[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F9":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","9","Article 9","Processing of special categories of personal data",133,"General Data Protection Regulation","**What it asks for.** Processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data used to identify a person, health data and data about sex life or sexual orientation, is prohibited unless one of the listed exceptions applies. Exceptions include explicit consent, employment and social protection obligations, vital interests and specific grounds set by law.\n\n**In practice.** Organisations identify where special category data is processed, record both an Article 6 lawful basis and an Article 9 condition, and apply stronger controls such as restricted access, encryption and stricter retention. Evidence includes data inventories that flag these categories, DPIAs where required and documented reliance on any national law provisions.\n\n**Common gaps.** Special category data often appears unexpectedly, for example in free text fields, sickness records or biometric access systems. Organisations also forget that member state law can add conditions.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_9","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},132,[19,23,27,31,35,39,43,47,51,54,58,62],{"slug":20,"title":21,"published_at":22},"xandr-fined-86m-for-processing-grindr-users-sensitive-data-without-consent","Xandr Fined €8.6M for Processing Grindr Users' Sensitive Data Without Consent","2026-10-16T10:20:42.098+00:00",{"slug":24,"title":25,"published_at":26},"iqvia-fined-7m-by-italys-dpa-for-gdpr-violations-exposing-3780-patients-health-data","IQVIA Fined €7M by Italy's DPA for GDPR Violations Exposing 3,780 Patients' Health Data","2026-10-14T10:20:50.218+00:00",{"slug":28,"title":29,"published_at":30},"xandr-fined-86m-for-unlawfully-sharing-grindr-users-sexual-orientation-data","Xandr Fined €8.6M for Unlawfully Sharing Grindr Users' Sexual Orientation Data","2026-10-13T16:21:46.652+00:00",{"slug":32,"title":33,"published_at":34},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-re-1791908476956","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent in Real-Time Bidding","2026-10-13T16:21:16.914+00:00",{"slug":36,"title":37,"published_at":38},"croatian-gambling-operator-fined-259m-for-unlawful-biometric-data-collection","Croatian Gambling Operator Fined €2.59M for Unlawful Biometric Data Collection","2026-10-13T16:21:00.119+00:00",{"slug":40,"title":41,"published_at":42},"croatian-gambling-operator-fined-259m-for-gdpr-consent-and-biometric-data-failures","Croatian Gambling Operator Fined €2.59M for GDPR Consent and Biometric Data Failures","2026-10-13T14:20:51.771+00:00",{"slug":44,"title":45,"published_at":46},"xandr-fined-85m-for-unlawful-processing-of-sensitive-grindr-user-data-in-real-time-bidding","Xandr Fined €8.5M for Unlawful Processing of Sensitive Grindr User Data in Real-Time Bidding","2026-10-13T14:20:35.881+00:00",{"slug":48,"title":49,"published_at":50},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent","2026-10-13T12:20:47.783+00:00",{"slug":52,"title":33,"published_at":53},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-real-time-biddin","2026-10-13T12:20:33.036+00:00",{"slug":55,"title":56,"published_at":57},"xandr-fined-96m-for-unlawful-sharing-of-grindr-users-sensitive-data","Xandr Fined $9.6M for Unlawful Sharing of Grindr Users' Sensitive Data","2026-10-12T22:20:35.997+00:00",{"slug":59,"title":60,"published_at":61},"finnish-healthcare-provider-fined-33k-for-leaking-therapy-data-to-google-meta-microsoft","Finnish Healthcare Provider Fined €33K for Leaking Therapy Data to Google, Meta & Microsoft","2026-10-12T14:21:55.533+00:00",{"slug":63,"title":64,"published_at":65},"finnish-healthcare-provider-fined-33k-for-sharing-patient-data-with-big-tech-via-tracking-tools","Finnish Healthcare Provider Fined €33K for Sharing Patient Data with Big Tech via Tracking Tools","2026-10-12T14:21:21.087+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",43,{"slug":73,"name":74,"problem":75,"stories":76},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",26,{"slug":78,"name":79,"problem":80,"stories":81},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",14,{"slug":83,"name":84,"problem":85,"stories":86},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",11,{"slug":88,"name":89,"problem":90,"stories":91},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",6,{"slug":93,"name":94,"problem":95,"stories":91},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[97,103,108,114,119,123,127,133],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","3","Control 3","Data Protection",106,{"family":5,"item":104,"code":105,"title":106,"together":107},"5","Article 5(1)(f)","Principles relating to processing of personal data",92,{"family":109,"item":110,"code":111,"title":112,"together":113},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",82,{"family":5,"item":115,"code":116,"title":117,"together":118},"35","Article 35","Data protection impact assessment",60,{"family":5,"item":120,"code":121,"title":122,"together":118},"6","Article 6","Lawfulness of processing",{"family":124,"item":110,"code":125,"title":125,"together":126},"itil","ITIL",56,{"family":128,"item":129,"code":130,"title":131,"together":132},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",53,{"family":5,"item":134,"code":135,"title":136,"together":137},"25","Article 25","Data protection by design and by default",35]