Resources

PRACTICAL GUIDE FOR DATA PROTECTION OFFICERS BY CNIL

Data Protection Officer (DPO)

Italian Data Protection Authority (Garante)-Rossi Carta S.r.l. (4/24/2024)

Access Requests (DSAR), Controllers and Processors, Data Protection Officer (DPO), Data Subjects Rights, Lawfulness of Processing

Italian Data Protection Authority (Garante)-Azienda Socio-sanitaria Territoriale Rhodense (5/23/2024)

Accuracy, Data Subjects Rights

Italian Data Protection Authority (Garante)-Dly S.r.l. (4/24/2024)

Data Protection Officer (DPO), Lawfulness of Processing

Spanish Data Protection Authority (aepd)-BANCO BILBAO VIZCAYA ARGENTARIA, S.A. (6/12/2024)

Accuracy, Principles

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Corint Logistic SRL. (5/30/2024)

Access Requests (DSAR), Data Subjects Rights, Lawfulness of Processing, Principles, Right to Object, Sensitive Data

Italian Data Protection Authority (Garante)-Libero Consorzio comunale di Enna (4/11/2024)

Data Protection Officer (DPO)

Data Protection Authority of Hessen-Company (7/15/1905)

Data Subjects Rights, Right to Object

Croatian Data Protection Authority (azop)-Betting company (4/22/2024)

Consent, Data Protection Officer (DPO), Lawfulness of Processing

Croatian Data Protection Authority (azop)-Betting company (4/22/2024)

Consent, Data Protection Officer (DPO), Lawfulness of Processing

Spanish Data Protection Authority (aepd)-VODAFONE ESPAÑA, S.A.U. (4/5/2024)

Accuracy, Principles

Cypriot Data Protection Commissioner-Bank of Cyprus Public Company Ltd. (7/15/1905)

Accuracy, Principles

Italian Data Protection Authority (Garante)-Municipality of Siracusa (1/31/2024)

Controllers and Processors, Data Protection Officer (DPO)

Italian Data Protection Authority (Garante)-Libero Consorzio comunale di Caltanissetta (1/31/2024)

Controllers and Processors, Data Protection Officer (DPO)

Italian Data Protection Authority (Garante)-Provincia di Catanzaro (1/31/2024)

Controllers and Processors, Data Protection Officer (DPO)

Italian Data Protection Authority (Garante)-Provincia di Sassari (1/31/2024)

Controllers and Processors, Data Protection Officer (DPO)

Spanish Data Protection Authority (aepd)-Oney Servicios Financieros E.F.C. (10/23/2023)

Accuracy, Principles

French Data Protection Authority (CNIL)-Candidate for parliamentary elections (12/22/2023)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Mednow Medical Center di Giugni Marco (8/31/2023)

Accuracy, Data Subjects Rights, Principles, Sensitive Data

Croatian Data Protection Authority (azop)-Betting company (9/14/2023)

Consent, Data Protection Officer (DPO), Lawfulness of Processing

Croatian Data Protection Authority (azop)-Betting company (9/14/2023)

Consent, Data Protection Officer (DPO), Lawfulness of Processing

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-NN Asigurări de Viață S.A. (9/18/2023)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-GYMOOGIMNASIOS S.L. (8/2/2023)

Controllers and Processors, Data minimisation, Data Protection Officer (DPO), Principles

Spanish Data Protection Authority (aepd)-CONCENTRA CENTRAL DE COMPRAS Y SERVICIOS S.L. (6/7/2023)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Grizzaffi Management Srl (5/17/2023)

Data Subjects Rights, Lawfulness of Processing, Right to Object

Spanish Data Protection Authority (aepd)-ECOMM MOVADGENCY S.L. (2/28/2023)

Data Subjects Rights, Right to Object

National Commission for Data Protection (CNPD)-Company (10/27/2021)

Controllers and Processors, Data Protection Officer (DPO), Technical and Organisational Measures (TOMs)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Tensa Art Design SRL (4/4/2023)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Amiu S.p.A. (4/28/2022)

Controllers and Processors, Data Processing Agreement (DPA), Data Protection Officer (DPO), Principles, Representative

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-News service (11/15/2022)

Consent, Data Protection Officer (DPO), Data Subjects Rights, Lawfulness of Processing

Belgian Data Protection Authority (APD)-Company (8/23/2022)

Accuracy, Controllers and Processors, Principles, Representative, Technical and Organisational Measures (TOMs)

Italian Data Protection Authority (Garante)-Poliambulatorio Radiologico ‘il Sorriso’ S.r.l. (11/10/2022)

Controllers and Processors, Data Protection Officer (DPO), Data Subjects Rights, Principles

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Tensa Art Design SA (2/1/2023)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Cisterna di Latina municipality (11/10/2022)

Controllers and Processors, Data Protection Officer (DPO), Principles

Italian Data Protection Authority (Garante)-Cisterna di Latina Municipality (11/10/2022)

Controllers and Processors, Data Protection Officer (DPO), Principles

Italian Data Protection Authority (Garante)-Areti spa (11/24/2022)

Accountability, Accuracy, Data Subjects Rights, Principles, Sensitive Data

Spanish Data Protection Authority (aepd)-XASTRE DO PETO, S.L. (11/11/2022)

Consent, Data Subjects Rights, Lawfulness of Processing, Right to Object

Austrian Data Protection Authority (dsb)-Private individual (7/13/1905)

Data Protection Officer (DPO), Lawfulness of Processing

Data Protection Authority of Berlin-Company (9/20/2022)

Controllers and Processors, Data Protection Officer (DPO)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-SC Raiffeisen Bank SA (9/9/2022)

Accuracy, Principles

French Data Protection Authority (CNIL)-ACCOR SA (8/19/2022)

Access Requests (DSAR), Data Subjects Rights, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Sephora Cosmetics România SA (8/4/2022)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Villabate municipality (5/12/2022)

Controllers and Processors, Data Protection Officer (DPO), Lawfulness of Processing, Representative

French Data Protection Authority (CNIL)-TotalEnergies Electricité et Gaz France (6/23/2022)

Data Subjects Rights, Right to Object

Belgian Data Protection Authority (APD)-SA Rossel & Cie (6/16/2022)

Consent, Controllers and Processors, Data Protection Officer (DPO), Data Subjects Rights, Lawfulness of Processing

Norwegian Supervisory Authority (Datatilsynet)-Company (3/15/2022)

Consent, Data Subjects Rights, Lawfulness of Processing, Right to Object

Italian Data Protection Authority (Garante)-Made in Italy s.r.l.s. (4/7/2022)

Access Requests (DSAR), Controllers and Processors, Data Protection Officer (DPO), Data Subjects Rights, Lawfulness of Processing

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-IAMSAT Muntenia SA (2/22/2022)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-T.S.M. s.r.l. (1/27/2022)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Aimon Srl (11/25/2021)

Controllers and Processors, Data Subjects Rights, Lawfulness of Processing, Representative, Right to Object

Italian Data Protection Authority (Garante)-Centro di Medicina preventiva s.r.l. (12/16/2021)

Controllers and Processors, Data Protection Officer (DPO), Data Subjects Rights, Principles, Technical and Organisational Measures (TOMs)

Hellenic Data Protection Authority (HDPA)-Greek Ministry of Tourism (12/29/2021)

Controllers and Processors, Data Breaches, Data Protection Officer (DPO), Data Subjects Rights

Belgian Data Protection Authority (APD)-Bank (12/16/2021)

Controllers and Processors, Data Protection Officer (DPO)

French Data Protection Authority (CNIL)-FREE MOBILE (12/28/2021)

Data Subjects Rights, Principles, Privacy by Design, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Telekom Romania Communications SA (12/6/2021)

Access Requests (DSAR), Accountability, Accuracy, Data Subjects Rights, Principles, Sensitive Data

Hellenic Data Protection Authority (HDPA)-ΚΑΠΑ ΛΑΜΔΑ ΩΜΕΓΑ ΔΙΑΦΗΜΙΣΤΙΚΗ ΕΜΠΟΡΙΚΗ ΜΟΝΟΠΡΟΣΩΠΗ ΕΤΑΙΡΕΙΑ ΠΕΡΙΟΡΙΣΜΕΝΗΣ ΕΥΘΥΝΗΣ (10/14/2021)

Data Subjects Rights, Lawfulness of Processing, Right to Object

National Commission for Data Protection (CNPD)-Unknown (10/27/2021)

Data Protection Officer (DPO)

Hellenic Data Protection Authority (HDPA)-PREMIUMMEDIA ΠΑΡΑΓΩΓΗ ΟΠΤΙΚΟ-ΑΚΟΥΣΤΙΚΩΝ ΕΡΓΩΝ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΙΑ (10/4/2021)

Data Subjects Rights, Right to Object

National Commission for Data Protection (CNPD)-Unknown (10/13/2021)

Controllers and Processors, Data Protection Officer (DPO), Technical and Organisational Measures (TOMs)

National Commission for Data Protection (CNPD)-Unknown (10/13/2021)

Controllers and Processors, Data Protection Officer (DPO), Technical and Organisational Measures (TOMs)

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (10/19/2021)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-ACONCAGUA JUEGOS S.A. (9/29/2021)

Controllers and Processors, Data Protection Officer (DPO)

Data Protection Authority of Ireland-Vodafone Ireland Limited (9/7/2021)

Data Subjects Rights, Right to Object

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Magyar Telekom Nyrt. (6/18/2021)

Accuracy, Controllers and Processors, Data Subjects Rights, Principles, Representative

Austrian Data Protection Authority (dsb)-Unser Ö-Bonus Club GmbH (8/2/2021)

Data Protection Officer (DPO), Lawfulness of Processing

Deputy Data Protection Ombudsman-Magazine publisher (6/24/2021)

Data Protection Officer (DPO), Data Subjects Rights, Lawfulness of Processing

National Commission for Data Protection (CNPD)-Unknown (6/11/2021)

Data Protection Officer (DPO)

National Commission for Data Protection (CNPD)-Unknown (5/31/2021)

Data Protection Officer (DPO)

Spanish Data Protection Authority (aepd)-TNT EXPRESS WORLDWIDE SPAIN, S.L. (6/22/2021)

Accuracy, Principles

Italian Data Protection Authority (Garante)-OneDirect Srl (3/25/2021)

Consent, Controllers and Processors, Cooperation with Supervisory Authorithy, Data Protection Officer (DPO), Lawfulness of Processing

Spanish Data Protection Authority (aepd)-Promotech Digital S.L. (4/6/2021)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-Iberdrola Clientes (2/3/2021)

Accuracy, Data Subjects Rights, Principles

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Unknown (11/18/2020)

Accuracy, Principles

French Data Protection Authority (CNIL)-Perfomeclic (12/7/2020)

Data minimisation, Data Subjects Rights, Principles, Right to Object, Sensitive Data

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (1/4/2021)

Accuracy, Principles, Sensitive Data

Spanish Data Protection Authority (aepd)-Online Services (12/15/2020)

Consent, Controllers and Processors, Data Protection Officer (DPO), Data Subjects Rights, Lawfulness of Processing

Spanish Data Protection Authority (aepd)-Banco Bilbao Vizcaya Argentaria, S.A. (12/21/2020)

Accuracy, Principles

Spanish Data Protection Authority (aepd)-Conseguridad SL (10/26/2020)

Controllers and Processors, Data Protection Officer (DPO)

Lithuanian Data Protection Authority (VDAI)-Vilnius City Municipality Administration (10/21/2020)

Accuracy, Controllers and Processors, Principles, Representative

Spanish Data Protection Authority (aepd)-Tour & People Max S.L. (7/31/2020)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-El Real Sporting de Gijón S.A.D. (7/23/2020)

Controllers and Processors, Data Protection Officer (DPO), Lawfulness of Processing

Belgian Data Protection Authority (APD)-Operator of CCTV of a residential building (7/14/2020)

Controllers and Processors, Data Protection Officer (DPO), Lawfulness of Processing

Spanish Data Protection Authority (aepd)-De Vere Spain S.L. (7/2/2020)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-Glovoapp23 (6/9/2020)

Controllers and Processors, Data Protection Officer (DPO)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Estee Lauder Romania (4/23/2020)

Controllers and Processors, Data Protection Officer (DPO), Lawfulness of Processing, Principles, Sensitive Data

Belgian Data Protection Authority (APD)-Proximus SA (4/28/2020)

Controllers and Processors, Cooperation with Supervisory Authorithy, Data Protection Officer (DPO), Representative

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Financial Enterprise (6/26/2019)

Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Data Protection Authority of Hamburg-Hamburger Volksbank eG (7/11/1905)

Data Subjects Rights, Right to Object

Data Protection Authority of Hamburg-Facebook Germany GmbH (7/11/1905)

Controllers and Processors, Data Protection Officer (DPO)

Italian Data Protection Authority (Garante)-Eni Gas e Luce (12/11/2019)

Access Requests (DSAR), Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Italian Data Protection Authority (Garante)-TIM (telecommunications operator) (1/15/2020)

Access Requests (DSAR), Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Spanish Data Protection Authority (aepd)-Iberia Lineas Aereas de Espana, S.A. Operadora Unipersonal (2/3/2020)

Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Spanish Data Protection Authority (aepd)-Banco Bilbao Vizcaya Argentaria S.L. (2/3/2020)

Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-SC Enel Energie S.A. (Electricity Distributor) (12/16/2019)

Consent, Controllers and Processors, Data Subjects Rights, Lawfulness of Processing, Principles, Representative, Right to Object

Hellenic Data Protection Authority (HDPA)-Wind Hellas Telecommunications (10/18/2019)

Data Subjects Rights, Right to Object

The Federal Commissioner for Data Protection and Freedom of Information (BfDI)-Rapidata GmbH (12/9/2019)

Controllers and Processors, Data Protection Officer (DPO)

Czech Data Protection Auhtority (UOOU)-Alza.cz a.s. (Unknown)

Controllers and Processors, Data Protection Officer (DPO), Lawfulness of Processing

Hellenic Data Protection Authority (HDPA)-Telecommunication Service Provider (10/7/2019)

Data Subjects Rights, Right to Object

Data Protection Authority of Berlin-Delivery Hero (9/19/2019)

Access Requests (DSAR), Data Subjects Rights, Right to Object

Austrian Data Protection Authority (dsb)-Company in the medical sector (8/1/2019)

Controllers and Processors, Data Protection Officer (DPO), Data Subjects Rights, Technical and Organisational Measures (TOMs)

Spanish Data Protection Authority (aepd)-Professional Football League (LaLiga) (6/11/2019)

Controllers and Processors, Data Protection Officer (DPO), Lawfulness of Processing

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (Unknown)

Accuracy, Principles

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (Unknown)

Accuracy, Principles

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Bank (2/8/2019)

Accuracy, Principles

Recommendations 01/2021 on the adequacy referential under the Law Enforcement Directive |EPDB

Adequacy Decisions, Data Transfers

2023 Coordinated Enforcement Action Designation and Position of Data Protection Officers by EDPB

Controllers and Processors, Data Protection Officer (DPO)

Report on the first review of the functioning of the adequacy decisions adopted pursuant to Article 25(6) of Directive 95/46/EC

Adequacy Decisions, Data Transfers

Drones and Data Protection Guidelines by AEPD

Drones, Specific processing situations

Infographic DPC TikTok Fine

Fairness, Liability and Remedies, Principles, Supervisory Authorities

Decision of the Data Protection Commission made pursuant to Section 111 of the DPA, 2018 and Articles 60 and 65 of the GDPR

Fairness, Liability and Remedies, Principles, Supervisory Authorities

One-Stop-Shop thematic case digest: RIGHT TO OBJECTAND RIGHT TO ERASURE

Data Subjects Rights, Right to Erasure, Right to Object

C-534/20

Controllers and Processors, Data Protection Officer (DPO)

C-453/21

Controllers and Processors, Data Protection Officer (DPO)

Information note by EDPB on data transfers under the GDPR to the United States after the adoption of the adequacy decision on 10 July 2023

Adequacy Decisions, Data Transfers

Opinion 14/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the United Kingdom |EPDB

Adequacy Decisions, Data Transfers

Opinion 15/2021 regarding the European Commission Draft Implementing Decision pursuant to Directive (EU) 2016/680 on the adequate protection of personal data in the United Kingdom |EDPB

Adequacy Decisions, Data Transfers

Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea |EDPB

Adequacy Decisions, Data Transfers

Information Note by EDPB on the redress mechanism for EU/EEA individuals in relation to alleged violations of U.S. law with respect to their data collected by U.S authorities competent for national security

Adequacy Decisions, Data Transfers

EU-US Data Privacy Framework Template Complaint Form for Submitting Commercial Related Complaints to EU DPAs by EDPB

Adequacy Decisions, Data Transfers

Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea |EPDB

Adequacy Decisions, Data Transfers

Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework |EPDB

Adequacy Decisions, Data Transfers

Certified Data Protection Officer by PECB

Data Protection Officer (DPO)

COMMISSION IMPLEMENTING DECISION of 10.7.2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework

Adequacy Decisions, Data Transfers

Guidelines on Data Protection Officers (‘DPOs’)

Data Protection Officer (DPO)

Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679

Data Subjects Rights, Right to Object

Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation

Certification

Guidelines 4/2018 on the accreditation of certification bodies under Article 43 of the General Data Protection Regulation (2016/679)

Certification

Guidelines 07/2022 on certification as a tool for transfers

Certification

Rules of Procedure by EDPB on the cooperation and respective roles of national SAs and the EDPB Secretariat regarding the submission of complaints in the redress mechanism available to EU individuals in relation to alleged violations of U.S law with respect to their data collected by U.S. authorities competent for national security

Adequacy Decisions, Data Transfers, Risk Management

Rules of Procedure for the “Informal Panel of EU DPAs”according to the EU-US Data Privacy Framework by EDPB

Adequacy Decisions, Data Transfers

Template Complaint Form to the U.S. Office of the Director of National Intelligence’s Civil Liberties Protection Officer (CLPO) by EDPB

Adequacy Decisions, Data Transfers

A Guide to UK GDPR Principles | UK ICO

Accountability, Accuracy, Data minimisation, Integrity and confidentiality, Lawfulness of Processing, Principles, Purpose limitation, Storage limitation, Transparency