[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002Foverview":3},{"item":4,"lessons":16,"controls":67,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","overview","GDPR","General Data Protection Regulation (GDPR)",55,"European Union","**What it covers.** The General Data Protection Regulation, Regulation (EU) 2016\u002F679, applies from May 2018 and governs the processing of personal data of individuals in the European Union. It sets principles for processing, lawful bases, rights for individuals, obligations for controllers and processors including security and breach notification, rules on international transfers, and the powers of supervisory authorities, including fines.\n\n**In practice.** Organisations build a privacy programme around accountability: records of processing, lawful bases, notices, rights request handling, vendor management, DPIAs, security measures and breach procedures, with a data protection officer where required. Evidence is the documentation behind each of these, kept current and linked to actual systems. Security teams contribute mainly through Article 32 measures and breach response.\n\n**Common gaps.** Programmes often start strongly and then drift as systems change. Documentation that does not match reality is a frequent weakness when an authority investigates.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679","Read the official text on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},52,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"finnish-dpa-orders-espoo-to-restrict-google-tools-data-processing-for-students","Finnish DPA Orders Espoo to Restrict Google Tools Data Processing for Students","2026-09-28T19:21:36.231+00:00",{"slug":24,"title":25,"published_at":26},"cjeu-rules-vague-partner-consent-invalid-for-direct-marketing","CJEU Rules Vague 'Partner' Consent Invalid for Direct Marketing","2026-09-23T10:20:56.329+00:00",{"slug":28,"title":29,"published_at":30},"german-federal-court-expands-gdpr-enforcement-national-injunctions-now-permissible-for-unlawful-data","German Federal Court Expands GDPR Enforcement: National Injunctions Now Permissible for Unlawful Data Transfers","2026-09-23T08:21:44.988+00:00",{"slug":32,"title":33,"published_at":34},"german-federal-court-expands-data-subject-remedies-beyond-gdpr","German Federal Court Expands Data Subject Remedies Beyond GDPR","2026-09-22T08:20:18.047+00:00",{"slug":36,"title":37,"published_at":38},"court-overturns-dpa-ruling-balancing-gdpr-access-rights-against-legitimate-institutional-interests","Court Overturns DPA Ruling: Balancing GDPR Access Rights Against Legitimate Institutional Interests","2026-09-16T09:21:51.994+00:00",{"slug":40,"title":41,"published_at":42},"dutch-court-overturns-600k-gdpr-fine-over-inadequate-personal-data-proof","Dutch Court Overturns €600K GDPR Fine Over Inadequate Personal Data Proof","2026-09-16T08:21:22.615+00:00",{"slug":44,"title":45,"published_at":46},"cjeu-rules-orange-romanias-consent-practices-invalid-under-gdpr","CJEU Rules Orange Romania's Consent Practices Invalid Under GDPR","2026-09-16T08:20:50.266+00:00",{"slug":48,"title":49,"published_at":50},"spains-aepd-blanket-refusal-to-disclose-health-data-access-logs-violates-gdpr-article-15","Spain's AEPD: Blanket Refusal to Disclose Health Data Access Logs Violates GDPR Article 15","2026-09-15T16:22:14.189+00:00",{"slug":52,"title":53,"published_at":54},"spains-aepd-finds-ministry-of-defence-violated-gdpr-patient-data-access-rights","Spain's AEPD Finds Ministry of Defence Violated GDPR Patient Data Access Rights","2026-09-10T16:21:15.194+00:00",{"slug":56,"title":57,"published_at":58},"eu-coalition-pushes-to-replace-cookie-banners-with-automated-privacy-signals","EU Coalition Pushes to Replace Cookie Banners with Automated Privacy Signals","2026-09-10T06:20:19.193+00:00",{"slug":60,"title":61,"published_at":62},"finnish-court-rules-deceptive-cookie-banner-violates-gdpr-and-eprivacy-directive","Finnish Court Rules Deceptive Cookie Banner Violates GDPR and ePrivacy Directive","2026-09-09T16:20:39.521+00:00",{"slug":64,"title":65,"published_at":66},"grindrs-26m-hiv-data-sharing-settlement-a-costly-lesson-in-sensitive-data-governance","Grindr's £26M HIV Data Sharing Settlement: A Costly Lesson in Sensitive Data Governance","2026-09-08T11:20:37.032+00:00",[68,73,78,83,88,92],{"slug":69,"name":70,"problem":71,"stories":72},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",8,{"slug":74,"name":75,"problem":76,"stories":77},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",7,{"slug":79,"name":80,"problem":81,"stories":82},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",4,{"slug":84,"name":85,"problem":86,"stories":87},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",3,{"slug":89,"name":90,"problem":91,"stories":87},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":93,"name":94,"problem":95,"stories":96},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",2,[98,104,109,113,119,124,128,133],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","3","Control 3","Data Protection",48,{"family":105,"item":6,"code":106,"title":107,"together":108},"nist-privacy","Privacy Framework","NIST Privacy Framework",39,{"family":110,"item":6,"code":111,"title":111,"together":112},"itil","ITIL",28,{"family":114,"item":115,"code":116,"title":117,"together":118},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",18,{"family":114,"item":120,"code":121,"title":122,"together":123},"29101","ISO\u002FIEC 29101","ISO\u002FIEC 29101: Privacy architecture framework",16,{"family":5,"item":125,"code":126,"title":127,"together":123},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":5,"item":129,"code":130,"title":131,"together":132},"15","Article 15","Right of access by the data subject",15,{"family":5,"item":134,"code":135,"title":136,"together":137},"4","Article 4(11)","Definitions",13]