[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F35":3},{"item":4,"lessons":16,"controls":65,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","35","Article 35","Data protection impact assessment",210,"General Data Protection Regulation","**What it asks for.** Where processing, especially using new technologies, is likely to result in a high risk to the rights and freedoms of individuals, the controller must carry out a data protection impact assessment before starting. The article gives examples such as systematic and extensive profiling with significant effects, large scale processing of special category data and large scale systematic monitoring of public areas, and sets out the minimum content of an assessment.\n\n**In practice.** Organisations screen new projects and changes to decide whether a DPIA is needed, using supervisory authority lists of high risk processing. A good assessment describes the processing, assesses necessity and proportionality, identifies risks to individuals and records measures to address them, with advice from the data protection officer. Where high risk remains, prior consultation with the authority under Article 36 applies.\n\n**Common gaps.** DPIAs are often completed after the system is built, treated as a form to fill in, or never revisited when processing changes.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_35","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,49,53,57,61],{"slug":19,"title":20,"published_at":21},"iqvia-fined-7m-by-italys-dpa-for-gdpr-violations-exposing-3780-patients-health-data","IQVIA Fined €7M by Italy's DPA for GDPR Violations Exposing 3,780 Patients' Health Data","2026-10-14T10:20:50.218+00:00",{"slug":23,"title":24,"published_at":25},"ai-hiring-tools-trigger-gdpr-scrutiny-over-missing-risk-assessments","AI Hiring Tools Trigger GDPR Scrutiny Over Missing Risk Assessments","2026-10-14T10:20:18.748+00:00",{"slug":27,"title":28,"published_at":29},"xandr-fined-86m-for-unlawfully-sharing-grindr-users-sexual-orientation-data","Xandr Fined €8.6M for Unlawfully Sharing Grindr Users' Sexual Orientation Data","2026-10-13T16:21:46.652+00:00",{"slug":31,"title":32,"published_at":33},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-re-1791908476956","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent in Real-Time Bidding","2026-10-13T16:21:16.914+00:00",{"slug":35,"title":36,"published_at":37},"croatian-gambling-operator-fined-259m-for-unlawful-biometric-data-collection","Croatian Gambling Operator Fined €2.59M for Unlawful Biometric Data Collection","2026-10-13T16:21:00.119+00:00",{"slug":39,"title":40,"published_at":41},"croatian-gambling-operator-fined-259m-for-gdpr-consent-and-biometric-data-failures","Croatian Gambling Operator Fined €2.59M for GDPR Consent and Biometric Data Failures","2026-10-13T14:20:51.771+00:00",{"slug":43,"title":44,"published_at":45},"xandr-fined-85m-for-unlawful-processing-of-sensitive-grindr-user-data-in-real-time-bidding","Xandr Fined €8.5M for Unlawful Processing of Sensitive Grindr User Data in Real-Time Bidding","2026-10-13T14:20:35.881+00:00",{"slug":47,"title":32,"published_at":48},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-real-time-biddin","2026-10-13T12:20:33.036+00:00",{"slug":50,"title":51,"published_at":52},"finnish-healthcare-provider-fined-33k-for-leaking-therapy-data-to-google-meta-microsoft","Finnish Healthcare Provider Fined €33K for Leaking Therapy Data to Google, Meta & Microsoft","2026-10-12T14:21:55.533+00:00",{"slug":54,"title":55,"published_at":56},"finnish-healthcare-provider-fined-33k-for-sharing-patient-data-with-big-tech-via-tracking-tools","Finnish Healthcare Provider Fined €33K for Sharing Patient Data with Big Tech via Tracking Tools","2026-10-12T14:21:21.087+00:00",{"slug":58,"title":59,"published_at":60},"iqvia-fined-7m-for-gdpr-failures-after-patient-data-breach","IQVIA Fined €7M for GDPR Failures After Patient Data Breach","2026-10-12T12:21:24.347+00:00",{"slug":62,"title":63,"published_at":64},"croatian-gambling-operator-fined-259m-for-biometric-data-gdpr-violations","Croatian Gambling Operator Fined €2.59M for Biometric Data GDPR Violations","2026-10-11T22:20:17.238+00:00",[66,71,76,81,86,91],{"slug":67,"name":68,"problem":69,"stories":70},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",61,{"slug":72,"name":73,"problem":74,"stories":75},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",55,{"slug":77,"name":78,"problem":79,"stories":80},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",22,{"slug":82,"name":83,"problem":84,"stories":85},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",20,{"slug":87,"name":88,"problem":89,"stories":90},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",14,{"slug":92,"name":93,"problem":94,"stories":95},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",12,[97,103,108,114,120,124,129,134],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","3","Control 3","Data Protection",185,{"family":5,"item":104,"code":105,"title":106,"together":107},"5","Article 5(1)(f)","Principles relating to processing of personal data",146,{"family":109,"item":110,"code":111,"title":112,"together":113},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",145,{"family":115,"item":116,"code":117,"title":118,"together":119},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",102,{"family":121,"item":110,"code":122,"title":122,"together":123},"itil","ITIL",101,{"family":5,"item":125,"code":126,"title":127,"together":128},"6","Article 6","Lawfulness of processing",99,{"family":5,"item":130,"code":131,"title":132,"together":133},"25","Article 25","Data protection by design and by default",73,{"family":5,"item":135,"code":136,"title":137,"together":138},"13","Article 13","Information to be provided where personal data are collected from the data subject",68]