-retaining-influencer-data-beyond-contract-expiry","Pharma Company Fined for Retaining Influencer Data Beyond Contract Expiry","2026-08-26T12:21:22.668+00:00",{"slug":39,"title":40,"published_at":41},"lab-pharma-fined-for-retaining-influencer-data-after-contract-expiry-and-obstructing-dpa-investigati","Lab Pharma Fined for Retaining Influencer Data After Contract Expiry and Obstructing DPA Investigation","2026-08-21T14:21:11.616+00:00",{"slug":43,"title":44,"published_at":45},"pharma-company-fined-for-ignoring-gdpr-erasure-rights-and-obstructing-dpa-investigation","Pharma Company Fined for Ignoring GDPR Erasure Rights and Obstructing DPA Investigation","2026-08-21T14:20:24.341+00:00",{"slug":47,"title":48,"published_at":49},"italian-dpa-fines-publisher-280k-for-marketing-emails-without-valid-consent","Italian DPA Fines Publisher €280K for Marketing Emails Without Valid Consent","2026-08-20T12:20:18.937+00:00",{"slug":51,"title":52,"published_at":53},"greek-dpa-fines-two-companies-160000-for-gdpr-violations-over-cctv-data-mishandling","Greek DPA Fines Two Companies €160,000 for GDPR Violations Over CCTV Data Mishandling","2026-06-30T11:20:24.527+00:00",[55,60,65,69,73],{"slug":56,"name":57,"problem":58,"stories":59},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",2,{"slug":61,"name":62,"problem":63,"stories":64},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",1,{"slug":66,"name":67,"problem":68,"stories":64},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",{"slug":70,"name":71,"problem":72,"stories":64},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":74,"name":75,"problem":76,"stories":64},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[78,84,89,93,99,103,108,112],{"family":79,"item":80,"code":81,"title":82,"together":83},"cis","3","Control 3","Data Protection",8,{"family":5,"item":85,"code":86,"title":87,"together":88},"5","Article 5(1)(f)","Principles relating to processing of personal data",7,{"family":90,"item":91,"code":92,"title":92,"together":88},"itil","overview","ITIL",{"family":94,"item":95,"code":96,"title":97,"together":98},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",5,{"family":100,"item":91,"code":101,"title":102,"together":98},"nist-privacy","Privacy Framework","NIST Privacy Framework",{"family":5,"item":104,"code":105,"title":106,"together":107},"6","Article 6","Lawfulness of processing",3,{"family":5,"item":109,"code":110,"title":111,"together":107},"83","Article 83","General conditions for imposing administrative fines",{"family":5,"item":113,"code":114,"title":115,"together":107},"35","Article 35","Data protection impact assessment"]