[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso\u002F27701":3},{"item":4,"lessons":16,"controls":65,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",287,"International Organization for Standardization (ISO) and IEC","**What it covers.** An international standard for establishing and improving a privacy information management system. It was first published in 2019 as an extension to ISO\u002FIEC 27001 and 27002, and a later edition allows it to be used as a standalone management system. It covers organisations acting as controllers and as processors of personal data.\n\n**In practice.** Organisations define the scope of personal data processing, assign privacy roles, maintain records of processing, and implement controls for lawful processing, data subject rights, retention and transfers. It is often used to demonstrate accountability under GDPR, alongside a mapping between the standard and legal obligations. Auditors expect a defined scope, risk assessment covering privacy, documented controls and evidence that they operate.\n\n**Common gaps.** Common gaps are treating privacy as a policy exercise without operational records, weak processor oversight, and a scope that excludes systems where personal data actually flows.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F71670.html","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"xandr-fined-86m-for-processing-grindr-users-sensitive-data-without-consent","Xandr Fined €8.6M for Processing Grindr Users' Sensitive Data Without Consent","2026-10-16T10:20:42.098+00:00",{"slug":23,"title":24,"published_at":25},"norway-fines-xandr-for-unlawful-personal-data-processing-tied-to-grindr","Norway Fines Xandr for Unlawful Personal Data Processing Tied to Grindr","2026-10-14T14:21:53.44+00:00",{"slug":27,"title":28,"published_at":29},"bulgarian-court-rules-gdpr-article-15-violated-by-incomplete-data-access-response","Bulgarian Court Rules GDPR Article 15 Violated by Incomplete Data Access Response","2026-10-14T12:20:34.389+00:00",{"slug":31,"title":32,"published_at":33},"iqvia-fined-7m-by-italys-dpa-for-gdpr-violations-exposing-3780-patients-health-data","IQVIA Fined €7M by Italy's DPA for GDPR Violations Exposing 3,780 Patients' Health Data","2026-10-14T10:20:50.218+00:00",{"slug":35,"title":36,"published_at":37},"ai-hiring-tools-trigger-gdpr-scrutiny-over-missing-risk-assessments","AI Hiring Tools Trigger GDPR Scrutiny Over Missing Risk Assessments","2026-10-14T10:20:18.748+00:00",{"slug":39,"title":40,"published_at":41},"xandr-fined-86m-for-unlawfully-sharing-grindr-users-sexual-orientation-data","Xandr Fined €8.6M for Unlawfully Sharing Grindr Users' Sexual Orientation Data","2026-10-13T16:21:46.652+00:00",{"slug":43,"title":44,"published_at":45},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-re-1791908476956","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent in Real-Time Bidding","2026-10-13T16:21:16.914+00:00",{"slug":47,"title":48,"published_at":49},"croatian-gambling-operator-fined-259m-for-unlawful-biometric-data-collection","Croatian Gambling Operator Fined €2.59M for Unlawful Biometric Data Collection","2026-10-13T16:21:00.119+00:00",{"slug":51,"title":52,"published_at":53},"croatian-gambling-operator-fined-259m-for-gdpr-consent-and-biometric-data-failures","Croatian Gambling Operator Fined €2.59M for GDPR Consent and Biometric Data Failures","2026-10-13T14:20:51.771+00:00",{"slug":55,"title":56,"published_at":57},"xandr-fined-85m-for-unlawful-processing-of-sensitive-grindr-user-data-in-real-time-bidding","Xandr Fined €8.5M for Unlawful Processing of Sensitive Grindr User Data in Real-Time Bidding","2026-10-13T14:20:35.881+00:00",{"slug":59,"title":60,"published_at":61},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent","2026-10-13T12:20:47.783+00:00",{"slug":63,"title":44,"published_at":64},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-real-time-biddin","2026-10-13T12:20:33.036+00:00",[66,71,76,81,86,90],{"slug":67,"name":68,"problem":69,"stories":70},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",87,{"slug":72,"name":73,"problem":74,"stories":75},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",73,{"slug":77,"name":78,"problem":79,"stories":80},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",28,{"slug":82,"name":83,"problem":84,"stories":85},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",18,{"slug":87,"name":88,"problem":89,"stories":85},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":91,"name":92,"problem":93,"stories":94},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",5,[96,102,108,114,118,123,128,133],{"family":97,"item":98,"code":99,"title":100,"together":101},"cis","3","Control 3","Data Protection",251,{"family":103,"item":104,"code":105,"title":106,"together":107},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",232,{"family":109,"item":110,"code":111,"title":112,"together":113},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",183,{"family":115,"item":104,"code":116,"title":116,"together":117},"itil","ITIL",182,{"family":109,"item":119,"code":120,"title":121,"together":122},"6","Article 6","Lawfulness of processing",121,{"family":109,"item":124,"code":125,"title":126,"together":127},"35","Article 35","Data protection impact assessment",102,{"family":109,"item":129,"code":130,"title":131,"together":132},"13","Article 13","Information to be provided where personal data are collected from the data subject",99,{"family":134,"item":135,"code":136,"title":137,"together":70},"nist-800-53","pt-2","PT-2","Authority to Process Personally Identifiable Information"]