[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F85":3},{"item":4,"lessons":16,"controls":61,"related":67},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","85","Article 85","Processing and freedom of expression and information",11,"General Data Protection Regulation","**What it asks for.** Article 85 requires member states to reconcile, by law, the right to data protection with the right to freedom of expression and information, including processing for journalistic purposes and for academic, artistic or literary expression. For these purposes, member states must provide exemptions or derogations from specified chapters of the regulation where necessary to reconcile the two rights.\n\n**In practice.** Organisations involved in journalism, research publishing or similar activities identify which national exemptions apply in each relevant country and document how they rely on them. Evidence includes a legal analysis by jurisdiction, editorial policies that address personal data and records of decisions where the exemption was used.\n\n**Common gaps.** The scope of national exemptions differs considerably between member states and is often assumed to be broader than it is. Security and breach obligations generally still need to be met.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_85","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,45,49,53,57],{"slug":19,"title":20,"published_at":21},"cyprus-court-upholds-10000-fine-against-media-group-for-unlawful-disclosure-of-financial-data","Cyprus Court Upholds €10,000 Fine Against Media Group for Unlawful Disclosure of Financial Data","2026-09-16T09:21:20.097+00:00",{"slug":23,"title":24,"published_at":25},"spanish-newspaper-fined-20000-for-failing-to-anonymize-assault-video-under-gdpr-1789546927841","Spanish Newspaper Fined €20,000 for Failing to Anonymize Assault Video Under GDPR","2026-09-16T08:22:07.651+00:00",{"slug":27,"title":28,"published_at":29},"italian-dpa-fines-il-fatto-quotidiano-for-publishing-sensitive-health-data-in-violation-of-gdpr","Italian DPA Fines Il Fatto Quotidiano for Publishing Sensitive Health Data in Violation of GDPR","2026-08-26T10:21:57.802+00:00",{"slug":31,"title":32,"published_at":33},"italian-dpa-fines-il-fatto-quotidiano-for-publishing-sensitive-personal-health-data","Italian DPA Fines Il Fatto Quotidiano for Publishing Sensitive Personal Health Data","2026-08-25T12:20:56.17+00:00",{"slug":35,"title":36,"published_at":37},"german-court-forces-jehovahs-witnesses-to-honor-gdpr-data-access-rights","German Court Forces Jehovah's Witnesses to Honor GDPR Data Access Rights","2026-08-12T10:21:12.861+00:00",{"slug":39,"title":40,"published_at":41},"german-court-rules-gdpr-overrides-religious-data-protection-rules-for-member-access-rights","German Court Rules GDPR Overrides Religious Data Protection Rules for Member Access Rights","2026-08-10T14:21:39.093+00:00",{"slug":43,"title":24,"published_at":44},"spanish-newspaper-fined-20000-for-failing-to-anonymize-assault-video-under-gdpr","2026-07-27T16:21:30.455+00:00",{"slug":46,"title":47,"published_at":48},"cjeu-rules-commercial-criminal-data-databases-cannot-claim-gdpr-journalism-exemption","CJEU Rules Commercial Criminal Data Databases Cannot Claim GDPR Journalism Exemption","2026-07-15T10:22:06.575+00:00",{"slug":50,"title":51,"published_at":52},"cjeu-rules-member-states-cannot-expand-gdpr-derogations-beyond-article-852","CJEU Rules Member States Cannot Expand GDPR Derogations Beyond Article 85(2)","2026-07-14T08:20:23.108+00:00",{"slug":54,"title":55,"published_at":56},"cypriot-media-firm-fined-10000-for-unlawful-disclosure-of-personal-financial-data","Cypriot Media Firm Fined €10,000 for Unlawful Disclosure of Personal Financial Data","2026-06-17T11:20:20.814+00:00",{"slug":58,"title":59,"published_at":60},"cypriot-court-upholds-10000-fine-for-unlawful-disclosure-of-financial-data-in-tv-broadcast","Cypriot Court Upholds €10,000 Fine for Unlawful Disclosure of Financial Data in TV Broadcast","2026-06-17T08:20:53.179+00:00",[62],{"slug":63,"name":64,"problem":65,"stories":66},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",1,[68,73,78,83,89,94,99,103],{"family":69,"item":70,"code":71,"title":72,"together":9},"cis","3","Control 3","Data Protection",{"family":74,"item":75,"code":76,"title":76,"together":77},"itil","overview","ITIL",10,{"family":5,"item":79,"code":80,"title":81,"together":82},"5","Article 5(1)(f)","Principles relating to processing of personal data",7,{"family":84,"item":85,"code":86,"title":87,"together":88},"nist-800-53","pt-2","PT-2","Authority to Process Personally Identifiable Information",6,{"family":5,"item":90,"code":91,"title":92,"together":93},"9","Article 9","Processing of special categories of personal data",5,{"family":95,"item":75,"code":96,"title":97,"together":98},"nist-privacy","Privacy Framework","NIST Privacy Framework",4,{"family":5,"item":75,"code":100,"title":101,"together":102},"GDPR","General Data Protection Regulation (GDPR)",3,{"family":104,"item":105,"code":106,"title":107,"together":102},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems"]