[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-privacy\u002Foverview":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",469,"US National Institute of Standards and Technology (NIST)","**What it covers.** The NIST Privacy Framework is voluntary guidance for managing privacy risk arising from data processing. Version 1.0 is organised into five functions: Identify-P, Govern-P, Control-P, Communicate-P and Protect-P, with categories and subcategories beneath them. It is designed to sit alongside the NIST Cybersecurity Framework and supports building profiles of current and target state.\n\n**In practice.** Organisations map their data processing, identify privacy risks to individuals and choose outcomes from the framework that fit their context and legal obligations. A current and target profile helps prioritise improvement. Evidence includes data inventories, privacy risk assessments, policies on data handling, transparency material and records showing how individuals' requests are handled. In Europe it is often used as a structuring aid alongside GDPR rather than instead of it.\n\n**Common gaps.** Privacy risk is often assessed only as a compliance or security question, without considering harms to individuals. Profiles are created once and not maintained.",null,"https:\u002F\u002Fwww.nist.gov\u002Fprivacy-framework","Open the Privacy Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},465,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"burger-king-japan-breach-exposes-11m-app-users-personal-data","Burger King Japan Breach Exposes 11M App Users' Personal Data","2026-10-16T15:20:48.695+00:00",{"slug":24,"title":25,"published_at":26},"xandr-fined-86m-for-processing-grindr-users-sensitive-data-without-consent","Xandr Fined €8.6M for Processing Grindr Users' Sensitive Data Without Consent","2026-10-16T10:20:42.098+00:00",{"slug":28,"title":29,"published_at":30},"centerpoint-energy-breach-exposes-1m-texans-pii-via-cybercrime-forum-disclosure","CenterPoint Energy Breach Exposes 1M+ Texans' PII via Cybercrime Forum Disclosure","2026-10-15T10:20:22.506+00:00",{"slug":32,"title":33,"published_at":34},"norway-fines-xandr-for-unlawful-personal-data-processing-tied-to-grindr","Norway Fines Xandr for Unlawful Personal Data Processing Tied to Grindr","2026-10-14T14:21:53.44+00:00",{"slug":36,"title":37,"published_at":38},"bulgarian-court-rules-gdpr-article-15-violated-by-incomplete-data-access-response","Bulgarian Court Rules GDPR Article 15 Violated by Incomplete Data Access Response","2026-10-14T12:20:34.389+00:00",{"slug":40,"title":41,"published_at":42},"iqvia-fined-7m-by-italys-dpa-for-gdpr-violations-exposing-3780-patients-health-data","IQVIA Fined €7M by Italy's DPA for GDPR Violations Exposing 3,780 Patients' Health Data","2026-10-14T10:20:50.218+00:00",{"slug":44,"title":45,"published_at":46},"healthcare-provider-fined-33k-for-leaking-therapy-data-to-google-meta-microsoft-via-tracking-pixels","Healthcare Provider Fined €33K for Leaking Therapy Data to Google, Meta & Microsoft via Tracking Pixels","2026-10-14T08:20:59.917+00:00",{"slug":48,"title":49,"published_at":50},"xandr-fined-86m-for-unlawfully-sharing-grindr-users-sexual-orientation-data","Xandr Fined €8.6M for Unlawfully Sharing Grindr Users' Sexual Orientation Data","2026-10-13T16:21:46.652+00:00",{"slug":52,"title":53,"published_at":54},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-re-1791908476956","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent in Real-Time Bidding","2026-10-13T16:21:16.914+00:00",{"slug":56,"title":57,"published_at":58},"croatian-gambling-operator-fined-259m-for-unlawful-biometric-data-collection","Croatian Gambling Operator Fined €2.59M for Unlawful Biometric Data Collection","2026-10-13T16:21:00.119+00:00",{"slug":60,"title":61,"published_at":62},"croatian-gambling-operator-fined-259m-for-gdpr-consent-and-biometric-data-failures","Croatian Gambling Operator Fined €2.59M for GDPR Consent and Biometric Data Failures","2026-10-13T14:20:51.771+00:00",{"slug":64,"title":65,"published_at":66},"xandr-fined-85m-for-unlawful-processing-of-sensitive-grindr-user-data-in-real-time-bidding","Xandr Fined €8.5M for Unlawful Processing of Sensitive Grindr User Data in Real-Time Bidding","2026-10-13T14:20:35.881+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",151,{"slug":74,"name":75,"problem":76,"stories":77},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",135,{"slug":79,"name":80,"problem":81,"stories":82},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",56,{"slug":84,"name":85,"problem":86,"stories":87},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",40,{"slug":89,"name":90,"problem":91,"stories":92},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",36,{"slug":94,"name":95,"problem":96,"stories":97},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",19,[99,105,111,117,121,126,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","3","Control 3","Data Protection",386,{"family":106,"item":107,"code":108,"title":109,"together":110},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",267,{"family":112,"item":113,"code":114,"title":115,"together":116},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",232,{"family":118,"item":6,"code":119,"title":119,"together":120},"itil","ITIL",225,{"family":106,"item":122,"code":123,"title":124,"together":125},"6","Article 6","Lawfulness of processing",176,{"family":106,"item":127,"code":128,"title":129,"together":130},"35","Article 35","Data protection impact assessment",145,{"family":106,"item":132,"code":133,"title":134,"together":135},"13","Article 13","Information to be provided where personal data are collected from the data subject",141,{"family":106,"item":137,"code":138,"title":139,"together":140},"25","Article 25","Data protection by design and by default",116]