[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso\u002F29134":3},{"item":4,"lessons":16,"controls":38,"related":44},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso","29134","ISO\u002FIEC 29134","ISO\u002FIEC 29134: Guidelines for privacy impact assessment",5,"International Organization for Standardization (ISO) and IEC","**What it covers.** An international standard giving guidance on the process for privacy impact assessments and on the structure and content of a PIA report. It helps organisations identify and treat privacy risks of processing personal data.\n\n**In practice.** Organisations decide when an assessment is needed, describe the processing and data flows, consult stakeholders, assess risks to individuals and agree treatment measures, then document and review the result. It is often used to structure data protection impact assessments under GDPR, alongside regulator guidance. Evidence includes completed assessments, treatment plans and follow-up records.\n\n**Common gaps.** Common gaps are assessments done after a system is built, reports not updated when processing changes and agreed measures not tracked to implementation. Assessments also often focus on legal compliance rather than real risks to individuals.",null,"https:\u002F\u002Fwww.iso.org\u002Fisoiec-27001-information-security.html","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34],{"slug":19,"title":20,"published_at":21},"italian-meteorological-institute-fined-for-unlawful-cctv-surveillance-without-dpia-or-employee-notic","Italian Meteorological Institute Fined for Unlawful CCTV Surveillance Without DPIA or Employee Notice","2026-10-07T08:21:59.854+00:00",{"slug":23,"title":24,"published_at":25},"italian-municipality-fined-for-gdpr-violations-in-traffic-camera-data-collection","Italian Municipality Fined for GDPR Violations in Traffic Camera Data Collection","2026-07-21T20:20:21.689+00:00",{"slug":27,"title":28,"published_at":29},"italian-garante-fines-company-for-gdpr-failures-llm-training-transparency-age-verification-and-missi","Italian Garante Fines Company for GDPR Failures: LLM Training Transparency, Age Verification, and Missing DPIAs","2026-07-14T10:22:01.316+00:00",{"slug":31,"title":32,"published_at":33},"italian-dpa-fines-employer-for-unlawful-continuous-gps-tracking-of-staff-vehicles","Italian DPA Fines Employer for Unlawful Continuous GPS Tracking of Staff Vehicles","2026-07-07T14:20:21.619+00:00",{"slug":35,"title":36,"published_at":37},"italian-dpa-fines-company-for-excessive-employee-vehicle-tracking","Italian DPA Fines Company for Excessive Employee Vehicle Tracking","2026-07-07T12:21:11.984+00:00",[39],{"slug":40,"name":41,"problem":42,"stories":43},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",4,[45,50,54,59,64,68,72,77],{"family":46,"item":47,"code":48,"title":49,"together":9},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":46,"item":51,"code":52,"title":53,"together":9},"35","Article 35","Data protection impact assessment",{"family":55,"item":56,"code":57,"title":58,"together":9},"cis","3","Control 3","Data Protection",{"family":60,"item":61,"code":62,"title":63,"together":43},"nist-800-53","pt-2","PT-2","Authority to Process Personally Identifiable Information",{"family":46,"item":65,"code":66,"title":67,"together":43},"13","Article 13","Information to be provided where personal data are collected from the data subject",{"family":46,"item":69,"code":70,"title":71,"together":43},"25","Article 25","Data protection by design and by default",{"family":73,"item":74,"code":75,"title":76,"together":43},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",{"family":78,"item":74,"code":79,"title":79,"together":80},"itil","ITIL",3]