[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F5":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",775,"Regulation (EU) 2016\u002F679 (General Data Protection Regulation)","**What it asks for.** The article sets out the core principles for all processing: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality, which requires appropriate security. It also sets out accountability, meaning the controller is responsible for compliance and must be able to demonstrate it.\n\n**In practice.** Doing this well means each processing activity has a defined purpose, a lawful basis, a retention period and appropriate security, and that these are written down. Evidence includes records of processing, retention schedules that are actually enforced, data minimisation decisions in system design and security controls matched to the sensitivity of the data. Accountability is shown through policies, training, assessments and audit trails.\n\n**Common gaps.** Retention periods are commonly defined on paper but not applied in systems, so old data accumulates. Many organisations also struggle to demonstrate compliance, even where practice is reasonable.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_5","Read the official text on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},651,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"cross-jurisdictional-law-enforcement-surveillance-of-political-activists-raises-civil-liberties-alar","Cross-Jurisdictional Law Enforcement Surveillance of Political Activists Raises Civil Liberties Alarms","2026-10-16T20:20:31.596+00:00",{"slug":24,"title":25,"published_at":26},"shadow-ai-personal-chatgpt-use-at-work-creates-data-exposure-risk","Shadow AI: Personal ChatGPT Use at Work Creates Data Exposure Risk","2026-10-16T16:21:15.148+00:00",{"slug":28,"title":29,"published_at":30},"spanish-cycling-federation-fined-4800-after-two-month-data-breach-exposing-261965-records","Spanish Cycling Federation Fined €4,800 After Two-Month Data Breach Exposing 261,965 Records","2026-10-16T16:20:43.825+00:00",{"slug":32,"title":33,"published_at":34},"burger-king-japan-app-breach-exposes-11m-member-records","Burger King Japan App Breach Exposes 11M Member Records","2026-10-16T12:21:23.341+00:00",{"slug":36,"title":37,"published_at":38},"xandr-fined-86m-for-processing-grindr-users-sensitive-data-without-consent","Xandr Fined €8.6M for Processing Grindr Users' Sensitive Data Without Consent","2026-10-16T10:20:42.098+00:00",{"slug":40,"title":41,"published_at":42},"uk-legal-aid-agency-breach-exposes-47-years-of-sensitive-records","UK Legal Aid Agency Breach Exposes 47 Years of Sensitive Records","2026-10-15T16:20:35.876+00:00",{"slug":44,"title":45,"published_at":46},"vibetech-exposes-137m-records-in-unsecured-database","Vibetech Exposes 13.7M Records in Unsecured Database","2026-10-15T16:20:19.435+00:00",{"slug":48,"title":49,"published_at":50},"international-csam-crackdown-highlights-platform-accountability-and-reporting-gaps","International CSAM Crackdown Highlights Platform Accountability and Reporting Gaps","2026-10-15T12:20:23.726+00:00",{"slug":52,"title":53,"published_at":54},"uk-legal-aid-agency-breach-exposes-decades-of-sensitive-records","UK Legal Aid Agency Breach Exposes Decades of Sensitive Records","2026-10-15T10:21:06.955+00:00",{"slug":56,"title":57,"published_at":58},"centerpoint-energy-breach-exposes-1m-texans-pii-via-cybercrime-forum-disclosure","CenterPoint Energy Breach Exposes 1M+ Texans' PII via Cybercrime Forum Disclosure","2026-10-15T10:20:22.506+00:00",{"slug":60,"title":61,"published_at":62},"telco-found-liable-for-gdpr-breach-after-identity-fraud-enabled-by-weak-verification","Telco Found Liable for GDPR Breach After Identity Fraud Enabled by Weak Verification","2026-10-14T18:20:33.817+00:00",{"slug":64,"title":65,"published_at":66},"telco-fined-for-failing-to-verify-identities-enabling-gdpr-violating-fraud","Telco Fined for Failing to Verify Identities, Enabling GDPR-Violating Fraud","2026-10-14T18:20:19.96+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",176,{"slug":74,"name":75,"problem":76,"stories":77},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",92,{"slug":79,"name":80,"problem":81,"stories":82},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",83,{"slug":84,"name":85,"problem":86,"stories":87},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",70,{"slug":89,"name":90,"problem":91,"stories":92},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",59,{"slug":94,"name":95,"problem":96,"stories":97},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",52,[99,105,110,115,120,125,130,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","3","Control 3","Data Protection",463,{"family":106,"item":107,"code":108,"title":108,"together":109},"itil","overview","ITIL",321,{"family":111,"item":107,"code":112,"title":113,"together":114},"nist-privacy","Privacy Framework","NIST Privacy Framework",267,{"family":5,"item":116,"code":117,"title":118,"together":119},"25","Article 25","Data protection by design and by default",204,{"family":5,"item":121,"code":122,"title":123,"together":124},"6","Article 6","Lawfulness of processing",189,{"family":5,"item":126,"code":127,"title":128,"together":129},"32","Article 32","Security of processing",188,{"family":131,"item":132,"code":133,"title":134,"together":135},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",183,{"family":5,"item":137,"code":138,"title":139,"together":140},"35","Article 35","Data protection impact assessment",146]