[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F44":3},{"item":4,"lessons":16,"controls":65,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","44","Article 44","General principle for transfers",24,"General Data Protection Regulation","**What it asks for.** Transfers of personal data to a third country or an international organisation may only take place if the conditions in Chapter V are met, including for onward transfers. The aim is that the level of protection guaranteed by the regulation is not undermined when data leaves the European Economic Area.\n\n**In practice.** Organisations map where personal data goes, including access from outside the EEA by vendors and support teams, and identify the transfer mechanism for each flow, such as an adequacy decision, standard contractual clauses or binding corporate rules. Where safeguards are used, a transfer impact assessment and supplementary measures are typically expected. Evidence includes a transfer register, contracts and assessments.\n\n**Common gaps.** Remote access by support staff in third countries is often not recognised as a transfer. Sub-processor chains also create onward transfers that are not tracked.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_44","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,49,53,57,61],{"slug":19,"title":20,"published_at":21},"data-broker-fined-for-unlawful-resale-of-personal-data-without-consent","Data Broker Fined for Unlawful Resale of Personal Data Without Consent","2026-10-08T10:21:09.857+00:00",{"slug":23,"title":24,"published_at":25},"austria-dsb-rules-us-streaming-service-violated-gdpr-transparency-requirements","Austria DSB Rules US Streaming Service Violated GDPR Transparency Requirements","2026-10-02T10:21:23.507+00:00",{"slug":27,"title":28,"published_at":29},"bgh-ruling-third-party-embeds-can-trigger-national-injunctions-under-gdpr","BGH Ruling: Third-Party Embeds Can Trigger National Injunctions Under GDPR","2026-09-22T10:21:31.555+00:00",{"slug":31,"title":32,"published_at":33},"eu-states-eye-sweeping-ai-data-access-threatening-citizens-privacy-rights","EU States Eye Sweeping AI Data Access, Threatening Citizens' Privacy Rights","2026-09-21T06:20:20.823+00:00",{"slug":35,"title":36,"published_at":37},"unchecked-license-plate-data-sharing-exposes-surveillance-overreach","Unchecked License Plate Data Sharing Exposes Surveillance Overreach","2026-08-28T10:20:39.876+00:00",{"slug":39,"title":40,"published_at":41},"hungarian-online-store-fined-41500-for-gdpr-transparency-failures-1785925312590","Hungarian Online Store Fined €41,500 for GDPR Transparency Failures","2026-08-05T10:21:52.189+00:00",{"slug":43,"title":44,"published_at":45},"hungarian-retailer-fined-41500-for-opaque-gdpr-privacy-notices","Hungarian Retailer Fined €41,500 for Opaque GDPR Privacy Notices","2026-08-05T10:21:19.575+00:00",{"slug":47,"title":40,"published_at":48},"hungarian-online-store-fined-41500-for-gdpr-transparency-failures","2026-08-04T18:20:39.397+00:00",{"slug":50,"title":51,"published_at":52},"adversarial-nation-code-found-in-apps-marketed-to-us-military-personnel","Adversarial Nation Code Found in Apps Marketed to US Military Personnel","2026-07-20T10:20:46.746+00:00",{"slug":54,"title":55,"published_at":56},"eu-commission-reprimanded-for-unlawful-data-transfers-via-microsoft-365","EU Commission Reprimanded for Unlawful Data Transfers via Microsoft 365","2026-07-17T14:20:59.934+00:00",{"slug":58,"title":59,"published_at":60},"schrems-ii-eu-us-privacy-shield-invalidated-over-mass-surveillance-concerns","Schrems II: EU-US Privacy Shield Invalidated Over Mass Surveillance Concerns","2026-07-17T14:20:42.188+00:00",{"slug":62,"title":63,"published_at":64},"eu-commission-fined-for-unlawful-data-transfers-to-us-via-third-party-services","EU Commission Fined for Unlawful Data Transfers to US via Third-Party Services","2026-07-08T12:20:41.39+00:00",[66,71,76,81,85,90],{"slug":67,"name":68,"problem":69,"stories":70},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",10,{"slug":72,"name":73,"problem":74,"stories":75},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",8,{"slug":77,"name":78,"problem":79,"stories":80},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",7,{"slug":82,"name":83,"problem":84,"stories":80},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",{"slug":86,"name":87,"problem":88,"stories":89},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",3,{"slug":91,"name":92,"problem":93,"stories":94},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",1,[96,102,108,114,118,122,126,130],{"family":97,"item":98,"code":99,"title":100,"together":101},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",19,{"family":103,"item":104,"code":105,"title":106,"together":107},"cis","3","Control 3","Data Protection",18,{"family":109,"item":110,"code":111,"title":112,"together":113},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",16,{"family":115,"item":98,"code":116,"title":116,"together":117},"itil","ITIL",14,{"family":5,"item":119,"code":120,"title":121,"together":70},"46","Article 46","Transfers subject to appropriate safeguards",{"family":5,"item":123,"code":124,"title":125,"together":70},"13","Article 13","Information to be provided where personal data are collected from the data subject",{"family":5,"item":127,"code":128,"title":129,"together":75},"30","Article 30","Records of processing activities",{"family":5,"item":131,"code":132,"title":133,"together":80},"5","Article 5(1)(f)","Principles relating to processing of personal data"]