[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-34":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-34","Annex A 5.34","ISO\u002FIEC 27001:2022 Annex A 5.34: Privacy and protection of PII",38,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects the organisation to identify and meet its requirements for preserving privacy and protecting personally identifiable information, in line with applicable laws, regulations and contracts.\n\n**In practice.** Good practice starts with knowing which legal requirements apply, such as GDPR, and where personal data is processed. Responsibilities are assigned, often to a privacy officer, and supported by policies, records of processing, data protection impact assessments and technical measures such as access control and encryption. Auditors expect to see this inventory of obligations and data, assigned roles and evidence that controls are applied and reviewed.\n\n**Common gaps.** Typical gaps are privacy handled entirely by legal without links to security controls, incomplete records of processing and no review when systems change.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},44,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"third-party-cloud-provider-breach-exposes-tsmc-employee-data","Third-Party Cloud Provider Breach Exposes TSMC Employee Data","2026-11-13T16:22:01.669+00:00",{"slug":24,"title":25,"published_at":26},"third-party-cloud-provider-exposes-46000-tsmc-employee-records","Third-Party Cloud Provider Exposes 46,000 TSMC Employee Records","2026-11-13T06:20:42.501+00:00",{"slug":28,"title":29,"published_at":30},"cjeu-rules-dpas-are-gdpr-controllers-when-handling-complaints-1794399709398","CJEU Rules DPAs Are GDPR Controllers When Handling Complaints","2026-11-11T12:21:49.345+00:00",{"slug":32,"title":33,"published_at":34},"biometric-time-tracking-system-deployed-without-mandatory-dpia","Biometric Time-Tracking System Deployed Without Mandatory DPIA","2026-11-11T11:20:22.657+00:00",{"slug":36,"title":37,"published_at":38},"italian-ministry-of-justice-fined-for-excessive-public-disclosure-of-candidate-data","Italian Ministry of Justice Fined for Excessive Public Disclosure of Candidate Data","2026-11-10T17:22:06.561+00:00",{"slug":40,"title":41,"published_at":42},"italian-ministry-of-justice-fined-for-publicly-displaying-notary-candidates-personal-data-without-le","Italian Ministry of Justice Fined for Publicly Displaying Notary Candidates' Personal Data Without Legal Basis","2026-11-10T10:22:27.409+00:00",{"slug":44,"title":45,"published_at":46},"telco-found-liable-for-gdpr-breach-after-identity-fraud-enabled-by-weak-verification","Telco Found Liable for GDPR Breach After Identity Fraud Enabled by Weak Verification","2026-10-14T18:20:33.817+00:00",{"slug":48,"title":49,"published_at":50},"romanian-dpa-fines-customer-care-firm-5000-after-data-breach-exposes-sensitive-employee-and-banking-","Romanian DPA Fines Customer Care Firm €5,000 After Data Breach Exposes Sensitive Employee and Banking Data","2026-10-09T16:20:25.34+00:00",{"slug":52,"title":53,"published_at":54},"ai-hiring-tool-triggers-gdpr-warning-over-lack-of-dpias-and-transparency","AI Hiring Tool Triggers GDPR Warning Over Lack of DPIAs and Transparency","2026-10-08T16:21:43.317+00:00",{"slug":56,"title":57,"published_at":58},"employee-fined-for-photographing-and-sharing-patients-sensitive-health-data","Employee Fined for Photographing and Sharing Patients' Sensitive Health Data","2026-10-06T16:20:25.103+00:00",{"slug":60,"title":61,"published_at":62},"romanian-dpa-fines-employer-5000-for-unlawful-biometric-attendance-system","Romanian DPA Fines Employer €5,000 for Unlawful Biometric Attendance System","2026-09-29T16:22:17.469+00:00",{"slug":64,"title":65,"published_at":66},"300k-gdpr-fine-for-mishandling-75-of-erasure-requests","€300K GDPR Fine for Mishandling 75% of Erasure Requests","2026-09-29T14:20:25.731+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",10,{"slug":74,"name":75,"problem":76,"stories":77},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",6,{"slug":79,"name":80,"problem":81,"stories":82},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",5,{"slug":84,"name":85,"problem":86,"stories":87},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",4,{"slug":89,"name":90,"problem":91,"stories":92},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",3,{"slug":94,"name":95,"problem":96,"stories":97},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",2,[99,105,110,115,120,126,131,135],{"family":100,"item":101,"code":102,"title":103,"together":104},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",33,{"family":106,"item":107,"code":108,"title":109,"together":104},"cis","3","Control 3","Data Protection",{"family":111,"item":112,"code":113,"title":113,"together":114},"itil","overview","ITIL",25,{"family":100,"item":116,"code":117,"title":118,"together":119},"6","Article 6","Lawfulness of processing",20,{"family":121,"item":122,"code":123,"title":124,"together":125},"nist-800-53","ac-3","AC-3","Access Enforcement",16,{"family":100,"item":127,"code":128,"title":129,"together":130},"9","Article 9","Processing of special categories of personal data",13,{"family":132,"item":112,"code":133,"title":134,"together":130},"nist-privacy","Privacy Framework","NIST Privacy Framework",{"family":100,"item":136,"code":137,"title":138,"together":139},"25","Article 25","Data protection by design and by default",12]