[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPmGDnEB-lmHYXXqyDnk88LfY7Macz4JiwF5beZ1N64k":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"9b7a8ccb-748c-4756-a32c-f608931f9fd0","irish-high-court-clarifies-gdpr-compliance-burden-of-proof-for-data-controllers","5b222f63-8709-45dc-91c1-56de27d5a40a","Irish High Court Clarifies GDPR Compliance Burden of Proof for Data Controllers","The Irish High Court ruled that once a claimant establishes a defendant is a data controller with engaged GDPR obligations, the burden shifts to the controller to prove its own compliance. This case, involving Microsoft's Xandr real-time bidding platform, highlights that data controllers cannot passively assume compliance — they must be able to affirmatively demonstrate it. Real-time bidding ecosystems process vast amounts of personal data at scale, making documented accountability mechanisms essential. The ruling reinforces that GDPR's accountability principle (Article 5(2)) carries real legal weight in litigation and that controllers must proactively maintain and produce evidence of compliance.","**Immediate actions:**\n- Conduct a comprehensive audit of all data processing activities involving personal data to ensure documented lawful bases exist.\n- Review and update Records of Processing Activities (RoPA) to accurately reflect current data flows, especially within ad-tech or real-time bidding platforms.\n\n**Long-term improvements:**\n- Embed a data protection by design and by default framework into all product development and third-party platform integrations.\n- Appoint or empower a Data Protection Officer (DPO) to continuously monitor and document GDPR compliance posture across all controller activities.\n- Establish contractual accountability mechanisms with all data processors and sub-processors to ensure compliance obligations flow down the supply chain.\n\n**Detection & evidence measures:**\n- Implement ongoing compliance monitoring and logging of consent records, data subject requests, and processing activities to build an auditable evidence trail.\n- Schedule periodic Data Protection Impact Assessments (DPIAs) for high-risk processing activities such as behavioural advertising and profiling.",[12,13,14,15,16,17,18,19,20],"GDPR Article 5(1) – Principles relating to processing of personal data","GDPR Article 5(2) – Accountability principle","GDPR Article 24(1) – Responsibility of the controller","GDPR Article 30 – Records of processing activities","GDPR Article 35 – Data Protection Impact Assessment","NIST Privacy Framework PR.PO-P1 – Policies and procedures","NIST SP 800-53 PT-1 – Personally Identifiable Information Processing and Transparency Policy","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)",{},"published","2026-10-02T10:21:37.112096+00:00","2026-10-02T10:21:37.022+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=High_Court_-_2026_IEHC_640&diff=53281&oldid=0","high-court-2026-iehc-640-631c12","High Court - 2026 IEHC 640",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[44,48,52],{"slug":45,"name":46,"problem":47},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":49,"name":50,"problem":51},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":53,"name":54,"problem":55},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]