Resources

Data Broker Sells Voter Data on Support for QAnon and January 6

Data Sharing

Data Sharing Toolkit Tracker

Data Sharing

Data Sharing Toolkit Tracker – more information about the Toolkit by UK ICO

Data Sharing

Italian Data Protection Authority (Garante)-Azienda Socio-sanitaria Territoriale Rhodense (5/23/2024)

Accuracy, Data Subjects Rights

Spanish Data Protection Authority (aepd)-BANCO BILBAO VIZCAYA ARGENTARIA, S.A. (6/12/2024)

Accuracy, Principles

Spanish Data Protection Authority (aepd)-VODAFONE ESPAÑA, S.A.U. (4/5/2024)

Accuracy, Principles

Hellenic Data Protection Authority (HDPA)-Greek Ministry of Immigration and Asylum (4/2/2024)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Privacy by Design

Spanish Data Protection Authority (aepd)-CTC EXTERNALIZACIÓN, S.L (2/12/2024)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights

Cypriot Data Protection Commissioner-Bank of Cyprus Public Company Ltd. (7/15/1905)

Accuracy, Principles

Spanish Data Protection Authority (aepd)-Oney Servicios Financieros E.F.C. (10/23/2023)

Accuracy, Principles

Dutch Supervisory Authority for Data Protection (AP)-International Card Services B.V. (1/15/2024)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Data Protection Authority of Sweden-Östersund Municipality’s Department for Children and Education (11/28/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Hellenic Data Protection Authority (HDPA)-Athens Urban Transport Organization (9/25/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Storage limitation

Italian Data Protection Authority (Garante)-Mednow Medical Center di Giugni Marco (8/31/2023)

Accuracy, Data Subjects Rights, Principles, Sensitive Data

Spanish Data Protection Authority (aepd)-GSMA LTD. (5/3/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Spanish Data Protection Authority (aepd)-ALBERO FORTE COMPOSITE, S.L. (4/28/2023)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Belgian Data Protection Authority (APD)-Company (8/23/2022)

Accuracy, Controllers and Processors, Principles, Representative, Technical and Organisational Measures (TOMs)

Italian Data Protection Authority (Garante)-Azienda Universitaria Friuli Occidentale (12/15/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Principles, Sensitive Data

Italian Data Protection Authority (Garante)-Azienda Universitaria Friuli Centrale (12/15/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Principles, Sensitive Data

Italian Data Protection Authority (Garante)-Azienda Universitaria Giuliano Isontina (12/15/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Principles, Sensitive Data

Spanish Data Protection Authority (aepd)-Homeowners Association (12/28/2022)

Data Subjects Rights, Lawfulness of Processing, Public Interests

Italian Data Protection Authority (Garante)-Areti spa (11/24/2022)

Accountability, Accuracy, Data Subjects Rights, Principles, Sensitive Data

Spanish Data Protection Authority (aepd)-Company (10/9/2022)

Data Subjects Rights, Lawfulness of Processing, Public Interests

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-SC Raiffeisen Bank SA (9/9/2022)

Accuracy, Principles

Norwegian Supervisory Authority (Datatilsynet)-Recover AS (8/25/2022)

Lawfulness of Processing, Public Interests

Data Protection Authority of Niedersachsen-Volkswagen (7/26/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights

Norwegian Supervisory Authority (Datatilsynet)-Arbeidstilsynet (5/16/2022)

Lawfulness of Processing, Public Interests

Italian Data Protection Authority (Garante)-Istituto Nazionale Assicurazione Infortuni sul Lavoro (4/28/2022)

Lawfulness of Processing, Principles, Public Interests, Sensitive Data

Danish Data Protection Authority (Datatilsynet)-Danish National Genome Center (3/25/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Italian Data Protection Authority (Garante)-Azienda sanitaria unica regionale Marche (1/13/2022)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Integrity and confidentiality, Principles

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Telekom Romania Communications SA (12/6/2021)

Access Requests (DSAR), Accountability, Accuracy, Data Subjects Rights, Principles, Sensitive Data

Spanish Data Protection Authority (aepd)-SERVICIOS LOGÍSTICOS MARTORELL SIGLO XXI, S.L. (10/26/2021)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Magyar Telekom Nyrt. (6/18/2021)

Accuracy, Controllers and Processors, Data Subjects Rights, Principles, Representative

Lithuanian Data Protection Authority (VDAI)-Unknown (7/12/1905)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Technical and Organisational Measures (TOMs)

Spanish Data Protection Authority (aepd)-TNT EXPRESS WORLDWIDE SPAIN, S.L. (6/22/2021)

Accuracy, Principles

Norwegian Supervisory Authority (Datatilsynet)-Ålesund Municipality (3/15/2021)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Lawfulness of Processing, Performance of Contract

Spanish Data Protection Authority (aepd)-Iberdrola Clientes (2/3/2021)

Accuracy, Data Subjects Rights, Principles

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Unknown (11/18/2020)

Accuracy, Principles

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (1/4/2021)

Accuracy, Principles, Sensitive Data

Spanish Data Protection Authority (aepd)-Banco Bilbao Vizcaya Argentaria, S.A. (12/21/2020)

Accuracy, Principles

Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)-Gnosjö Municipality (11/25/2020)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Representative

Lithuanian Data Protection Authority (VDAI)-Vilnius City Municipality Administration (10/21/2020)

Accuracy, Controllers and Processors, Principles, Representative

Deputy Data Protection Ombudsman-Taksi Helsinki (5/29/2020)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Representative

Deputy Data Protection Ombudsman-Kymen Vesi Oy (5/22/2020)

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Data Protection Authority of Sweden-School in Skellefteå (8/20/2019)

Controllers and Processors, Data minimisation, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (Unknown)

Accuracy, Principles

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (Unknown)

Accuracy, Principles

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Bank (2/8/2019)

Accuracy, Principles

New data protection audit framework launched to help organisations improve compliance by UK ICO

Controllers and Processors, Data Sharing, Data Subjects Rights

Telegram’s New Policy: User Data to Be Shared with Authorities in Criminal Cases

Data Sharing, Data Subjects Rights

LinkedIn Used User Data for AI Training Before Updating Its Terms

AI, Data Sharing, Data Subjects Rights, Lawfulness of Processing

Privacy Impact Assessment (PIA) Templates by CNIL

Data Protection Impact Assessment (DPIA)

Recommendation 01/2019 on the draft list of the European Data Protection Supervisor regarding the processing operations subject to the requirement of a data protection impact assessment (Article 39.4 of Regulation (EU) 2018/1725) |EPDB

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR |EPDB

Definitions, Main Establishment

Comparison of U.S. State Privacy Laws. Data Protection Assessments by CIPL

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Draft Impact Assessment Framework by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Annex: A summary of the Transparency in Health and Social Care guidance impact assessment by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

Transparency in health and social care by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

[Draft] Guidelines on the processing of personal data in regard to recruitment by the UK ICO

Automated Decision-making, Controllers and Processors, Data Protection Impact Assessment (DPIA), Employment, Specific processing situations

Privacy Impact Assessment Tool by the Australian Government

Controllers and Processors, Data Protection Impact Assessment (DPIA)

DPIA for AI template

Controllers and Processors, Data Protection Impact Assessment (DPIA)

AI and Data Protection Risk Toolkit by UK ICO

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Audit Requirements for Personal Data Processing Activities involving AI by AEPD

Controllers and Processors, Data Protection Impact Assessment (DPIA), Technical and Organisational Measures (TOMs)

Human rights Impact Assessments for AI

Controllers and Processors, Data Protection Impact Assessment (DPIA)

C-439/19

Criminal Convictions and Offences, Lawfulness of Processing, Principles, Public Interests

C-496/17

Lawfulness of Processing, Public Interests

C-180/21

Criminal Convictions and Offences, Lawfulness of Processing, Principles, Public Interests

C-306/21

Lawfulness of Processing, Public Interests

Frequently Asked Questions (FAQs) on the Data Act by the EU Commission

Controllers and Processors, Data Sharing

UNESCO: Consultation paper on AI Regulation

AI, Lawfulness of Processing, Public Interests, Specific processing situations

CNIL open source PIA software – data protection impact assessment

Data Protection Impact Assessment (DPIA)

Meta Platforms Ireland v EDPB (Case T-319/24)

Controllers and Processors, Data Sharing, Data Subjects Rights

Data protection impact assessment for AI Solutions by Danish DPA

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Case 2:24-cv-05140 by the attorney general of California

Consent, Controllers and Processors, Data Sharing, Lawfulness of Processing

Data protection impact assessment on the processing of personal data on government Facebook Pages

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Opinion 20/2021 on Tobacco Traceability System |EDPB

Controllers and Processors, Data Sharing

Opinion 19/2021 on the draft decision of the competent supervisory authority of Hungary regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EDPB

Accreditation

Data Sharing Code of Practice by UK ICO [Controller to Controller]

Controllers and Processors, Data Sharing

Opinion 25/2021 on the draft decision of the competent supervisory authority of Lithuania regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EDPB

Accreditation

Opinion 35/2021 on the draft decision of the competent supervisory authority of Belgium regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 36/2021 on the draft decision of the competent supervisory authority of Norway regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 37/2021 on the draft decision of the competent supervisory authority of Malta regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Accreditation

Opinion 38/2021 on the draft decision of the competent supervisory authority of Latvia regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 12/2022 on the draft decision of the competent supervisory authority of France regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 13/2022 on the draft decision of the competent supervisory authority of Bulgaria regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 11/2023 on the draft decision of the competent supervisory authority of Sweden regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Accreditation

Opinion 12/2023 on the draft decision of the competent supervisory authority of Cyprus regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 13/2023 on the draft decision of the competent supervisory authority of Croatia regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 11/2022 on the draft decision of the competent supervisory authority of Poland regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 4/2023 on the draft decision of the competent supervisory authority of Malta regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro

Accreditation

EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

Accreditation

Human rights Impact Assessments for AI by Access Now

AI, Data Protection Impact Assessment (DPIA)

Weltimmo s.r.o. v. Nemzeti Adatvédelmi és Információszabadság Hatóság [2015] Case C-230/14, 1 October 2015

Main Establishment

Guide to Data Protection Impact Assessments by PDPC Singapore

Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessments (DPIA) Template by UK ICO

Data Protection Impact Assessment (DPIA)

How to manage DPIAs by Data Protection Network (DPN)

Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessment (DPIAs) by APDCAT

Data Protection Impact Assessment (DPIA)

Guide to Data Protection Impact Assessments (DPIAs) by the Irish DPC

Data Protection Impact Assessment (DPIA)

GDPR Risk Assessment by the AEPD

Data Protection Impact Assessment (DPIA)

Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Knowledge Bases by CNIL

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Methodology by CNIL

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Methodology Mindmap by CNIL

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment – Internet of Things Devices (CNIL)

Data Protection Impact Assessment (DPIA)

Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications

Connected Vihicles

The NSW AI Assessment Framework

Controllers and Processors, Data Protection Impact Assessment (DPIA)

AI Possible Risks & Mitigations Optical Character Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

AI Possible Risks & Mitigations Named Entity Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

5310-C Privacy Threshold Assessments and Privacy Impact Assessments by Office of Information Security

Controllers and Processors, Data Protection Impact Assessment (DPIA)

AI and Data Protection risk toolkit by the UK ICO

AI, Data Protection Impact Assessment (DPIA)

ANAF Case C‑201/14, 1 October 2015

Automated Decision-making, Data Sharing, Data Transfers, Public Administrative Body

A Guide to UK GDPR Principles | UK ICO

Accountability, Accuracy, Data minimisation, Integrity and confidentiality, Lawfulness of Processing, Principles, Purpose limitation, Storage limitation, Transparency

A Guide to Lawful Basis | UK ICO

Consent, Lawfulness of Processing, Legal Obligation, Legitimate Interest, Performance of Contract, Public Interests, Vital Interests

Risk Management and Impact Assessment (DPIA) by AEPD

Data Protection Impact Assessment (DPIA)