[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-33":3},{"item":4,"lessons":16,"controls":66,"related":94},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-33","Annex A 5.33","ISO\u002FIEC 27001:2022 Annex A 5.33: Protection of records",13,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects records to be protected from loss, destruction, falsification, unauthorised access and unauthorised release. It supports legal, regulatory and contractual obligations as well as the organisation's own need to keep evidence of its activities.\n\n**In practice.** Good practice means identifying which records the organisation must keep, for legal, regulatory, contractual or business reasons, and defining retention periods and storage. Records are protected with suitable controls for integrity and availability, such as access restrictions, backups and immutable storage for important logs, and the ability to read them over time is considered. Auditors expect a retention schedule, evidence of protection and controlled disposal.\n\n**Common gaps.** Typical gaps are no retention schedule, records held indefinitely by default and media or formats that become unreadable before the retention period ends.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"cjeu-rules-physical-church-baptismal-registers-fall-under-gdpr","CJEU Rules Physical Church Baptismal Registers Fall Under GDPR","2026-10-06T08:20:21.201+00:00",{"slug":23,"title":24,"published_at":25},"66m-accounts-exposed-in-times-car-data-breach-including-drivers-license-images","6.6M Accounts Exposed in Times Car Data Breach Including Driver's License Images","2026-10-01T12:21:38.729+00:00",{"slug":27,"title":28,"published_at":29},"microsoft-bolsters-ai-agent-security-with-dlp-auto-labeling-and-copilot-controls","Microsoft Bolsters AI Agent Security with DLP, Auto-Labeling, and Copilot Controls","2026-09-24T20:22:23.286+00:00",{"slug":31,"title":32,"published_at":33},"spains-aepd-blanket-refusal-to-disclose-health-data-access-logs-violates-gdpr-article-15","Spain's AEPD: Blanket Refusal to Disclose Health Data Access Logs Violates GDPR Article 15","2026-09-15T16:22:14.189+00:00",{"slug":35,"title":36,"published_at":37},"spains-aepd-finds-ministry-of-defence-violated-gdpr-patient-data-access-rights","Spain's AEPD Finds Ministry of Defence Violated GDPR Patient Data Access Rights","2026-09-10T16:21:15.194+00:00",{"slug":39,"title":40,"published_at":41},"italian-hospital-fined-10000-for-unlawful-publication-of-candidate-data-on-public-website","Italian Hospital Fined €10,000 for Unlawful Publication of Candidate Data on Public Website","2026-09-08T16:21:53.505+00:00",{"slug":43,"title":44,"published_at":45},"italian-dpa-fines-il-fatto-quotidiano-for-publishing-sensitive-health-data-in-violation-of-gdpr","Italian DPA Fines Il Fatto Quotidiano for Publishing Sensitive Health Data in Violation of GDPR","2026-08-26T10:21:57.802+00:00",{"slug":47,"title":48,"published_at":49},"lab-pharma-fined-for-retaining-influencer-data-after-contract-expiry-and-obstructing-dpa-investigati","Lab Pharma Fined for Retaining Influencer Data After Contract Expiry and Obstructing DPA Investigation","2026-08-21T14:21:11.616+00:00",{"slug":51,"title":52,"published_at":53},"polish-municipal-unit-fined-for-employee-data-leak-and-failure-to-report-gdpr-breach","Polish Municipal Unit Fined for Employee Data Leak and Failure to Report GDPR Breach","2026-07-09T14:22:09.682+00:00",{"slug":55,"title":56,"published_at":57},"polish-municipal-welfare-unit-fined-for-unreported-health-data-breach-exposed-via-public-server","Polish Municipal Welfare Unit Fined for Unreported Health Data Breach Exposed via Public Server","2026-07-09T14:21:23.423+00:00",{"slug":59,"title":60,"published_at":61},"gdpr-violation-sharing-personal-data-via-facebook-message-ruled-unlawful","GDPR Violation: Sharing Personal Data via Facebook Message Ruled Unlawful","2026-07-06T08:20:37.464+00:00",{"slug":63,"title":64,"published_at":65},"slovenian-dpa-penalises-controller-for-breach-response-failures-and-poor-access-policy","Slovenian DPA Penalises Controller for Breach Response Failures and Poor Access Policy","2026-06-30T14:20:40.746+00:00",[67,72,77,81,85,90],{"slug":68,"name":69,"problem":70,"stories":71},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",6,{"slug":73,"name":74,"problem":75,"stories":76},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",2,{"slug":78,"name":79,"problem":80,"stories":76},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":82,"name":83,"problem":84,"stories":76},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":86,"name":87,"problem":88,"stories":89},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":91,"name":92,"problem":93,"stories":89},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[95,101,107,112,118,122,127,131],{"family":96,"item":97,"code":98,"title":99,"together":100},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",12,{"family":102,"item":103,"code":104,"title":105,"together":106},"cis","3","Control 3","Data Protection",11,{"family":108,"item":109,"code":110,"title":110,"together":111},"itil","overview","ITIL",8,{"family":113,"item":114,"code":115,"title":116,"together":117},"nist-800-53","ac-3","AC-3","Access Enforcement",5,{"family":96,"item":119,"code":120,"title":121,"together":117},"25","Article 25","Data protection by design and by default",{"family":96,"item":123,"code":124,"title":125,"together":126},"32","Article 32","Security of processing",4,{"family":102,"item":128,"code":129,"title":130,"together":126},"8","Control 8","Audit Log Management",{"family":102,"item":132,"code":133,"title":134,"together":126},"6","Control 6","Access Control Management"]