[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-122":3},{"item":4,"lessons":16,"controls":62,"related":84},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-122","SP 800-122","SP 800-122: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)",11,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST guidance on identifying PII and determining the level of protection it needs. It introduces confidentiality impact levels for PII and recommends safeguards and incident response considerations specific to personal data.\n\n**In practice.** Organisations identify the PII they hold, assess the harm that would result from its disclosure, and apply safeguards such as minimisation, de-identification, access control and encryption accordingly. Incident response plans include steps for breaches of PII. Evidence includes data inventories, impact categorisation and documented safeguards. European organisations typically use it alongside GDPR requirements.\n\n**Common gaps.** Common gaps are collecting more PII than needed, inventories that miss unstructured data and no specific handling of personal data breaches. Breach response plans also often lack criteria for assessing harm to the people affected.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fsp800","Find it among NIST SP 800 publications","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58],{"slug":19,"title":20,"published_at":21},"croatian-gambling-operator-fined-259m-for-unlawful-biometric-data-collection","Croatian Gambling Operator Fined €2.59M for Unlawful Biometric Data Collection","2026-10-13T16:21:00.119+00:00",{"slug":23,"title":24,"published_at":25},"romanian-firm-fined-5000-for-unlawful-biometric-employee-tracking","Romanian Firm Fined €5,000 for Unlawful Biometric Employee Tracking","2026-09-29T17:20:26.435+00:00",{"slug":27,"title":28,"published_at":29},"romanian-dpa-fines-employer-5000-for-unlawful-biometric-attendance-system","Romanian DPA Fines Employer €5,000 for Unlawful Biometric Attendance System","2026-09-29T16:22:17.469+00:00",{"slug":31,"title":32,"published_at":33},"romanian-firm-fined-5000-for-unlawful-biometric-fingerprint-system","Romanian Firm Fined €5,000 for Unlawful Biometric Fingerprint System","2026-09-29T10:21:57.494+00:00",{"slug":35,"title":36,"published_at":37},"romanian-firm-fined-5000-for-unlawful-biometric-time-tracking-without-legal-basis","Romanian Firm Fined €5,000 for Unlawful Biometric Time-Tracking Without Legal Basis","2026-09-29T10:21:42.061+00:00",{"slug":39,"title":40,"published_at":41},"landlord-fined-for-sharing-tenants-personal-data-with-employer","Landlord Fined for Sharing Tenant's Personal Data with Employer","2026-09-08T14:22:06.583+00:00",{"slug":43,"title":44,"published_at":45},"landlord-fined-for-sharing-tenants-personal-data-with-employer-via-email","Landlord Fined for Sharing Tenant's Personal Data with Employer via Email","2026-09-03T12:22:14.123+00:00",{"slug":47,"title":48,"published_at":49},"5320-gdpr-fine-for-unsecured-discarded-employee-documents-in-slovenia","€5,320 GDPR Fine for Unsecured Discarded Employee Documents in Slovenia","2026-09-01T14:20:41.516+00:00",{"slug":51,"title":52,"published_at":53},"safepal-breach-exposes-39798-customers-pii-now-for-sale-on-dark-web","SafePal Breach Exposes 39,798 Customers' PII, Now for Sale on Dark Web","2026-08-17T00:20:19.969+00:00",{"slug":55,"title":56,"published_at":57},"polish-individual-fined-for-unlawful-camera-surveillance-beyond-property-boundaries","Polish Individual Fined for Unlawful Camera Surveillance Beyond Property Boundaries","2026-07-15T10:21:49.631+00:00",{"slug":59,"title":60,"published_at":61},"individual-fined-for-unlawful-cctv-surveillance-violating-gdpr","Individual Fined for Unlawful CCTV Surveillance Violating GDPR","2026-07-14T10:21:41.953+00:00",[63,68,72,76,80],{"slug":64,"name":65,"problem":66,"stories":67},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",1,{"slug":69,"name":70,"problem":71,"stories":67},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":73,"name":74,"problem":75,"stories":67},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",{"slug":77,"name":78,"problem":79,"stories":67},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":81,"name":82,"problem":83,"stories":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[85,90,95,101,106,110,115,121],{"family":86,"item":87,"code":88,"title":89,"together":9},"cis","3","Control 3","Data Protection",{"family":91,"item":92,"code":93,"title":94,"together":9},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":96,"item":97,"code":98,"title":99,"together":100},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",7,{"family":91,"item":102,"code":103,"title":104,"together":105},"6","Article 6","Lawfulness of processing",6,{"family":91,"item":107,"code":108,"title":109,"together":105},"35","Article 35","Data protection impact assessment",{"family":91,"item":111,"code":112,"title":113,"together":114},"9","Article 9","Processing of special categories of personal data",5,{"family":116,"item":117,"code":118,"title":119,"together":120},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",4,{"family":122,"item":97,"code":123,"title":123,"together":120},"itil","ITIL"]