[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F6":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","6","Article 6","Lawfulness of processing",275,"General Data Protection Regulation","**What it asks for.** Processing is lawful only if at least one of six bases applies: consent, performance of a contract, a legal obligation, protection of vital interests, a task in the public interest or official authority, or the legitimate interests of the controller or a third party, balanced against the rights of the individual. Public authorities cannot rely on legitimate interests for their tasks.\n\n**In practice.** Each processing activity has a lawful basis chosen and documented before processing begins. Where legitimate interests is used, a documented balancing assessment is expected. Evidence includes the basis recorded in the record of processing activities, consent records where relevant, and privacy notices that state the basis. The chosen basis affects which rights apply, so it should be decided deliberately.\n\n**Common gaps.** Organisations sometimes switch bases after the fact or rely on consent where it cannot be freely given, such as in employment. Legitimate interests assessments are often missing or superficial.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_6","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},270,[19,23,27,31,35,39,43,47,51,54,58,62],{"slug":20,"title":21,"published_at":22},"cross-jurisdictional-law-enforcement-surveillance-of-political-activists-raises-civil-liberties-alar","Cross-Jurisdictional Law Enforcement Surveillance of Political Activists Raises Civil Liberties Alarms","2026-10-16T20:20:31.596+00:00",{"slug":24,"title":25,"published_at":26},"xandr-fined-86m-for-processing-grindr-users-sensitive-data-without-consent","Xandr Fined €8.6M for Processing Grindr Users' Sensitive Data Without Consent","2026-10-16T10:20:42.098+00:00",{"slug":28,"title":29,"published_at":30},"norway-fines-xandr-for-unlawful-personal-data-processing-tied-to-grindr","Norway Fines Xandr for Unlawful Personal Data Processing Tied to Grindr","2026-10-14T14:21:53.44+00:00",{"slug":32,"title":33,"published_at":34},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-re-1791908476956","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent in Real-Time Bidding","2026-10-13T16:21:16.914+00:00",{"slug":36,"title":37,"published_at":38},"croatian-gambling-operator-fined-259m-for-unlawful-biometric-data-collection","Croatian Gambling Operator Fined €2.59M for Unlawful Biometric Data Collection","2026-10-13T16:21:00.119+00:00",{"slug":40,"title":41,"published_at":42},"croatian-gambling-operator-fined-259m-for-gdpr-consent-and-biometric-data-failures","Croatian Gambling Operator Fined €2.59M for GDPR Consent and Biometric Data Failures","2026-10-13T14:20:51.771+00:00",{"slug":44,"title":45,"published_at":46},"xandr-fined-85m-for-unlawful-processing-of-sensitive-grindr-user-data-in-real-time-bidding","Xandr Fined €8.5M for Unlawful Processing of Sensitive Grindr User Data in Real-Time Bidding","2026-10-13T14:20:35.881+00:00",{"slug":48,"title":49,"published_at":50},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent","2026-10-13T12:20:47.783+00:00",{"slug":52,"title":33,"published_at":53},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-real-time-biddin","2026-10-13T12:20:33.036+00:00",{"slug":55,"title":56,"published_at":57},"xandr-fined-96m-for-unlawful-sharing-of-grindr-users-sensitive-data","Xandr Fined $9.6M for Unlawful Sharing of Grindr Users' Sensitive Data","2026-10-12T22:20:35.997+00:00",{"slug":59,"title":60,"published_at":61},"wind-tre-fined-167m-for-unlawful-telemarketing-and-consent-failures","Wind Tre Fined €16.7M for Unlawful Telemarketing and Consent Failures","2026-10-12T12:20:36.995+00:00",{"slug":63,"title":64,"published_at":65},"italian-dpa-fines-controller-for-unlawful-processing-of-sensitive-patient-data-without-legal-basis","Italian DPA Fines Controller for Unlawful Processing of Sensitive Patient Data Without Legal Basis","2026-10-12T12:20:22.886+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",84,{"slug":73,"name":74,"problem":75,"stories":76},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",65,{"slug":78,"name":79,"problem":80,"stories":81},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",25,{"slug":83,"name":84,"problem":85,"stories":86},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",17,{"slug":88,"name":89,"problem":90,"stories":91},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",10,{"slug":93,"name":94,"problem":95,"stories":91},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[97,103,108,114,118,124,129,134],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","3","Control 3","Data Protection",221,{"family":5,"item":104,"code":105,"title":106,"together":107},"5","Article 5(1)(f)","Principles relating to processing of personal data",189,{"family":109,"item":110,"code":111,"title":112,"together":113},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",176,{"family":115,"item":110,"code":116,"title":116,"together":117},"itil","ITIL",132,{"family":119,"item":120,"code":121,"title":122,"together":123},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",121,{"family":5,"item":125,"code":126,"title":127,"together":128},"35","Article 35","Data protection impact assessment",99,{"family":5,"item":130,"code":131,"title":132,"together":133},"13","Article 13","Information to be provided where personal data are collected from the data subject",79,{"family":135,"item":136,"code":137,"title":138,"together":139},"nist-800-53","pt-2","PT-2","Authority to Process Personally Identifiable Information",78]