[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F4":3},{"item":4,"lessons":16,"controls":66,"related":94},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","4","Article 4(11)","Definitions",54,"General Data Protection Regulation","**What it asks for.** Article 4 defines the key terms used throughout the regulation, including personal data, processing, controller, processor, pseudonymisation, personal data breach and consent. Point 11 defines consent as a freely given, specific, informed and unambiguous indication of the individual's wishes, given by a statement or by a clear affirmative action.\n\n**In practice.** Organisations use these definitions consistently in policies, contracts and assessments. For consent, that means no pre-ticked boxes or silence, separate consent for distinct purposes, enough information for the person to understand what they agree to and a genuine choice. Evidence includes consent interfaces, the wording used and records that show an affirmative action.\n\n**Common gaps.** Many teams interpret personal data too narrowly, overlooking identifiers such as device IDs or IP addresses. Consent is also frequently bundled or implied, which fails the definition.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_4","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},53,[19,23,27,30,34,38,42,46,50,54,58,62],{"slug":20,"title":21,"published_at":22},"cjeu-rules-dpas-are-gdpr-controllers-when-handling-complaints-1794399709398","CJEU Rules DPAs Are GDPR Controllers When Handling Complaints","2026-11-11T12:21:49.345+00:00",{"slug":24,"title":25,"published_at":26},"dynamic-ip-addresses-qualify-as-personal-data-under-gdpr-cjeu-advocate-general-opines","Dynamic IP Addresses Qualify as Personal Data Under GDPR, CJEU Advocate General Opines","2026-11-11T09:21:16.462+00:00",{"slug":28,"title":21,"published_at":29},"cjeu-rules-dpas-are-gdpr-controllers-when-handling-complaints","2026-11-10T15:21:16.315+00:00",{"slug":31,"title":32,"published_at":33},"italian-dpa-fines-controller-for-unlawful-processing-of-sensitive-patient-data-without-legal-basis","Italian DPA Fines Controller for Unlawful Processing of Sensitive Patient Data Without Legal Basis","2026-10-12T12:20:22.886+00:00",{"slug":35,"title":36,"published_at":37},"google-ordered-to-provide-full-gdpr-data-access-after-excluding-cookie-and-tracking-data","Google Ordered to Provide Full GDPR Data Access After Excluding Cookie and Tracking Data","2026-10-09T12:21:11.713+00:00",{"slug":39,"title":40,"published_at":41},"cjeu-rules-vague-partners-consent-invalid-under-gdpr","CJEU Rules Vague 'Partners' Consent Invalid Under GDPR","2026-10-08T10:20:54.336+00:00",{"slug":43,"title":44,"published_at":45},"dutch-dpa-fine-overturned-due-to-insufficient-proof-that-mac-addresses-constitute-personal-data","Dutch DPA Fine Overturned Due to Insufficient Proof That MAC Addresses Constitute Personal Data","2026-10-08T08:20:20.782+00:00",{"slug":47,"title":48,"published_at":49},"cjeu-rules-annotation-is-not-erasure-gdpr-applies-to-baptismal-registers","CJEU Rules Annotation Is Not Erasure: GDPR Applies to Baptismal Registers","2026-10-06T16:20:54.673+00:00",{"slug":51,"title":52,"published_at":53},"medical-employee-fined-for-photographing-and-sharing-patient-data-without-consent","Medical Employee Fined for Photographing and Sharing Patient Data Without Consent","2026-10-06T16:20:39.204+00:00",{"slug":55,"title":56,"published_at":57},"cjeu-opinion-gdpr-right-to-erasure-applies-to-church-baptismal-registers","CJEU Opinion: GDPR Right to Erasure Applies to Church Baptismal Registers","2026-10-06T08:20:36.043+00:00",{"slug":59,"title":60,"published_at":61},"cjeu-rules-physical-church-baptismal-registers-fall-under-gdpr","CJEU Rules Physical Church Baptismal Registers Fall Under GDPR","2026-10-06T08:20:21.201+00:00",{"slug":63,"title":64,"published_at":65},"cjeu-rules-vague-partner-consent-invalid-for-direct-marketing","CJEU Rules Vague 'Partner' Consent Invalid for Direct Marketing","2026-09-23T10:20:56.329+00:00",[67,72,77,82,86,90],{"slug":68,"name":69,"problem":70,"stories":71},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",13,{"slug":73,"name":74,"problem":75,"stories":76},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",4,{"slug":78,"name":79,"problem":80,"stories":81},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",1,{"slug":83,"name":84,"problem":85,"stories":81},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",{"slug":87,"name":88,"problem":89,"stories":81},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":91,"name":92,"problem":93,"stories":81},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[95,101,107,112,116,121,125,130],{"family":96,"item":97,"code":98,"title":99,"together":100},"cis","3","Control 3","Data Protection",45,{"family":102,"item":103,"code":104,"title":105,"together":106},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",40,{"family":5,"item":108,"code":109,"title":110,"together":111},"7","Article 7","Conditions for consent",24,{"family":113,"item":103,"code":114,"title":114,"together":115},"itil","ITIL",22,{"family":117,"item":118,"code":119,"title":120,"together":115},"iso","29101","ISO\u002FIEC 29101","ISO\u002FIEC 29101: Privacy architecture framework",{"family":5,"item":122,"code":123,"title":124,"together":115},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":117,"item":126,"code":127,"title":128,"together":129},"27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",21,{"family":5,"item":131,"code":132,"title":133,"together":134},"6","Article 6","Lawfulness of processing",17]