[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-188":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-188","SP 800-188","SP 800-188: De-Identifying Government Datasets: Techniques and Governance",32,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST guidance on de-identifying datasets before release or sharing, aimed at government agencies but useful to any organisation. It covers governance, risk assessment and techniques for removing or transforming identifying information while preserving usefulness of the data.\n\n**In practice.** Organisations set up a governance process that decides what may be released and to whom, assess re-identification risk, and choose suitable techniques such as suppression, generalisation, noise addition or synthetic data. Releases are documented and reviewed, and the effectiveness of de-identification is tested. Evidence includes release decisions, risk assessments and descriptions of methods used.\n\n**Common gaps.** Common gaps are assuming that removing names is enough, ignoring linkage with other datasets and no ongoing review as new data becomes available.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fsp800","Find it among NIST SP 800 publications","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"iqvia-fined-7m-for-inadequate-anonymization-and-unlawful-health-data-processing","IQVIA Fined €7M for Inadequate Anonymization and Unlawful Health Data Processing","2026-10-09T10:22:39.265+00:00",{"slug":23,"title":24,"published_at":25},"austrian-court-upholds-13m-gdpr-fine-for-unlawful-processing-of-political-affinity-data","Austrian Court Upholds €13M GDPR Fine for Unlawful Processing of Political Affinity Data","2026-10-08T10:21:24.951+00:00",{"slug":27,"title":28,"published_at":29},"dutch-dpa-fine-overturned-due-to-insufficient-proof-that-mac-addresses-constitute-personal-data","Dutch DPA Fine Overturned Due to Insufficient Proof That MAC Addresses Constitute Personal Data","2026-10-08T08:20:20.782+00:00",{"slug":31,"title":32,"published_at":33},"cjeu-rules-individuals-may-request-erasure-from-church-baptism-registers-under-gdpr","CJEU Rules Individuals May Request Erasure from Church Baptism Registers Under GDPR","2026-10-07T14:21:27.964+00:00",{"slug":35,"title":36,"published_at":37},"cjeu-rules-annotation-is-not-erasure-gdpr-applies-to-baptismal-registers","CJEU Rules Annotation Is Not Erasure: GDPR Applies to Baptismal Registers","2026-10-06T16:20:54.673+00:00",{"slug":39,"title":40,"published_at":41},"iqvia-fined-78m-for-inadequate-health-data-anonymization","IQVIA Fined $7.8M for Inadequate Health Data Anonymization","2026-10-05T18:20:20.555+00:00",{"slug":43,"title":44,"published_at":45},"austrian-court-rules-unredacted-personal-data-in-published-legal-decisions-violates-privacy-law","Austrian Court Rules Unredacted Personal Data in Published Legal Decisions Violates Privacy Law","2026-09-23T09:20:20.705+00:00",{"slug":47,"title":48,"published_at":49},"ai-service-collects-face-scans-and-mood-data-under-legitimate-interests-loophole","AI Service Collects Face Scans and Mood Data Under 'Legitimate Interests' Loophole","2026-09-19T12:20:18.091+00:00",{"slug":51,"title":52,"published_at":53},"dutch-court-overturns-600k-gdpr-fine-over-inadequate-personal-data-proof","Dutch Court Overturns €600K GDPR Fine Over Inadequate Personal Data Proof","2026-09-16T08:21:22.615+00:00",{"slug":55,"title":56,"published_at":57},"meta-sued-for-harvesting-biometric-data-without-consent-to-train-ai","Meta Sued for Harvesting Biometric Data Without Consent to Train AI","2026-09-11T20:20:50.364+00:00",{"slug":59,"title":60,"published_at":61},"austrian-supreme-court-rules-purpose-limitation-violation-under-gdpr-in-credit-assessment-case","Austrian Supreme Court Rules Purpose Limitation Violation Under GDPR in Credit Assessment Case","2026-09-10T16:22:40.326+00:00",{"slug":63,"title":64,"published_at":65},"clearview-ais-inquiryiq-raises-mass-surveillance-and-privacy-risk-concerns","Clearview AI's InquiryIQ Raises Mass Surveillance and Privacy Risk Concerns","2026-09-10T12:22:00.455+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",6,{"slug":73,"name":74,"problem":75,"stories":76},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",5,{"slug":78,"name":79,"problem":80,"stories":81},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",4,{"slug":83,"name":84,"problem":85,"stories":86},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",2,{"slug":88,"name":89,"problem":90,"stories":91},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",1,{"slug":93,"name":94,"problem":95,"stories":91},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[97,103,108,114,119,124,129,133],{"family":98,"item":99,"code":100,"title":101,"together":102},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",29,{"family":104,"item":105,"code":106,"title":107,"together":102},"cis","3","Control 3","Data Protection",{"family":109,"item":110,"code":111,"title":112,"together":113},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",19,{"family":109,"item":115,"code":116,"title":117,"together":118},"35","Article 35","Data protection impact assessment",18,{"family":109,"item":120,"code":121,"title":122,"together":123},"25","Article 25","Data protection by design and by default",15,{"family":109,"item":125,"code":126,"title":127,"together":128},"9","Article 9","Processing of special categories of personal data",14,{"family":130,"item":99,"code":131,"title":131,"together":132},"itil","ITIL",13,{"family":134,"item":135,"code":136,"title":137,"together":138},"iso","29101","ISO\u002FIEC 29101","ISO\u002FIEC 29101: Privacy architecture framework",12]