Deploying AI Systems Securely by NSA

AI, Specific processing situations

Perspectives on Issues in AI Governance by Google

AI, Specific processing situations

Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms by EDPB

Consent, Lawfulness of Processing

REGULATION (EU) 2024/900 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 13 March 2024 on the transparency and targeting of political advertising

Marketing and Advertising, Specific processing situations

PRACTICE GUIDE SECURITY OF PERSONAL DATA Version 2024 by CNIL

Definitions, Personal Data

Report and Recommendations of the New York State Bar Association Task Force on Artificial Intelligence

AI, Specific processing situations

The American Privacy Rights Act (APRA) section-by-section draft

American Privacy Rights Act Discussion Draft

Technical and organisational measures signed by Superhosting.bg

Controllers and Processors, Technical and Organisational Measures (TOMs)

Personal data breach report form

Controllers and Processors, Data Breaches

Technical and Organizational Measures by Adobe Cloud Services

Controllers and Processors, Technical and Organisational Measures (TOMs)

META PLATFORMS INC v. FEDERAL TRADE COMMISSION (2024)

Data Sharing Code of Practice by UK ICO

Controllers and Processors, Data Sharing

Generative Artificial Intelligence Risk Assessment by State of California Department of Technology

AI, Risk Management, Specific processing situations

Decision on the merits 46/2024 by the Belgian DPA

Access Requests (DSAR), Data Subjects Rights

Data Protection Fining Guidelines by UK ICO

Liability and Penalties, Supervisory Authorities

Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria |EPDB

Certification, Controllers and Processors

EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act)

Data Transfers

EDPB-EDPS Joint Opinion 1/2022 on the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2021/953 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic |EPDB

Health Data, Principles, Sensitive Data

Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea |EPDB

Adequacy Decisions, Data Transfers

Opinion 04/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Norican Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 07/2022 on the draft decision of the Hungarian Supervisory Authority regarding the Controller Binding Corporate Rules of MOL Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 05/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Lundbeck Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 06/2022 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of Groupon International Limited |EPDB

Binding Corporate Rules, Data Transfers

Opinion 08/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Bioclinica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 38/2021 on the draft decision of the competent supervisory authority of Latvia regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 37/2021 on the draft decision of the competent supervisory authority of Malta regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Accreditation

Opinion 36/2021 on the draft decision of the competent supervisory authority of Norway regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 35/2021 on the draft decision of the competent supervisory authority of Belgium regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 39/2021 on whether Article 58(2)(g) GDPR could serve as a legal basis for a supervisory authority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject |EPDB

Data Controller, Data Subjects Rights, Definitions

Opinion 34/2021 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules of Otis |EPDB

Binding Corporate Rules, Data Transfers

Opinion 33/2021 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules of Carrier |EPDB

Binding Corporate Rules, Data Transfers

Opinion 31/2021 on the draft decision of the Spanish Supervisory Authority regarding the Processor Binding Corporate Rules of the COLT Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 30/2021 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the COLT Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 03/2022 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the WEBHELP Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 02/2022 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the WEBHELP Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 10/2022 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Controller Binding Corporate Rules of Fresenius Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 09/2022 on the draft decision of the Danish Supervisory Authority regarding the Processor Binding Corporate Rules of Bioclinica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 26/2022 on the draft decision of the Data Protection Authority of Bavaria for the Private Sector regarding the Controller Binding Corporate Rules of the Munich Re Reinsurance Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 24/2022 on the draft decision of the Swedish Supervisory Authority regarding the Processor Binding Corporate Rules of the Samres Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 23/2022 on the draft decision of the Swedish Supervisory Authority regarding the Controller Binding Corporate Rules of the Samres Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 22/2022 on the draft decision of the Liechtenstein Supervisory Authority regarding the Controller Binding Corporate Rules of Hilti Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 21/2022 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Ellucian Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 20/2022 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Ellucian Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 19/2022 on the draft decision of the Baden-Württemberg (Germany) Supervisory Authority regarding the Controller Binding Corporate Rules of the MercedesBenz Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 18/2022 on the draft decision of the Baden-Württemberg (Germany) Supervisory Authority regarding the Controller Binding Corporate Rules of the Daimler Truck Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 25/2022 regarding the European Privacy Seal (EuroPriSe ) certification criteria for the certification of processing operations by processors |EPDB

Certification, Controllers and Processors

EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse

Children as data subjects, Data Subjects Rights

EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space

Health Data, Principles, Sensitive Data

Opinion 17/2022 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the ANTOLIN Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 16/2022 on the draft decision of the competent supervisory authority of Slovenia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 15/2022 on the draft decision of the competent supervisory authority of Luxembourg regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 14/2022 on the draft decision of the competent supervisory authority of Bulgaria regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 13/2022 on the draft decision of the competent supervisory authority of Bulgaria regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 12/2022 on the draft decision of the competent supervisory authority of France regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 11/2022 on the draft decision of the competent supervisory authority of Poland regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 17/2023 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Informatica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 16/2023 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Informatica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 10/2023 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the PROSEGUR Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 9/2023 on the draft decision of the Italian Supervisory Authority regarding the Controller Binding Corporate Rules of Vertiv |EPDB

Binding Corporate Rules, Data Transfers

Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework |EPDB

Adequacy Decisions, Data Transfers

Opinion 8/2023 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of Autodesk Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 7/2023 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of Autodesk Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 22/2023 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules for employee data of the UPS Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 21/2023 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of the UPS Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 20/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Comcast Corporation Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 19/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the American Express Global Business Travel Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 18/2023 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of the Collibra Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria |EPDB

Certification, Controllers and Processors

Opinion 14/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Vestas Wind Systems Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 13/2023 on the draft decision of the competent supervisory authority of Croatia regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 12/2023 on the draft decision of the competent supervisory authority of Cyprus regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 11/2023 on the draft decision of the competent supervisory authority of Sweden regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Accreditation

Opinion 32/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Ramboll Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 31/2022 on the draft decision of the Slovak Supervisory Authority regarding the Processor Binding Corporate Rules of Piano Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 30/2022 on the draft decision of the Slovak Supervisory Authority regarding the Controller Binding Corporate Rules of Piano Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 29/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the DSV Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 28/2022 on the Europrivacy criteria of certification regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 (GDPR) |EPDB

Certification, Controllers and Processors

Opinion 27/2022 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of LEYTON Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 6/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Royal Greenland Group |EPDB

Binding Corporate Rules, Data Transfers

EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

Accreditation

EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro

Accreditation

Opinion 4/2023 on the draft decision of the competent supervisory authority of Malta regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 03/2023 on the draft decision of the competent supervisory authority of Romania regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 02/2023 on the draft decision of the competent supervisory authority of Latvia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to Article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 1/2023 on the draft decision of the competent supervisory authority of Croatia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to Article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 17/2023 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Informatica Group |EPDB

Binding Corporate Rules, Data Transfers

Recommendations 02/2021 on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions |EPDB

Consent, Lawfulness of Processing

Recommendations 01/2021 on the adequacy referential under the Law Enforcement Directive |EPDB

Adequacy Decisions, Data Transfers

Recommendations 02/2020 on the European Essential Guarantees for surveillance measures |EPDB

Specific processing situations, Surveillance

Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data |Version 2.0 |EPDB

Data Transfers

Recommendations 1/2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR) |EPDB

Data Transfers

Recommendation 01/2019 on the draft list of the European Data Protection Supervisor regarding the processing operations subject to the requirement of a data protection impact assessment (Article 39.4 of Regulation (EU) 2018/1725) |EPDB

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Opinion 36/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Booking.com Group |EPDB

Data Transfers

Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR |EPDB

Definitions, Main Establishment

Opinion 3/2024 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Accenture Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 2/2024 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the TELEFÓNICA Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 01/2024 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Booking.com Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 38/2023 on the draft decision of the competent supervisory authority of Slovenian regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR). |EPDB

Certification, Controllers and Processors

Opinion 37/2023 on the draft decision of the competent supervisory authority of Luxemburg regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Certification, Controllers and Processors

Opinion 35/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Carlsberg Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 34/2023 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Processor Binding Corporate Rules of the Cerner Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 33/2023 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Controller Binding Corporate Rules of the Cerner Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 32/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Thalès Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 31/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Thalès Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 30/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Sodexo Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 29/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Sodexo Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 28/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Servier Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 27/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Tessi Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 26/2023 on the draft decision of the Romanian Supervisory Authority regarding the Processor Binding Corporate Rules of the OSF Global Services Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 25/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the SHV Holding N.V. Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 24/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Nestlé Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 23/2023 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules for customer data of the UPS Group |EPDB

Binding Corporate Rules, Data Transfers

Rethinking Privacy in the AI Era | White Paper by Stanford University

AI, Specific processing situations

National Strategy to Advance Privacy-Preserving Data Sharing and Analytics by the EO by the US President

Anonymisation, Controllers and Processors, Technical and Organisational Measures (TOMs)

Biometric Data Guidance by the UK ICO

Principles, Sensitive Data

NIST Cybersecurity Framework 2.0: RESOURCE & OVERVIEW GUIDE

Comparison of U.S. State Privacy Laws. Data Protection Assessments by CIPL

Controllers and Processors, Data Protection Impact Assessment (DPIA)

A pro-innovation approach to AI regulation by UK ICO

AI, Specific processing situations

Case ZWO 22/775, Overijssel District, Netherlands

Liability and Penalties, Supervisory Authorities

EO 13800 on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

Controllers and Processors, Technical and Organisational Measures (TOMs)

PRESS RELEASE No 20/24 | Case C-118-22

Data Subjects Rights, Right to Erasure

THE NEW STANDARD CONTRACTUAL CLAUSES – QUESTIONS AND ANSWERS

Data Transfers, Standard Contractual Clauses (SCC)

EU-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

SWISS-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

[UK EXTENSION] EU-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

Transfer Impact Assessment (TIA) Template by HSE

Data Transfers

Transfer Risk Assessment Tool by the UK ICO

Data Transfers

Transparency and Consent Framework Policies by IAB Europe

Consent, Cookies, Lawfulness of Processing, Principles, Transparency

Analysis of the final compromise text of the EU AI Act with a view to agreement by the Belgian Presidency

AI, Specific processing situations

DRAFT RISK ASSESSMENT REGULATIONS FOR CALIFORNIA PRIVACY PROTECTION AGENCY

Risk Management

CASE STUDIES (2018 – 2023) by the Irish DPC

Access Requests (DSAR), Controllers and Processors, Data Breaches, Data Subjects Rights, Liability and Penalties, Supervisory Authorities

Datenschutzkonforme Künstliche Intelligenz Checkliste mit Prüfkriterien nach DS-GVO

AI, Specific processing situations

GDPR: a culture of non-compliance? Numbers of evidence-based enforcement efforts by nyob

Liability and Penalties, Supervisory Authorities

[UK] International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Data Transfers

Guide to Technical and Organisational Data Protection Measures (TOM) by the Swiss FDPIC

Controllers and Processors, Technical and Organisational Measures (TOMs)

Recommendations 02/2020 on the European Essential Guarantees for surveillance measures

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

NIST Critical Infrastructure Framework

NIST Privacy Framework v1

2023 Coordinated Enforcement Action Designation and Position of Data Protection Officers by EDPB

Controllers and Processors, Data Protection Officer (DPO)

Draft Impact Assessment Framework by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA)

One-stop-shop case digest on Security of Processing and Data Breach Notification by the EDPB

Controllers and Processors, Data Breaches, Technical and Organisational Measures (TOMs)

Artificial Intelligence Strategy of the CJEU

AI, Specific processing situations

Generative AI framework for HM Government by the UK Central Digital and Data Office

AI, Specific processing situations

[PROPOSAL 2024] EU AI ACT

AI, Specific processing situations

Guide to Binding Corporate Rules by the UK ICO

Data Transfers

Report on the first review of the functioning of the adequacy decisions adopted pursuant to Article 25(6) of Directive 95/46/EC

Adequacy Decisions, Data Transfers

GUIDELINES CLOCKING AND ATTENDANCE CONTROL PROCESSING USING BIOMETRIC SYSTEMS BY THE AEPD

Employment, Principles, Sensitive Data, Specific processing situations

EU DATA ACT

Case C 683-2021

Controllers and Processors, Liability and Penalties, Supervisory Authorities

[Draft] Transfer Impact Assessment by the CNIL

Data Transfers

How to handle someone’s data subject access request when there is information about other individuals involved by the Irish DPA

Access Requests (DSAR), Data Subjects Rights

Privacy Notice Template by the UK ICO

Data Subjects Rights

Case T-1077/23

AI, Copyright, Specific processing situations

AI fairness in practice by the Alan Turing Institute

AI, Specific processing situations

(NEW JERSEY) ACT concerning [commercial Internet websites] online, services, consumers, and [personally identifiable information] personal data and supplementing Title 56 of the Revised Statutes

Interim Report – Governing AI for Humanity by UN AI Advisory Body

AI, Specific processing situations

Processing Personal Data on the Basis of Legitimate Interests under the GDPR by FPF

Lawfulness of Processing, Legitimate Interest

Information Commissioner’s Further Response to the Data Protection and Digital Information Bill (DPDI Bill)

Principles, Sensitive Data

GUIDELINES ON LEGITIMATE INTEREST by the NPC of the Republic of Philippines

Lawfulness of Processing, Legitimate Interest

The NYT vs OpenAI and Microsoft

AI, Copyright, Specific processing situations

Transparency in health and social care by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

Annex: A summary of the Transparency in Health and Social Care guidance impact assessment by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

[PRESS RELEASE No 191/23] CJEU on the right to compensation for non-material damages based on the fear of possible misuse

Liability and Penalties, Supervisory Authorities

[DRAFT] FRAMEWORK CONVENTION ON ARTIFICIAL INTELLIGENCE, HUMAN RIGHTS, DEMOCRACY AND THE RULE OF LAW

AI, Specific processing situations

A Guide to Cookies and Compliance by DMA

Consent, Cookies, Lawfulness of Processing

[Press release] Commission opens formal proceedings against X under the Digital Services Act

Digital Services Act

RISK FRAMEWORK FOR BODY-RELATED DATA IN IMMERSIVE TECHNOLOGIES BY FPF

Principles, Sensitive Data

International data transfer agreement and guidance by the UK ICO

Data Transfers

[Draft] Guidelines on the processing of personal data in regard to employment by the UK ICO

Employment, Specific processing situations

[DRAFT] Data Confidentiality – Identifying and Protecting Assets Against Data Breaches by NIST

Controllers and Processors, Data Breaches

Understanding the Role of PETs and PPTs in the Digital Age

Controllers and Processors, Technical and Organisational Measures (TOMs)

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL LAYING DOWN HARMONISED RULES ON ARTIFICIAL INTELLIGENCE (ARTIFICIAL INTELLIGENCE ACT)

AI, Specific processing situations

[Draft] Guidelines on the processing of personal data in regard to recruitment by the UK ICO

Automated Decision-making, Controllers and Processors, Data Protection Impact Assessment (DPIA), Employment, Specific processing situations

New rules for Artificial Intelligence – Questions and Answers by the European Commision

AI, Specific processing situations

Cybersecurity of Artificial Intelligence in the AI Act by the European Commision

Controllers and Processors, Technical and Organisational Measures (TOMs)

Privacy-Enhancing and Privacy Preserving Technologies: Understanding the Role of PETs and PPTs in the Digital Age by CIPL

Controllers and Processors, Technical and Organisational Measures (TOMs)

European Commision press release on AI Act Agreement

AI, Specific processing situations

Urgent Binding Decision 01/2023 requested by the Norwegian SA for the ordering of final measures regarding Meta Platforms Ireland Ltd (Art. 66(2) GDPR)

Liability and Penalties, Supervisory Authorities

Guidelines for evaluating differential priavacy gurantees by NIST

Anonymisation, Controllers and Processors, Technical and Organisational Measures (TOMs)

AI Act Provisional Agreement Press Release

AI, Specific processing situations

Privacy Impact Assessment Tool by the Australian Government

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Personal Data Protection Factsheet by the ECHR

Data Subjects Rights

Practical Guide on Controller to Processor Contracts by the Irish DPC

Controllers and Processors, Data Processing Agreement (DPA)

SME Guide on Information Security Controls by European Digital SME Alliance

Controllers and Processors, Technical and Organisational Measures (TOMs)

Guidelines issued by the Malta Gaming Authority for the Maltese Gaming Industry

Gaming, Specific processing situations

Press Release No 184-23 by the CJEU

Joint Controllers, Liability and Penalties, Supervisory Authorities

Everything Recruiters Need to Know About GDPR by ZOHO

Employment, Specific processing situations

Guidance on the Use of CCTV – For Data Controllers by the Irish DPC

CCTV, Specific processing situations

Benefits and Risks of Generative Artificial Intelligence Report by the State of California

AI, Specific processing situations

Guidelines for secure AI system development by UK NCSC and US CISA

AI, Specific processing situations

The impact of the General Data Protection Regulation (GDPR) on artificial intelligence by the EU Parliamnet

AI, Specific processing situations

AUTOMATED DECISIONMAKING TECHNOLOGY REGULATIONS (DRAFT) by CPPA

Automated Decision-making, Controllers and Processors

Opinion on processing of CCTV data in regard to employee performance analytics by the Bulgarian DPA

CCTV, Employment, Specific processing situations

Technical Recommendations on the use of APIs by CNIL

Controllers and Processors, Technical and Organisational Measures (TOMs)

Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence (PROPOSED MEMORANDUM )

AI, Specific processing situations

GDPR guidance: Legitimate Inerersts Assessments (LIA) for Digital Advertising

Lawfulness of Processing, Legitimate Interest, Marketing and Advertising, Specific processing situations

PRACTICAL GUIDANCE FOR THE USE OF GENERATIVE ARTIFICIAL INTELLIGENCE IN THE PRACTICE OF LAW by State Bar of California

AI, Specific processing situations

AI Privacy Policy template

AI, Specific processing situations

DPIA for AI template

Controllers and Processors, Data Protection Impact Assessment (DPIA)

TOWARDS A SUSTAINABLE, MULTILATERAL, AND UNIVERSAL SOLUTION FOR INTERNATIONAL DATA TRANSFER by the UK Government

Data Transfers

Global Toolkit on AI and the Rule of Law for the Judiciary by UNESCO

AI, Specific processing situations

Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive by EDPB

Consent, Lawfulness of Processing

Exceeding customer expectations by Google

Principles, Privacy by Design

Case C-307-2022

Data Subjects Rights

Generative AI: The Data Protection Implications by CEDPO

AI, Specific processing situations

Artificial intelligence for healthcare and well-being during exceptional times | European Commision

COMMON GUIDEPOSTS TO PROMOTE INTEROPERABILITY IN AI RISK MANAGEMENT | German Ministry of labor and social Affairs

AI, Specific processing situations

DSAR management for controllers by Bailiwick of Guernsey’s DPA

Access Requests (DSAR), Data Subjects Rights

Bulgarian CPPD Newsletter

Children as data subjects, Controllers and Processors, Data Subjects Rights, Technical and Organisational Measures (TOMs)

Study on the essence of the fundamental rights to privacy and to protection of personal data by EDPS

Data Subjects Rights

Protection of workers’ personal data: General principles by ILO

Employment, Specific processing situations

Online Safety Bill | UK

Automated Decision-Making Under the GDPR by the FPF

AI, Automated Decision-making, Controllers and Processors, Specific processing situations

Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence by the US President

AI, Specific processing situations

Child oriented approach to data processing by DPC Ireland

Children as data subjects, Data Subjects Rights

Audit Requirements for Personal Data Processing Activities involving AI by AEPD

Controllers and Processors, Data Protection Impact Assessment (DPIA), Technical and Organisational Measures (TOMs)

AI and Data Protection Risk Toolkit by UK ICO

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Legal Risks to being a DPO by IAPP

Controllers and Processors, Data Protection Officer (DPO)

Artificial intelligence and the Information Privacy Principles by the Privacy Commisioner (New Zealand)

AI, Specific processing situations

Data breach preparation and response by the Australian Information Commisioners

Controllers and Processors, Data Breaches

Opinion 44/2023 on the Proposal for Artificial Intelligence Act in the light of legislative developments

AI, Specific processing situations

Mobile Privacy Disclosures by the FTC

Data Subjects Rights, Right to know

Description of the dataset template by CNIL

AI, Specific processing situations

Data Breach Process Guidance by HSE

Controllers and Processors, Data Breaches

Privacy Information Management with ISO 27001

ISO 27001

AI How-to Sheets by CNIL

AI, Specific processing situations

T‑553-23 R

Data Transfers

Drones and Data Protection Guidelines by AEPD

Drones, Specific processing situations

Data protection and monitoring workers

Employment, Specific processing situations

Baseline Cyber Security for SMEs

Controllers and Processors, Technical and Organisational Measures (TOMs)

How to use AI and personal data

AI, Specific processing situations

Public Benefit and Privacy Panel for Health and Social Care (Guidance for applicants)

Health Data, Principles, Sensitive Data

Decision of the Data Protection Commission made pursuant to Section 111 of the DPA, 2018 and Articles 60 and 65 of the GDPR

Fairness, Liability and Penalties, Principles, Supervisory Authorities

Infographic DPC TikTok Fine

Fairness, Liability and Penalties, Principles, Supervisory Authorities

Government access to datain third countries

Data Processing by the Government, Specific processing situations

Study on the appropriate safeguards under Article 89(1) GDPR for the processing of personal data for scientific research

Scientific Research, Specific processing situations

Study on the national administrative rules impacting the cooperation duties for the national supervisory authorities

Supervisory Authorities

One-Stop-Shop thematic case digest: RIGHT TO OBJECTAND RIGHT TO ERASURE

Data Subjects Rights, Right to Erasure, Right to Object

Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

Recommendations 1-2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR)

Code of Conduct, Controllers and Processors

Guidelines 01/2023 on Article 37 Law Enforcement Directive

Data Transfers

OPINION 1/15 OF 26. 7. 2017

Data Transfers

CASE OF BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM

National Security, Specific processing situations

Case C-101/01

Data Transfers, Definitions, Principles, Processing of personal data, Sensitive Data

C-460/20

Data Subjects Rights, Right to Erasure, Search Engines, Specific processing situations

C-136/17

Data Subjects Rights, Principles, Right to Erasure, Search Engines, Sensitive Data, Specific processing situations

C-496/17

Lawfulness of Processing, Public Interests

C-507/17

Data Subjects Rights, Right to Erasure, Territorial Scope

Joined Cases C-511/18, C-512/18 and C-520/18

Criminal Convictions and Offences, National Security, Principles, Specific processing situations

C-708/18

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

C-61/19

Consent, Lawfulness of Processing

C-272/19

Access Requests (DSAR), Data Controller, Data Subjects Rights, Definitions

C-439/19

Criminal Convictions and Offences, Lawfulness of Processing, Principles, Public Interests

C-597/19

Lawfulness of Processing, Legitimate Interest

C-645/19

Supervisory Authorities

C-102/20

Consent, Lawfulness of Processing

C-184/20

Principles, Sensitive Data

C-245/20

Supervisory Authorities

C-319/20

Representation of data subjects

C-534/20

Controllers and Processors, Data Protection Officer (DPO)

C-34/21

Employment, Specific processing situations

C-77/21

Principles, Purpose limitation

C-129/21

Consent, Data Subjects Rights, Lawfulness of Processing, Right to Erasure

C-154/21

Access Requests (DSAR), Data Subjects Rights

C-180/21

Criminal Convictions and Offences, Lawfulness of Processing, Principles, Public Interests

C-205/21

Consent, Criminal Convictions and Offences, Lawfulness of Processing, Principles

C-268/21

Data minimisation, Principles

C-300/21

Liability and Penalties, Supervisory Authorities

C-306/21

Lawfulness of Processing, Public Interests

C-349/21

Access Requests (DSAR), Data Subjects Rights

C-453/21

Controllers and Processors, Data Protection Officer (DPO)

Case C-60/22

Accountability, Joint Controllers, Principles

Guide to the Case-Law of the of the European Court of Human Rights

Data Subjects Rights, Principles, Sensitive Data

C-252/21

Contractual Obligation, Lawfulness of Processing, Principles, Sensitive Data

Case C-487/21

Access Requests (DSAR), Data Subjects Rights

Certified Data Protection Officer by PECB

Controllers and Processors, Data Protection Officer (DPO)

ЕО Order on Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern

Data Transfers

Artificial Intelligence and Privacy

AI, Specific processing situations

[UK] International Data Transfer Agreements – Transitional Provisions

Data Transfers

[UK] International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Data Transfers

RISK FRAMEWORK FOR BODY-RELATED DATA IN IMMERSIVE TECHNOLOGIES BY FPF

Transfer Impact Assessment (TIA)

Data Transfers, Transfer Impact Assessment

Zapier’s Transfer Impact Assessment

Data Transfers, Transfer Impact Assessment

American Data Privacy And Protection Act (DRAFT)

AI, Specific processing situations

Cybersecurity panel session: An introduction to incident response, common cyber threats and ways to mitigate risk by the UK ICO

Data Breaches, Technical and Organisational Measures (TOMs)

Cybersecurity panel session: Supply chain attacks by the UK ICO

Technical and Organisational Measures (TOMs)

Cybersecurity panel session: SME Focus by the UK ICO

Technical and Organisational Measures (TOMs)

Personal data breaches in the health sector: how to avoid them (and how to deal with them when they happen) by the UK ICO

Data Breaches

Balancing transparency and empathy in request and complaint handling by the UK ICO

Access Requests (DSAR)

Handling vexatious requests under FOIA by the UK ICO

Access Requests (DSAR)

GenAI and data protection: how organisations and their employees can use it appropriately and lawfully

AI

How to deal with SARs as an employer by the UK ICO

Access Requests (DSAR), Employment

Good FOI practice – a panel discussion by the UK ICO

Access Requests (DSAR)

The IDTA, Addendum and TRA: practical guidance for cross-border transfers by the UK ICO

Data Transfers

Lifecycle of a complaint by the UK ICO

Access Requests (DSAR), Data Subjects Rights

Section 40(2) FOIA – the personal data exemption – a practical approach by the UK ICO

Access Requests (DSAR), Data Subjects Rights

Insight into audit and assurance by the UK ICO

Children as data subjects, Data protection audit

A 10-step guide to sharing information to safeguard children by the UK ICO

Children as data subjects

Privacy, seriously by the UK ICO

AI, Privacy by Design, Product Privacy Design

AI and Data Protection risk toolkit by the UK ICO

AI

Federal Data Protection Act (Germany)

Human rights Impact Assessments for AI by Access Now

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Practice Guide to Anonymising Personal Data by Stiftung Dateschutz

Anonymisation, Controllers and Processors

Senate Bill 262 (Delete Act)

REGULATION (EU) 2022/868 (Data Governance Act)

DIRECTIVE (EU) 2016/680 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (Law Enforcement Directive)

Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines | NIST

Controllers and Processors, Technical and Organisational Measures (TOMs)

DIRECTIVE (EU) 2019/1937 on the protection of persons who report breaches of Union law (Whistleblower Directive)

Guidance Note: Employer Vehicle Tracking | Irish DPC

Automated Decision-making, Consent, Employment, Lawfulness of Processing, Legitimate Interest

Opinion on legitimate interests of the data controller (Opinion 06/2014)

Lawfulness of Processing, Legitimate Interest

Building a Cybersecurity and Privacy Learning Program | NIST | Initial Public Draft

Data Breaches, Employment, Risk Management, Technical and Organisational Measures (TOMs)

REGULATION (EU) 2022/1925 (Digital Markets Act)

Joint statement on data scraping and the protection of privacy

Governance, Personal Data Collection

Bodil Lindqvist [2003] Case C-101/01, 6 November 2003

Automated Decision-making

Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González [2014] Case C-131/12

Data Controller, Personal Data

Digital Rights Ireland Ltd. v. Minister for Communications and Others [2014] Joined Cases C-293/12 and C-594/12

Data minimisation

Tele2 Sverige AB v. Post-och telestyrelsen and Secretary of State for the Home Department v. Tom Watson and others Joined Cases C-203/15 and C-698/15

Data minimisation

Maximillian Schrems v. Data Protection Commissioner [2015] Case C-362/14, 6 October 2015.

Adequacy Decisions, Data Transfers

Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Case C-311/18), 16 July 2020.

Adequacy Decisions, Data Transfers

Big Brother Watch and others v United Kingdom (Applications nos 58170/13, 62322/14 and 24960/15), 25 May 2021.

Data minimisation

Weltimmo s.r.o. v. Nemzeti Adatvédelmi és Információszabadság Hatóság [2015] Case C-230/14, 1 October 2015

Territorial Scope

František Ryneš v. Úřad pro ochranu osobních údajů [2014] Case C-212/13, 11 December 2014

Material scope

Planet49 GmbH, C-673/17, Grand Chamber, 1 October 2019.

Consent, Cookies, Lawfulness of Processing

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH, in the presence of Facebook Ireland Ltd (Case C-210/16).

Data Controller

Fashion ID, 29 July 2019, C-40/17, ECLI:EU:C:2019:629

Consent, Data Controller, Legitimate Interest

Patrick Breyer v. Germany Case C-582/14, 12 May 2016

Personal Data

Google v CNIL Case C 507/17

Automated Decision-making, Search Engines

CNIL and others v Google Case C 136/17

Automated Decision-making, Search Engines, Sensitive Data

Salvatore Manni Case C 398/15

Data Retention, Legitimate Interest, Storage limitation

Nowak (C-434/16, EU:C:2017:994)

Personal Data

Prokuratuur (Conditions of access to data relating to electronic communications) (C-746/18, EU:C:2021:152)

Criminal Convictions and Offences, Public Administrative Body, Sensitive Data

EU-Canada PNR Agreement of 26 July 2017 (Grand Chamber) (EU:C:2017:592)

Data Transfers

ANAF Case C‑201/14, 1 October 2015

Automated Decision-making, Data Sharing, Data Transfers, Public Administrative Body

Opinion 05/2014 on Anonymisation Techniques | WP216

Anonymisation

Guidance on Anonymisation and Pseudonymisation | Irish DPC

Anonymisation

Anonymisation: managing data protection risk code of practice | UK ICO

Anonymisation

GUIDE TO BASIC ANONYMISATION | PDPC Singapore

Anonymisation

Spanish AEPD: 10 MISUNDERSTANDINGS RELATED TO ANONYMISATION

Anonymisation

UK MRC Identifiability, anonymisation and pseudonymisation

Anonymisation

Australian ACMA DoorDash Technologies Australia Pty Ltd

Consent, Liability and Penalties, Spam

Personal data protection law (Saudi Arabia)

Personal Information Protection and Electronic Documents Act (PIPEDA, CANADA)

Proposal for EU AI Act

THE DIGITAL PERSONAL DATA PROTECTION ACT (INDIA)

Board of Directors Handbook for Cloud Risk Governance | Google

Governance

Federal Act on Data Protection (Switzerland)

European Convention on Human Rights

UK Data Protection Act 2018

Directive (EU) 2016/1148 “NIS2 Directive”

REGULATION (EU) 2018/1725 “GDPR for EU Institutions”

Directive 2002/58/EC on privacy and electronic communications

Records of Processing Activities under Article 30 GDPR | Irish DPC

Controllers and Processors, Records of processing Activities (ROPA)

Information note on data transfers under the GDPR to the US | EDPB

Adequacy Decisions, Data Transfers

Data Protection and Journalism | UK ICO

Freedom of expression and information, Specific processing situations

Data Subjects Rights | UK ICO

Access Requests (DSAR), Automated Decision-making, Children as data subjects, Data Subject Rights Restrictions, Data Subjects Rights, Right to Erasure, Right to know, Right to Object, Right to Portability, Right to Rectification

What is Personal Data | UK ICO

Definitions

A Guide to UK GDPR Principles | UK ICO

Accountability, Accuracy, Data minimisation, Integrity and confidentiality, Lawfulness of Processing, Principles, Purpose limitation, Storage limitation, Transparency

A Guide to Lawful Basis | UK ICO

Consent, Contractual Obligation, Lawfulness of Processing, Legal Obligation, Legitimate Interest, Public Interests, Vital Interests

Guidance on Video Surveillance | UK ICO

Accountability, Employment, Lawfulness of Processing, Legitimate Interest, Principles, Sensitive Data

Guide to Accountability and Governance | UK ICO

Accountability, Governance, Principles

Data Sharing Code | UK ICO

Data Transfers, Records of processing Activities (ROPA)

The Employment Practices Code | UK ICO

Data Subjects Rights, Employment

Children and the GDPR | UK ICO

Children as data subjects, Data Subjects Rights

Guidance on ai and data protection 2.0 | UK ICO

AI

Consumer Data Protection Act (Virginia CDPA)

Connecticut Data Privacy Act

Colorado Privacy Act

Utah Consumer Privacy Act

GDPR Risk Assessment by the AEPD

Data Protection Impact Assessment (DPIA)

Guide to Data Protection Impact Assessments (DPIAs) by the Irish DPC

Data Protection Impact Assessment (DPIA)

Risk Management and Impact Assessment (DPIA) by AEPD

Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessment (DPIAs) by APDCAT

Data Protection Impact Assessment (DPIA)

How to manage DPIAs by Data Protection Network (DPN)

Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessments (DPIA) Template by UK ICO

Data Protection Impact Assessment (DPIA)

Guide to Data Protection Impact Assessments by PDPC Singapore

Data Protection Impact Assessment (DPIA)

Joint Guide to ASEAN MCC and EU SCC

Data Transfers, Standard Contractual Clauses (SCC)

Decision of the Norwegian Data Protection Authority to adopt urgent and provisional measures against Meta (Facebook)

Consent, Contractual Obligation, Cooperation and consistency, Lawfulness of Processing, Legitimate Interest

Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679

Automated Decision-making

WORKING PARTY 29 POSITION PAPER on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR

Records of processing Activities (ROPA)

Guidelines on transparency under Regulation 2016/679

Transparency

Guidelines on Data Protection Officers (‘DPOs’)

Data Protection Officer (DPO)

CALIFORNIA CONSUMER PRIVACY ACT REGULATIONS

General

Records of processing activities template by the CNIL

Records of processing Activities (ROPA)

Members of the Code of Conduct for Cloud Infrastructure Service Providers

Code of Conduct

Elaboration of the Code of Conduct for Cloud Infrastructure Service Providers (CNIL)

Code of Conduct

Data Protection Code of Conduct for Cloud Infrastructure Service Providers

Code of Conduct

Sending direct marketing messages: At-a-glance guide (UK ICO)

Consent, Lawfulness of Processing

CJEU Research and Documentation Directorate – Protection of personal data (Fact Sheet)

Data Subjects Rights, General, Lawfulness of Processing, Principles, Territorial Scope

Why a right to explanation of automated decision-making does not exist in the General Data Protection Regulation

Data Subjects Rights, Right to Object

Recommendations for companies planning to use Cloud computing services by CNIL

Data Sharing, Data Transfers

Privacy Impact Assessment (PIA) Knowledge Bases by CNIL

Data Protection Impact Assessment (DPIA)

Approach to Data Spaces from GDPR Perspective (AEPD)

Data Spaces, Risk Management

The EDPB data protection guide for small business

AI, Risk Management

COMMISSION IMPLEMENTING DECISION of 10.7.2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework

Adequacy Decisions, Data Transfers

Privacy Impact Assessment – Internet of Things Devices (CNIL)

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Methodology Mindmap by CNIL

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Methodology by CNIL

Data Protection Impact Assessment (DPIA)

Guidelines 02/2022 on the application of Article 60 GDPR

Supervisory Authorities

Dark Patterns in Personal Data Collection: Definition, Taxonomy and Lawfulness

Dark Patterns, Data Subjects Rights, Principles, Privacy by Design

Artificial Intelligence Risk Management Framework (AI RMF 1.0) by NIST

AI, Risk Management

Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679

Data Protection Impact Assessment (DPIA)

Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679

Data Transfers

Guidelines 4/2018 on the accreditation of certification bodies under Article 43 of the General Data Protection Regulation (2016/679)

Certification, Data Transfers

Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation

Certification, Data Transfers

Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679

Code of Conduct, Data Transfers

Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects

Contractual Obligation, Lawfulness of Processing

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

Territorial Scope

Guidelines 3/2019 on processing of personal data through video devices

Access Requests (DSAR), Consent, Data Subject Rights Restrictions, Data Subjects Rights, Lawfulness of Processing, Legitimate Interest, Right to Erasure, Right to know, Right to Object

Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak

Sensitive Data

Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak

Consent, Data Subjects Rights, Lawfulness of Processing, Public Interests, Vital Interests

Guidelines 05/2020 on consent under Regulation 2016/679

Consent, Data Subjects Rights, Lawfulness of Processing

Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR

Data Subjects Rights, Right to Erasure

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default

Principles, Privacy by Design

Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR

Consent, Lawfulness of Processing

Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies

Data Transfers

Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications

Controllers and Processors, Data Subjects Rights, Data Transfers

Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679

Data Subjects Rights, Right to Object

Guidelines 8/2020 on the targeting of social media users

Consent, Controllers and Processors, Data Controller, Data Processors, Lawfulness of Processing

Guidelines 02/2021 on virtual voice assistants

Access Requests (DSAR), Consent, Controllers and Processors, Data Controller, Data Processors, Data Subject Rights Restrictions, Data Subjects Rights, Lawfulness of Processing, Right to Erasure, Right to know

Guidelines 07/2020 on the concepts of controller and processor in the GDPR

Controllers and Processors, Data Controller, Data Processors

Guidelines 10/2020 on restrictions under Article 23 GDPR

Data Subject Rights Restrictions

Guidelines 01/2021 on Examples regarding Personal Data Breach Notification

Data Breaches

Guidelines 04/2021 on Codes of Conduct as tools for transfers

Data Transfers

Guidelines 02/2022 on the application of Article 60 GDPR

Supervisory Authorities

Guidelines 06/2022 on the practical implementation of amicable settlements

Supervisory Authorities

Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them

Access Requests (DSAR), Consent, Data Subjects Rights

Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR

Data Transfers

Guidelines 07/2022 on certification as a tool for transfers

Data Transfers

Guidelines 01/2022 on data subject rights – Right of access

Access Requests (DSAR), Data Subjects Rights

Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement

Consent, Principles, Public Interests, Sensitive Data

Guidelines 8/2022 on identifying a controller or processor’s lead supervisory authority

Supervisory Authorities

Guidelines 03/2021 on the application of Article 65(1)(a) GDPR

Supervisory Authorities

Guidelines 04/2022 on the calculation of administrative fines under the GDPR

Liability and Penalties, Supervisory Authorities

GDPR Fines Tracker

Liability and Penalties, Supervisory Authorities

GDPR Data Incidents – The Step-by-Step Playbook for Effective Response

Data Breaches

CIPL Examples of Legitimate Interest Grounds for Processing of Personal Data [PDF] [Official Guidelines]

Legitimate Interest

GDPR Full Text

CCPA Full Text

Report of the work undertaken by the Cookie Banner Taskforce [Official EDPB Guidelines] [pdf]

Consent, Cookies, Lawfulness of Processing

Guidelines 9/2022 on personal data breach notification under GDPR [Official EDPB Guidelines] [pdf]

Data Breaches

How Google Uses Information on websites [link]

Consent, Cookies, Lawfulness of Processing

Cookies Instructions Kit by DMA Italy, FedoWEB et al.

Cookies

Guidance on the rules on use of cookies and similar technologies [pdf] [Official Guidelines]

Consent, Cookies, Lawfulness of Processing