[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso\u002F29101":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso","29101","ISO\u002FIEC 29101","ISO\u002FIEC 29101: Privacy architecture framework",51,"International Organization for Standardization (ISO) and IEC","**What it covers.** An international standard that describes a privacy architecture framework for ICT systems that process personally identifiable information. It sets out concerns, architectural views and components that help system designers build privacy safeguards into the structure of a system, and it builds on the privacy principles of ISO\u002FIEC 29100.\n\n**In practice.** Applying it well means considering privacy at architecture stage: identifying where personal data is collected, stored and transferred, and placing components such as consent handling, access control, pseudonymisation and logging accordingly. Architects document how the design supports privacy principles and data minimisation. Evidence includes architecture documents with privacy views and design decisions linked to privacy impact assessments.\n\n**Common gaps.** Organisations often treat privacy as a late compliance check rather than an architecture input, and design documents seldom show where personal data flows.",null,"https:\u002F\u002Fwww.iso.org\u002Fisoiec-27001-information-security.html","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"croatian-gambling-operator-fined-259m-for-gdpr-biometric-and-consent-violations","Croatian Gambling Operator Fined €2.59M for GDPR Biometric and Consent Violations","2026-10-11T22:20:30.87+00:00",{"slug":23,"title":24,"published_at":25},"austrian-court-upholds-13m-gdpr-fine-for-unlawful-processing-of-political-affinity-data","Austrian Court Upholds €13M GDPR Fine for Unlawful Processing of Political Affinity Data","2026-10-08T10:21:24.951+00:00",{"slug":27,"title":28,"published_at":29},"dutch-dpa-fine-overturned-due-to-insufficient-proof-that-mac-addresses-constitute-personal-data","Dutch DPA Fine Overturned Due to Insufficient Proof That MAC Addresses Constitute Personal Data","2026-10-08T08:20:20.782+00:00",{"slug":31,"title":32,"published_at":33},"iqvia-fined-78m-for-inadequate-health-data-anonymization","IQVIA Fined $7.8M for Inadequate Health Data Anonymization","2026-10-05T18:20:20.555+00:00",{"slug":35,"title":36,"published_at":37},"metas-muse-ai-secretly-profiles-your-social-circles","Meta's Muse AI Secretly Profiles Your Social Circles","2026-10-03T14:20:23.017+00:00",{"slug":39,"title":40,"published_at":41},"spains-dgt-fined-for-collecting-excessive-personal-data-via-mobile-app","Spain's DGT Fined for Collecting Excessive Personal Data via Mobile App","2026-10-01T16:20:36.501+00:00",{"slug":43,"title":44,"published_at":45},"cjeu-rules-vague-partner-consent-invalid-for-direct-marketing","CJEU Rules Vague 'Partner' Consent Invalid for Direct Marketing","2026-09-23T10:20:56.329+00:00",{"slug":47,"title":48,"published_at":49},"austrian-court-rules-unredacted-personal-data-in-published-legal-decisions-violates-privacy-law","Austrian Court Rules Unredacted Personal Data in Published Legal Decisions Violates Privacy Law","2026-09-23T09:20:20.705+00:00",{"slug":51,"title":52,"published_at":53},"cjeu-rules-vague-consent-to-unidentified-partners-violates-gdpr","CJEU Rules Vague Consent to 'Unidentified Partners' Violates GDPR","2026-09-22T16:21:58.078+00:00",{"slug":55,"title":56,"published_at":57},"caixabank-fined-408k-for-gdpr-data-minimization-failures-in-inheritance-processes","CaixaBank Fined €408K for GDPR Data Minimization Failures in Inheritance Processes","2026-09-22T14:21:15.7+00:00",{"slug":59,"title":60,"published_at":61},"vague-consent-language-violates-gdpr-eu-court-rules","Vague Consent Language Violates GDPR, EU Court Rules","2026-09-22T12:22:23.843+00:00",{"slug":63,"title":64,"published_at":65},"austrian-court-rules-gdpr-purpose-limitation-violated-when-marketing-data-used-for-credit-assessment","Austrian Court Rules GDPR Purpose Limitation Violated When Marketing Data Used for Credit Assessments","2026-09-16T14:20:41.526+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",8,{"slug":73,"name":74,"problem":75,"stories":76},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",7,{"slug":78,"name":79,"problem":80,"stories":81},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",3,{"slug":83,"name":84,"problem":85,"stories":86},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",2,{"slug":88,"name":89,"problem":90,"stories":91},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":93,"name":94,"problem":95,"stories":91},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[97,103,109,113,119,124,129,134],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","3","Control 3","Data Protection",50,{"family":104,"item":105,"code":106,"title":107,"together":108},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",43,{"family":110,"item":105,"code":111,"title":111,"together":112},"itil","ITIL",32,{"family":114,"item":115,"code":116,"title":117,"together":118},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",31,{"family":114,"item":120,"code":121,"title":122,"together":123},"4","Article 4(11)","Definitions",22,{"family":114,"item":125,"code":126,"title":127,"together":128},"13","Article 13","Information to be provided where personal data are collected from the data subject",20,{"family":114,"item":130,"code":131,"title":132,"together":133},"35","Article 35","Data protection impact assessment",19,{"family":114,"item":135,"code":136,"title":137,"together":138},"25","Article 25","Data protection by design and by default",17]