[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-12":3},{"item":4,"lessons":16,"controls":26,"related":32},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-12","Annex A 8.12","ISO\u002FIEC 27001:2022 Annex A 8.12: Data leakage prevention",2,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects data leakage prevention measures to be applied to systems, networks and any other devices that process, store or transmit sensitive information. It was new in the 2022 edition.\n\n**In practice.** Good practice means first identifying and classifying sensitive information, then monitoring and controlling channels where it could leave, such as email, web uploads, removable media, cloud sharing and generative AI tools. Measures can block, warn or log. Auditors expect defined sensitive data types, configured controls, alert handling records and evidence of tuning.\n\n**Common gaps.** Typical gaps are tools deployed in monitor mode only, policies that miss cloud collaboration and new AI services, and alerts nobody reviews. Data protection and works council requirements for monitoring staff are also sometimes overlooked, especially in Europe.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22],{"slug":19,"title":20,"published_at":21},"italian-hospital-fined-10000-for-publishing-sensitive-candidate-data-online-for-five-years","Italian Hospital Fined €10,000 for Publishing Sensitive Candidate Data Online for Five Years","2026-09-08T10:22:33.886+00:00",{"slug":23,"title":24,"published_at":25},"employee-email-mistake-costs-electricity-company-212-in-gdpr-damages","Employee Email Mistake Costs Electricity Company €212 in GDPR Damages","2026-06-24T10:21:37.436+00:00",[27],{"slug":28,"name":29,"problem":30,"stories":31},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",1,[33,38,42,47,52,56,60,64],{"family":34,"item":35,"code":36,"title":37,"together":9},"cis","14","Control 14","Security Awareness and Skills Training",{"family":34,"item":39,"code":40,"title":41,"together":9},"3","Control 3","Data Protection",{"family":43,"item":44,"code":45,"title":46,"together":9},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":48,"item":49,"code":50,"title":51,"together":9},"nist-800-53","si-12","SI-12","Information Management and Retention",{"family":43,"item":53,"code":54,"title":55,"together":31},"32","Article 32","Security of processing",{"family":43,"item":57,"code":58,"title":59,"together":31},"33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":48,"item":61,"code":62,"title":63,"together":31},"sc-28","SC-28","Protection of Information at Rest",{"family":43,"item":65,"code":66,"title":67,"together":31},"6","Article 6","Lawfulness of processing"]