[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-34":3},{"item":4,"lessons":16,"controls":66,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-34","Annex A 5.34","ISO\u002FIEC 27001:2022 Annex A 5.34: Privacy and protection of PII",38,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects the organisation to identify and meet its requirements for preserving privacy and protecting personally identifiable information, in line with applicable laws, regulations and contracts.\n\n**In practice.** Good practice starts with knowing which legal requirements apply, such as GDPR, and where personal data is processed. Responsibilities are assigned, often to a privacy officer, and supported by policies, records of processing, data protection impact assessments and technical measures such as access control and encryption. Auditors expect to see this inventory of obligations and data, assigned roles and evidence that controls are applied and reviewed.\n\n**Common gaps.** Typical gaps are privacy handled entirely by legal without links to security controls, incomplete records of processing and no review when systems change.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"telco-found-liable-for-gdpr-breach-after-identity-fraud-enabled-by-weak-verification","Telco Found Liable for GDPR Breach After Identity Fraud Enabled by Weak Verification","2026-10-14T18:20:33.817+00:00",{"slug":23,"title":24,"published_at":25},"romanian-dpa-fines-customer-care-firm-5000-after-data-breach-exposes-sensitive-employee-and-banking-","Romanian DPA Fines Customer Care Firm €5,000 After Data Breach Exposes Sensitive Employee and Banking Data","2026-10-09T16:20:25.34+00:00",{"slug":27,"title":28,"published_at":29},"ai-hiring-tool-triggers-gdpr-warning-over-lack-of-dpias-and-transparency","AI Hiring Tool Triggers GDPR Warning Over Lack of DPIAs and Transparency","2026-10-08T16:21:43.317+00:00",{"slug":31,"title":32,"published_at":33},"employee-fined-for-photographing-and-sharing-patients-sensitive-health-data","Employee Fined for Photographing and Sharing Patients' Sensitive Health Data","2026-10-06T16:20:25.103+00:00",{"slug":35,"title":36,"published_at":37},"romanian-dpa-fines-employer-5000-for-unlawful-biometric-attendance-system","Romanian DPA Fines Employer €5,000 for Unlawful Biometric Attendance System","2026-09-29T16:22:17.469+00:00",{"slug":39,"title":40,"published_at":41},"300k-gdpr-fine-for-mishandling-75-of-erasure-requests","€300K GDPR Fine for Mishandling 75% of Erasure Requests","2026-09-29T14:20:25.731+00:00",{"slug":43,"title":44,"published_at":45},"italian-hospital-fined-30k-for-refusing-gdpr-erasure-request-on-recruitment-data","Italian Hospital Fined €30K for Refusing GDPR Erasure Request on Recruitment Data","2026-09-29T10:20:37.588+00:00",{"slug":47,"title":48,"published_at":49},"italian-dpa-fines-controller-5000-for-unlawful-employee-data-disclosure-to-employer","Italian DPA Fines Controller €5,000 for Unlawful Employee Data Disclosure to Employer","2026-09-28T18:23:05.405+00:00",{"slug":51,"title":52,"published_at":53},"estonian-dpa-orders-website-to-add-safeguards-after-republishing-restricted-personal-data","Estonian DPA Orders Website to Add Safeguards After Republishing Restricted Personal Data","2026-09-23T19:20:24.925+00:00",{"slug":55,"title":56,"published_at":57},"slovenian-institution-fails-to-identify-breach-victims-or-honor-access-rights","Slovenian Institution Fails to Identify Breach Victims or Honor Access Rights","2026-09-23T08:22:01.404+00:00",{"slug":59,"title":60,"published_at":61},"romanian-railway-company-fined-for-refusing-gdpr-data-access-request-1789554040811","Romanian Railway Company Fined for Refusing GDPR Data Access Request","2026-09-16T10:20:40.556+00:00",{"slug":63,"title":64,"published_at":65},"spains-aepd-rules-ministry-of-defence-violated-gdpr-by-withholding-health-data-access-logs","Spain's AEPD Rules Ministry of Defence Violated GDPR by Withholding Health Data Access Logs","2026-09-15T18:21:41.527+00:00",[67,72,77,81,86,91],{"slug":68,"name":69,"problem":70,"stories":71},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",9,{"slug":73,"name":74,"problem":75,"stories":76},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",5,{"slug":78,"name":79,"problem":80,"stories":76},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":82,"name":83,"problem":84,"stories":85},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",3,{"slug":87,"name":88,"problem":89,"stories":90},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",2,{"slug":92,"name":93,"problem":94,"stories":90},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[96,102,108,113,118,124,129,134],{"family":97,"item":98,"code":99,"title":100,"together":101},"cis","3","Control 3","Data Protection",33,{"family":103,"item":104,"code":105,"title":106,"together":107},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",31,{"family":109,"item":110,"code":111,"title":111,"together":112},"itil","overview","ITIL",25,{"family":103,"item":114,"code":115,"title":116,"together":117},"6","Article 6","Lawfulness of processing",18,{"family":119,"item":120,"code":121,"title":122,"together":123},"nist-800-53","ac-3","AC-3","Access Enforcement",15,{"family":125,"item":110,"code":126,"title":127,"together":128},"nist-privacy","Privacy Framework","NIST Privacy Framework",13,{"family":103,"item":130,"code":131,"title":132,"together":133},"9","Article 9","Processing of special categories of personal data",12,{"family":103,"item":135,"code":136,"title":137,"together":133},"25","Article 25","Data protection by design and by default"]