[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F58":3},{"item":4,"lessons":16,"controls":67,"related":94},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","58","Article 58","Powers",28,"General Data Protection Regulation","**What it asks for.** Article 58 sets out the powers each supervisory authority holds, in three groups. Investigative powers include ordering information, carrying out audits and obtaining access to premises and data. Corrective powers include warnings, reprimands, orders to comply or bring processing into line, temporary or definitive limitations including bans, orders to suspend data flows and imposing fines. Authorisation and advisory powers cover matters such as approving binding corporate rules and issuing opinions.\n\n**In practice.** Organisations prepare for authority contact by keeping documentation ready, having a named owner for regulator communications and being able to explain processing and controls quickly. Evidence includes an up to date record of processing, policies, DPIAs and incident records that can be produced on request.\n\n**Common gaps.** Organisations often focus only on fines and underestimate orders to stop processing or suspend transfers. Slow or incomplete responses to information requests can worsen the outcome.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_58","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},27,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"polish-dpa-fines-company-for-ignoring-gdpr-information-obligations-and-regulator-communications","Polish DPA Fines Company for Ignoring GDPR Information Obligations and Regulator Communications","2026-10-07T08:21:08.909+00:00",{"slug":24,"title":25,"published_at":26},"polish-company-fined-for-ignoring-gdpr-information-obligations-and-regulator-communications","Polish Company Fined for Ignoring GDPR Information Obligations and Regulator Communications","2026-10-06T14:21:41.61+00:00",{"slug":28,"title":29,"published_at":30},"polish-dpa-fines-company-for-obstructing-gdpr-investigation-and-hiding-identity","Polish DPA Fines Company for Obstructing GDPR Investigation and Hiding Identity","2026-09-30T08:21:39.198+00:00",{"slug":32,"title":33,"published_at":34},"mep-fined-for-gdpr-non-compliance-over-biometric-data-platform","MEP Fined for GDPR Non-Compliance Over Biometric Data Platform","2026-09-30T08:20:36.685+00:00",{"slug":36,"title":37,"published_at":38},"italian-hospital-fined-30k-for-refusing-gdpr-erasure-request-on-recruitment-data","Italian Hospital Fined €30K for Refusing GDPR Erasure Request on Recruitment Data","2026-09-29T10:20:37.588+00:00",{"slug":40,"title":41,"published_at":42},"edpb-issues-new-gdpr-fine-guidelines-and-dsa-gdpr-interaction-rules","EDPB Issues New GDPR Fine Guidelines and DSA-GDPR Interaction Rules","2026-09-23T19:21:31.878+00:00",{"slug":44,"title":45,"published_at":46},"romanian-railway-company-fined-for-refusing-gdpr-data-access-request-1789554040811","Romanian Railway Company Fined for Refusing GDPR Data Access Request","2026-09-16T10:20:40.556+00:00",{"slug":48,"title":49,"published_at":50},"gdpr-violation-controller-deletes-data-during-active-access-request","GDPR Violation: Controller Deletes Data During Active Access Request","2026-09-09T10:20:41.088+00:00",{"slug":52,"title":53,"published_at":54},"spanish-notary-fined-for-sharing-cadastral-data-without-legal-basis","Spanish Notary Fined for Sharing Cadastral Data Without Legal Basis","2026-09-03T12:22:43.68+00:00",{"slug":56,"title":57,"published_at":58},"experian-italia-fined-120k-for-ignoring-data-subject-rights-and-privacy-by-design-failures","Experian Italia Fined €120K for Ignoring Data Subject Rights and Privacy by Design Failures","2026-09-01T20:20:41.354+00:00",{"slug":60,"title":61,"published_at":62},"danish-dpa-authorizes-biometric-facial-recognition-at-football-matches-under-strict-gdpr-conditions","Danish DPA Authorizes Biometric Facial Recognition at Football Matches Under Strict GDPR Conditions","2026-09-01T08:21:09.065+00:00",{"slug":64,"title":65,"published_at":66},"italian-dpa-fines-company-for-unlawful-email-marketing-under-gdpr-and-eprivacy","Italian DPA Fines Company for Unlawful Email Marketing Under GDPR and ePrivacy","2026-08-28T16:20:52.725+00:00",[68,73,77,82,86,90],{"slug":69,"name":70,"problem":71,"stories":72},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",2,{"slug":74,"name":75,"problem":76,"stories":72},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":78,"name":79,"problem":80,"stories":81},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",1,{"slug":83,"name":84,"problem":85,"stories":81},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",{"slug":87,"name":88,"problem":89,"stories":81},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":91,"name":92,"problem":93,"stories":81},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[95,101,106,112,117,122,127,132],{"family":96,"item":97,"code":98,"title":99,"together":100},"cis","3","Control 3","Data Protection",20,{"family":102,"item":103,"code":104,"title":104,"together":105},"itil","overview","ITIL",19,{"family":107,"item":108,"code":109,"title":110,"together":111},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",16,{"family":113,"item":103,"code":114,"title":115,"together":116},"nist-privacy","Privacy Framework","NIST Privacy Framework",15,{"family":5,"item":118,"code":119,"title":120,"together":121},"83","Article 83","General conditions for imposing administrative fines",11,{"family":5,"item":123,"code":124,"title":125,"together":126},"5","Article 5(1)(f)","Principles relating to processing of personal data",9,{"family":5,"item":128,"code":129,"title":130,"together":131},"6","Article 6","Lawfulness of processing",7,{"family":5,"item":133,"code":134,"title":135,"together":131},"15","Article 15","Right of access by the data subject"]