[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F37":3},{"item":4,"lessons":16,"controls":66,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","37","Article 37","Designation of the data protection officer",34,"General Data Protection Regulation","**What it asks for.** Controllers and processors must designate a data protection officer where processing is carried out by a public authority or body (except courts acting in their judicial capacity), where core activities involve regular and systematic monitoring of individuals on a large scale, or where core activities involve large scale processing of special category or criminal offence data. Member state law may require it in other cases. A group can appoint a single DPO if easily accessible from each establishment.\n\n**In practice.** Organisations document whether a DPO is required, appoint someone with expert knowledge of data protection law and practice, publish contact details and communicate them to the supervisory authority. Evidence includes the assessment, the appointment, published contact details and the notification to the authority.\n\n**Common gaps.** The assessment of whether a DPO is needed is often not documented. Appointees may lack the required expertise or time.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_37","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"xandr-fined-85m-for-unlawful-data-processing-under-gdpr","Xandr Fined €8.5M for Unlawful Data Processing Under GDPR","2026-10-12T06:20:19.858+00:00",{"slug":23,"title":24,"published_at":25},"croatian-gambling-operator-fined-259m-for-gdpr-biometric-and-consent-violations","Croatian Gambling Operator Fined €2.59M for GDPR Biometric and Consent Violations","2026-10-11T22:20:30.87+00:00",{"slug":27,"title":28,"published_at":29},"google-ordered-to-provide-complete-data-copy-after-incomplete-gdpr-access-request","Google Ordered to Provide Complete Data Copy After Incomplete GDPR Access Request","2026-10-09T12:21:26.776+00:00",{"slug":31,"title":32,"published_at":33},"polish-bailiff-fined-for-dpo-conflict-of-interest-and-failure-to-notify-uodo","Polish Bailiff Fined for DPO Conflict of Interest and Failure to Notify UODO","2026-10-07T14:21:43.313+00:00",{"slug":35,"title":36,"published_at":37},"cjeu-rules-individuals-may-request-erasure-from-church-baptism-registers-under-gdpr","CJEU Rules Individuals May Request Erasure from Church Baptism Registers Under GDPR","2026-10-07T14:21:27.964+00:00",{"slug":39,"title":40,"published_at":41},"cjeu-rules-individuals-can-demand-erasure-from-church-baptismal-records-under-gdpr","CJEU Rules Individuals Can Demand Erasure from Church Baptismal Records Under GDPR","2026-10-06T16:21:42.897+00:00",{"slug":43,"title":44,"published_at":45},"polish-bailiff-fined-for-dpo-conflict-of-interest-and-missing-contact-details","Polish Bailiff Fined for DPO Conflict of Interest and Missing Contact Details","2026-10-06T14:21:09.166+00:00",{"slug":47,"title":48,"published_at":49},"irish-high-court-shifts-gdpr-compliance-burden-to-data-controllers","Irish High Court Shifts GDPR Compliance Burden to Data Controllers","2026-10-06T14:20:38.429+00:00",{"slug":51,"title":52,"published_at":53},"espoo-schools-misuse-google-edtech-tools-violating-gdpr-consent-rules","Espoo Schools Misuse Google EdTech Tools, Violating GDPR Consent Rules","2026-09-28T19:21:53.257+00:00",{"slug":55,"title":56,"published_at":57},"cjeu-clarifies-gdpr-fines-apply-to-private-entities-performing-public-tasks","CJEU Clarifies GDPR Fines Apply to Private Entities Performing Public Tasks","2026-09-23T12:21:43.465+00:00",{"slug":59,"title":60,"published_at":61},"cjeu-rules-private-entities-cannot-be-exempted-from-gdpr-fines-via-national-law","CJEU Rules Private Entities Cannot Be Exempted from GDPR Fines via National Law","2026-09-23T10:20:40.117+00:00",{"slug":63,"title":64,"published_at":65},"cjeu-case-highlights-gdpr-enforcement-gaps-for-subsidized-private-education-entities","CJEU Case Highlights GDPR Enforcement Gaps for Subsidized Private Education Entities","2026-09-22T16:22:15.943+00:00",[67,72,77,82,87,91],{"slug":68,"name":69,"problem":70,"stories":71},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",7,{"slug":73,"name":74,"problem":75,"stories":76},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",6,{"slug":78,"name":79,"problem":80,"stories":81},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",2,{"slug":83,"name":84,"problem":85,"stories":86},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",1,{"slug":88,"name":89,"problem":90,"stories":86},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":92,"name":93,"problem":94,"stories":86},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[96,102,107,112,116,121,126,131],{"family":97,"item":98,"code":99,"title":100,"together":101},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",26,{"family":103,"item":104,"code":105,"title":106,"together":101},"cis","3","Control 3","Data Protection",{"family":108,"item":109,"code":110,"title":111,"together":101},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",{"family":113,"item":98,"code":114,"title":114,"together":115},"itil","ITIL",23,{"family":5,"item":117,"code":118,"title":119,"together":120},"5","Article 5(1)(f)","Principles relating to processing of personal data",17,{"family":5,"item":122,"code":123,"title":124,"together":125},"35","Article 35","Data protection impact assessment",13,{"family":5,"item":127,"code":128,"title":129,"together":130},"6","Article 6","Lawfulness of processing",12,{"family":5,"item":132,"code":133,"title":134,"together":135},"30","Article 30","Records of processing activities",10]