[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F28":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","28","Article 28","Processor",235,"Regulation (EU) 2016\u002F679 (General Data Protection Regulation)","**What it asks for.** Controllers may only use processors that provide sufficient guarantees of appropriate technical and organisational measures. Processing must be governed by a contract or other legal act that sets out the subject matter, duration, nature and purpose of processing and includes specified obligations, such as acting only on documented instructions, confidentiality, security, controls on sub-processors, assistance to the controller, deletion or return of data and audit support.\n\n**In practice.** Organisations assess vendors before engagement, sign data processing agreements that cover the required terms and keep a register of processors and sub-processors. Evidence includes due diligence records, signed agreements, sub-processor change notifications and the results of audits or reviews of certifications and reports.\n\n**Common gaps.** Due diligence is often done at onboarding and not repeated. Sub-processor chains are poorly tracked, and audit rights exist on paper but are never exercised.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_28","Read the official text on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},237,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"third-party-cloud-provider-breach-exposes-tsmc-employee-data","Third-Party Cloud Provider Breach Exposes TSMC Employee Data","2026-11-13T16:22:01.669+00:00",{"slug":24,"title":25,"published_at":26},"third-party-cloud-provider-exposes-46000-tsmc-employee-records","Third-Party Cloud Provider Exposes 46,000 TSMC Employee Records","2026-11-13T06:20:42.501+00:00",{"slug":28,"title":29,"published_at":30},"third-party-ai-vendor-breach-exposes-notion-customer-chat-data","Third-Party AI Vendor Breach Exposes Notion Customer Chat Data","2026-11-12T12:21:15.592+00:00",{"slug":32,"title":33,"published_at":34},"third-party-ai-provider-breach-exposes-notion-customer-chat-transcripts","Third-Party AI Provider Breach Exposes Notion Customer Chat Transcripts","2026-11-10T17:20:22.297+00:00",{"slug":36,"title":37,"published_at":38},"shadow-ai-personal-chatgpt-use-at-work-creates-data-exposure-risk","Shadow AI: Personal ChatGPT Use at Work Creates Data Exposure Risk","2026-10-16T16:21:15.148+00:00",{"slug":40,"title":41,"published_at":42},"ransomware-negotiator-secretly-worked-for-the-attackers","Ransomware Negotiator Secretly Worked for the Attackers","2026-10-16T15:20:17.253+00:00",{"slug":44,"title":45,"published_at":46},"north-korean-it-worker-fraud-exposes-hiring-and-identity-verification-gaps","North Korean IT Worker Fraud Exposes Hiring and Identity Verification Gaps","2026-10-14T18:21:30.184+00:00",{"slug":48,"title":49,"published_at":50},"norway-fines-xandr-for-unlawful-personal-data-processing-tied-to-grindr","Norway Fines Xandr for Unlawful Personal Data Processing Tied to Grindr","2026-10-14T14:21:53.44+00:00",{"slug":52,"title":53,"published_at":54},"xandr-fined-86m-for-unlawfully-sharing-grindr-users-sexual-orientation-data","Xandr Fined €8.6M for Unlawfully Sharing Grindr Users' Sexual Orientation Data","2026-10-13T16:21:46.652+00:00",{"slug":56,"title":57,"published_at":58},"ransomware-negotiator-arrested-for-extortion-insider-threat-within-cybersecurity-industry","Ransomware Negotiator Arrested for Extortion: Insider Threat Within Cybersecurity Industry","2026-10-12T22:20:50.499+00:00",{"slug":60,"title":61,"published_at":62},"xandr-fined-96m-for-unlawful-sharing-of-grindr-users-sensitive-data","Xandr Fined $9.6M for Unlawful Sharing of Grindr Users' Sensitive Data","2026-10-12T22:20:35.997+00:00",{"slug":64,"title":65,"published_at":66},"finnish-healthcare-provider-fined-33k-for-sharing-patient-data-with-big-tech-via-tracking-tools","Finnish Healthcare Provider Fined €33K for Sharing Patient Data with Big Tech via Tracking Tools","2026-10-12T14:21:21.087+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",98,{"slug":74,"name":75,"problem":76,"stories":77},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",60,{"slug":79,"name":80,"problem":81,"stories":82},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",53,{"slug":84,"name":85,"problem":86,"stories":87},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",29,{"slug":89,"name":90,"problem":91,"stories":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",23,{"slug":94,"name":95,"problem":96,"stories":97},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",22,[99,105,110,116,121,127,132,137],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","15","Control 15","Service Provider Management",151,{"family":106,"item":107,"code":108,"title":108,"together":109},"itil","overview","ITIL",102,{"family":111,"item":112,"code":113,"title":114,"together":115},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",95,{"family":100,"item":117,"code":118,"title":119,"together":120},"3","Control 3","Data Protection",83,{"family":122,"item":123,"code":124,"title":125,"together":126},"nist-800-53","sa-9","SA-9","External System Services",79,{"family":5,"item":128,"code":129,"title":130,"together":131},"32","Article 32","Security of processing",70,{"family":5,"item":133,"code":134,"title":135,"together":136},"5","Article 5(1)(f)","Principles relating to processing of personal data",69,{"family":122,"item":138,"code":139,"title":140,"together":141},"ac-2","AC-2","Account Management",63]