[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F83":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","83","Article 83","General conditions for imposing administrative fines",79,"General Data Protection Regulation","**What it asks for.** The article requires supervisory authorities to make fines effective, proportionate and dissuasive, and lists factors to consider, including the nature, gravity and duration of the infringement, intent or negligence, mitigation, previous infringements, cooperation and the categories of data affected. It sets two tiers of maximum fines: up to 10 million euro or 2 percent of worldwide annual turnover, and up to 20 million euro or 4 percent, whichever is higher in each case.\n\n**In practice.** Organisations reduce exposure mainly by being able to show accountability: documented decisions, effective controls, prompt breach handling and constructive cooperation with the authority. The factors in the article are a useful lens for risk registers and board reporting on privacy risk.\n\n**Common gaps.** Organisations sometimes focus on maximum fines and overlook other powers, such as processing bans and orders, which can be more disruptive. Poor documentation weakens the mitigating factors an authority can take into account.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_83","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},77,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"vodafone-spain-fined-400k-after-ignoring-known-vulnerability-for-months","Vodafone Spain Fined €400K After Ignoring Known Vulnerability for Months","2026-10-16T12:20:31.802+00:00",{"slug":24,"title":25,"published_at":26},"xandr-fined-86m-for-processing-grindr-users-sensitive-data-without-consent","Xandr Fined €8.6M for Processing Grindr Users' Sensitive Data Without Consent","2026-10-16T10:20:42.098+00:00",{"slug":28,"title":29,"published_at":30},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-re-1791908476956","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent in Real-Time Bidding","2026-10-13T16:21:16.914+00:00",{"slug":32,"title":33,"published_at":34},"cjeu-loss-of-control-over-personal-data-qualifies-as-compensable-harm-under-gdpr-article-82","CJEU: Loss of Control Over Personal Data Qualifies as Compensable Harm Under GDPR Article 82","2026-10-12T14:20:50.134+00:00",{"slug":36,"title":37,"published_at":38},"iqvia-fined-7m-for-gdpr-failures-after-patient-data-breach","IQVIA Fined €7M for GDPR Failures After Patient Data Breach","2026-10-12T12:21:24.347+00:00",{"slug":40,"title":41,"published_at":42},"austrian-court-upholds-13m-gdpr-fine-for-unlawful-processing-of-political-affinity-data","Austrian Court Upholds €13M GDPR Fine for Unlawful Processing of Political Affinity Data","2026-10-08T10:21:24.951+00:00",{"slug":44,"title":45,"published_at":46},"polish-bailiff-fined-for-dpo-conflict-of-interest-and-failure-to-notify-uodo","Polish Bailiff Fined for DPO Conflict of Interest and Failure to Notify UODO","2026-10-07T14:21:43.313+00:00",{"slug":48,"title":49,"published_at":50},"polish-dpa-fines-company-for-ignoring-gdpr-information-obligations-and-regulator-communications","Polish DPA Fines Company for Ignoring GDPR Information Obligations and Regulator Communications","2026-10-07T08:21:08.909+00:00",{"slug":52,"title":53,"published_at":54},"employee-fined-for-photographing-and-sharing-patients-sensitive-health-data","Employee Fined for Photographing and Sharing Patients' Sensitive Health Data","2026-10-06T16:20:25.103+00:00",{"slug":56,"title":57,"published_at":58},"polish-company-fined-for-ignoring-gdpr-information-obligations-and-regulator-communications","Polish Company Fined for Ignoring GDPR Information Obligations and Regulator Communications","2026-10-06T14:21:41.61+00:00",{"slug":60,"title":61,"published_at":62},"irish-high-court-shifts-compliance-burden-to-microsoft-in-gdpr-real-time-bidding-case","Irish High Court Shifts Compliance Burden to Microsoft in GDPR Real-Time Bidding Case","2026-10-05T10:21:22.914+00:00",{"slug":64,"title":65,"published_at":66},"gdpr-article-25-privacy-must-be-built-in-not-bolted-on","GDPR Article 25: Privacy Must Be Built In, Not Bolted On","2026-09-30T16:21:43.514+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",22,{"slug":74,"name":75,"problem":76,"stories":77},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",20,{"slug":79,"name":80,"problem":81,"stories":82},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",9,{"slug":84,"name":85,"problem":86,"stories":87},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",8,{"slug":89,"name":90,"problem":91,"stories":92},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",5,{"slug":94,"name":95,"problem":96,"stories":97},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",4,[99,104,110,115,120,125,130,135],{"family":100,"item":101,"code":102,"title":102,"together":103},"itil","overview","ITIL",57,{"family":105,"item":106,"code":107,"title":108,"together":109},"cis","3","Control 3","Data Protection",53,{"family":111,"item":101,"code":112,"title":113,"together":114},"nist-privacy","Privacy Framework","NIST Privacy Framework",44,{"family":116,"item":117,"code":118,"title":119,"together":114},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",{"family":5,"item":121,"code":122,"title":123,"together":124},"5","Article 5(1)(f)","Principles relating to processing of personal data",42,{"family":126,"item":127,"code":128,"title":129,"together":77},"nist-800-53","pt-2","PT-2","Authority to Process Personally Identifiable Information",{"family":5,"item":131,"code":132,"title":133,"together":134},"6","Article 6","Lawfulness of processing",19,{"family":105,"item":136,"code":137,"title":138,"together":139},"14","Control 14","Security Awareness and Skills Training",15]