[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F4":3},{"item":4,"lessons":16,"controls":67,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","4","Article 4(11)","Definitions",54,"General Data Protection Regulation","**What it asks for.** Article 4 defines the key terms used throughout the regulation, including personal data, processing, controller, processor, pseudonymisation, personal data breach and consent. Point 11 defines consent as a freely given, specific, informed and unambiguous indication of the individual's wishes, given by a statement or by a clear affirmative action.\n\n**In practice.** Organisations use these definitions consistently in policies, contracts and assessments. For consent, that means no pre-ticked boxes or silence, separate consent for distinct purposes, enough information for the person to understand what they agree to and a genuine choice. Evidence includes consent interfaces, the wording used and records that show an affirmative action.\n\n**Common gaps.** Many teams interpret personal data too narrowly, overlooking identifiers such as device IDs or IP addresses. Consent is also frequently bundled or implied, which fails the definition.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_4","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},50,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"italian-dpa-fines-controller-for-unlawful-processing-of-sensitive-patient-data-without-legal-basis","Italian DPA Fines Controller for Unlawful Processing of Sensitive Patient Data Without Legal Basis","2026-10-12T12:20:22.886+00:00",{"slug":24,"title":25,"published_at":26},"google-ordered-to-provide-full-gdpr-data-access-after-excluding-cookie-and-tracking-data","Google Ordered to Provide Full GDPR Data Access After Excluding Cookie and Tracking Data","2026-10-09T12:21:11.713+00:00",{"slug":28,"title":29,"published_at":30},"cjeu-rules-vague-partners-consent-invalid-under-gdpr","CJEU Rules Vague 'Partners' Consent Invalid Under GDPR","2026-10-08T10:20:54.336+00:00",{"slug":32,"title":33,"published_at":34},"dutch-dpa-fine-overturned-due-to-insufficient-proof-that-mac-addresses-constitute-personal-data","Dutch DPA Fine Overturned Due to Insufficient Proof That MAC Addresses Constitute Personal Data","2026-10-08T08:20:20.782+00:00",{"slug":36,"title":37,"published_at":38},"cjeu-rules-annotation-is-not-erasure-gdpr-applies-to-baptismal-registers","CJEU Rules Annotation Is Not Erasure: GDPR Applies to Baptismal Registers","2026-10-06T16:20:54.673+00:00",{"slug":40,"title":41,"published_at":42},"medical-employee-fined-for-photographing-and-sharing-patient-data-without-consent","Medical Employee Fined for Photographing and Sharing Patient Data Without Consent","2026-10-06T16:20:39.204+00:00",{"slug":44,"title":45,"published_at":46},"cjeu-opinion-gdpr-right-to-erasure-applies-to-church-baptismal-registers","CJEU Opinion: GDPR Right to Erasure Applies to Church Baptismal Registers","2026-10-06T08:20:36.043+00:00",{"slug":48,"title":49,"published_at":50},"cjeu-rules-physical-church-baptismal-registers-fall-under-gdpr","CJEU Rules Physical Church Baptismal Registers Fall Under GDPR","2026-10-06T08:20:21.201+00:00",{"slug":52,"title":53,"published_at":54},"cjeu-rules-vague-partner-consent-invalid-for-direct-marketing","CJEU Rules Vague 'Partner' Consent Invalid for Direct Marketing","2026-09-23T10:20:56.329+00:00",{"slug":56,"title":57,"published_at":58},"isp-fined-600k-for-vague-consent-practices-in-direct-marketing","ISP Fined €600K for Vague Consent Practices in Direct Marketing","2026-09-23T09:20:37.418+00:00",{"slug":60,"title":61,"published_at":62},"cjeu-rules-vague-consent-to-unidentified-partners-violates-gdpr","CJEU Rules Vague Consent to 'Unidentified Partners' Violates GDPR","2026-09-22T16:21:58.078+00:00",{"slug":64,"title":65,"published_at":66},"cjeu-rules-vague-consent-for-marketing-partners-violates-gdpr","CJEU Rules Vague Consent for Marketing Partners Violates GDPR","2026-09-22T13:20:19.023+00:00",[68,73,78,83,87,91],{"slug":69,"name":70,"problem":71,"stories":72},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",13,{"slug":74,"name":75,"problem":76,"stories":77},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",4,{"slug":79,"name":80,"problem":81,"stories":82},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",1,{"slug":84,"name":85,"problem":86,"stories":82},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",{"slug":88,"name":89,"problem":90,"stories":82},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":92,"name":93,"problem":94,"stories":82},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[96,102,108,113,117,122,127,131],{"family":97,"item":98,"code":99,"title":100,"together":101},"cis","3","Control 3","Data Protection",45,{"family":103,"item":104,"code":105,"title":106,"together":107},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",40,{"family":5,"item":109,"code":110,"title":111,"together":112},"7","Article 7","Conditions for consent",24,{"family":114,"item":104,"code":115,"title":115,"together":116},"itil","ITIL",22,{"family":118,"item":119,"code":120,"title":121,"together":116},"iso","29101","ISO\u002FIEC 29101","ISO\u002FIEC 29101: Privacy architecture framework",{"family":5,"item":123,"code":124,"title":125,"together":126},"5","Article 5(1)(f)","Principles relating to processing of personal data",21,{"family":118,"item":128,"code":129,"title":130,"together":126},"27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",{"family":5,"item":132,"code":133,"title":134,"together":135},"6","Article 6","Lawfulness of processing",16]