Resources

EDPB Releases First Report on EU-U.S. Data Privacy Framework

U.S. Court Revives Video Privacy Lawsuit Against NBA

Lawfulness of Processing

Data Broker Sells Voter Data on Support for QAnon and January 6

Data Sharing

AI and the audiovisual sector: navigating the current legal landscape by IRIS European Audiovisual Observatory

Harmonised Standards for the European AI Act by EU Commission

AI Principles and Best Practices for Developers and Employers by U.S. DEPARTMENT OF LABOR

Cyber Security Handbook for Small Business and Not-for-Profit Directors by Australian Information Security Association

Technical and Organisational Measures (TOMs)

LinkedIn Fined €310 Million by Irish Data Regulator for Targeted Ads Without Consent

Lawfulness of Processing

Perplexity AI Faces Lawsuit Over Alleged Copyright Violations by Dow Jones and NY Post

noyb Files Complaint Against Pinterest for Unlawful Ad Tracking Practices

Lawfulness of Processing

UK’s New Data Use Bill: Easier Access and Enhanced Privacy for All

Local Laws

Age Appropriate Design Toolkit Tracker- more information about the Toolkit by UK ICO

Children as data subjects

Artificial Intelligence (AI) Toolkit Tracker – more information about the Toolkit by UK ICO

Data Sharing Toolkit Tracker – more information about the Toolkit by UK ICO

Data Sharing

Information & Cyber Security Checklist Tracker – more information about the Toolkit by UK ICO

Technical and Organisational Measures (TOMs)

Records Management Toolkit Tracker – more information about the Toolkit by UK ICO

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Requests For Access Toolkit Tracker – more information about the Toolkit by UK ICO

Access Requests (DSAR)

Training and Awareness Toolkit Tracker – more information about the Toolkit by UK ICO

Technical and Organisational Measures (TOMs)

Accountability Toolkit Tracker – more information about the Toolkit by UK ICO

Accountability

RTL Belgium Ordered to Add “Refuse All” Button to Cookie Banner by Belgian DPA

Consent

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg discussion paper on “Legal Foundations in Data Protection for the Use of AI”

AI, Lawfulness of Processing, Legitimate Interest, Specific processing situations

Japan AI Safety Institute’s “Guide to Red Teaming Methodology on AI Safety”

AI, Specific processing situations

Supreme Court of Singapore’s Circular on the Use of GenAI Tools in Court Documents

Data Processing by the Government, Specific processing situations

“The Landscape of Consent Management Tools – A Data Altruism Perspective” by EU Commission

Consent, Lawfulness of Processing

Major US Telecoms Hacked by Chinese Group, Federal Surveillance System Compromised

ICO Hits Northern Ireland Police with Fine Over Employee Data Breach

French News Agency AFP Hit by Cyber Attack, Real-Time News Feeds Affected

Study Finds ChatGPT Can Perform Biometric Tasks: A Closer Look at Privacy Risks

AI, Sensitive Data

New data protection audit framework launched to help organisations improve compliance by UK ICO

Controllers and Processors, Data Sharing, Data Subjects Rights

Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR by EDPB

Lawfulness of Processing, Legitimate Interest

Five New CJEU Rulings: A Turning Point for GDPR Compliance

The EU’s International Cooperation on Cyber Capacity Building| second edition

Technical and Organisational Measures (TOMs)

Cyber Threat Modelling for Risk Assessment by CSB

Risk Management, Technical and Organisational Measures (TOMs)

Guide to Good Governance in Cybersecurity by DCSD

Technical and Organisational Measures (TOMs)

ENISA Threat Landscape 2024 EU Agency for Cybersecurity

Technical and Organisational Measures (TOMs)

Chief Information Security Officer_ HANDBOOK

Risk Management

EDPS Model Administrative Arrangement

Data Processing by the Government, Data Transfers, Specific processing situations

FTC Targets Deceptive AI Claims with Operation AI Comply

AI, Lawfulness of Processing

OpenAI, Microsoft, and Amazon Join EU’s AI Pact to Shape Future Regulations

Meta Fined $101 Million for Exposing Millions of Passwords in Plaintext

Lawfulness of Processing, Technical and Organisational Measures (TOMs)

California Governor Vetoes AI Safety Bill

National Strategy on AI by Sri Lanka

AI, Lawfulness of Processing, Specific processing situations

The Future of European Competitiveness by EU Commission

AI, New technology, Specific processing situations

Tech Giants Sign Open Letter Urging “Regulatory Certainty on AI” in Europe

Telegram’s New Policy: User Data to Be Shared with Authorities in Criminal Cases

Data Sharing, Data Subjects Rights

Genetic Testing Company 23andMe Pays $30M for Data Breach

Data Breaches, Sensitive Data

LinkedIn Used User Data for AI Training Before Updating Its Terms

AI, Data Sharing, Data Subjects Rights, Lawfulness of Processing

India Digital Personal Data Protection Act (2023)

NIST Special Publication NIST SP 800-221A_Information and Communications Technology (ICT) Risk Outcomes Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio

Risk Management

Artificial Intelligence and Machine Learning in Health Care and Medical Sciences Best Practices by Pitfalls Gyorgy J. Simon Constantin Aliferis Springer

AI, Health Data, Principles, Sensitive Data, Specific processing situations

Report and Guidance on Privacy in Social Network Services – ”Rome Memorandum” by International Working Group on Data Protection in Telecommunications

Definitions, Processing of personal data

ENFORCEMENT ADVISORY NO. 2024-02 by CALIFORNIA PRIVACY PROTECTION AGENCY AVOIDING DARK PATTERNS: CLEAR AND UNDERSTANDABLE LANGUAGE, SYMMETRY IN CHOICE

Data Subjects Rights

Belgian DPA Enforces GDPR Compliance on Cookie Banners After noyb Complaints

EU Court Upholds €2.4 Billion Fine Against Google for Abusing Market Power

Swedish Bank Penalized €1.3 million for Transferring Customer Data to Meta

2025 Update: New SCCs Will Address Missing Rules for Cross-Border Data Transfers

Statement 2/2024 on the financial data access and payments package by EDPB

Finance and Fintech

Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR |EPDB

Definitions, Main Establishment

Opinion 36/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Booking.com Group |EPDB

Data Transfers

Opinion 31/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Thalès Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 32/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Thalès Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 33/2023 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Controller Binding Corporate Rules of the Cerner Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 34/2023 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Processor Binding Corporate Rules of the Cerner Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 35/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Carlsberg Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 37/2023 on the draft decision of the competent supervisory authority of Luxemburg regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Certification, Controllers and Processors

Opinion 38/2023 on the draft decision of the competent supervisory authority of Slovenian regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR). |EPDB

Certification, Controllers and Processors

Opinion 01/2024 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Booking.com Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 2/2024 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the TELEFÓNICA Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 3/2024 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Accenture Group |EPDB

Binding Corporate Rules, Data Transfers

Rethinking Privacy in the AI Era | White Paper by Stanford University

AI, Specific processing situations

Opinion 23/2023 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules for customer data of the UPS Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 24/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Nestlé Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 25/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the SHV Holding N.V. Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 26/2023 on the draft decision of the Romanian Supervisory Authority regarding the Processor Binding Corporate Rules of the OSF Global Services Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 27/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Tessi Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 28/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Servier Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 29/2023 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the Sodexo Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 30/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Sodexo Group |EPDB

Binding Corporate Rules, Data Transfers

THE NEW STANDARD CONTRACTUAL CLAUSES – QUESTIONS AND ANSWERS

Data Transfers, Standard Contractual Clauses (SCC)

A pro-innovation approach to AI regulation by UK ICO

AI, Specific processing situations

Comparison of U.S. State Privacy Laws. Data Protection Assessments by CIPL

Controllers and Processors, Data Protection Impact Assessment (DPIA)

SWISS-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

EU-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

NIST Cybersecurity Framework 2.0: RESOURCE & OVERVIEW GUIDE

GDPR: a culture of non-compliance? Numbers of evidence-based enforcement efforts by nyob

Liability and Remedies, Supervisory Authorities

Analysis of the final compromise text of the EU AI Act with a view to agreement by the Belgian Presidency

AI, Specific processing situations

Transparency and Consent Framework Policies by IAB Europe

Consent, Cookies, Lawfulness of Processing, Principles, Transparency

[UK EXTENSION] EU-U.S. DATA PRIVACY FRAMEWORK PRINCIPLES ISSUED BY THE U.S. DEPARTMENT OF COMMERCE

Data Transfers

Recommendations 02/2020 on the European Essential Guarantees for surveillance measures

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

Draft Impact Assessment Framework by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA)

NIST Privacy Framework v1

NIST Critical Infrastructure Framework

RISK FRAMEWORK FOR BODY-RELATED DATA IN IMMERSIVE TECHNOLOGIES

Artificial Intelligence Strategy of the CJEU

AI, Specific processing situations

Generative AI framework for HM Government by the UK Central Digital and Data Office

AI, Specific processing situations

Processing Personal Data on the Basis of Legitimate Interests under the GDPR by FPF

Lawfulness of Processing, Legitimate Interest

Interim Report – Governing AI for Humanity by UN AI Advisory Body

AI, Specific processing situations

AI fairness in practice by the Alan Turing Institute

AI, Specific processing situations

Information Commissioner’s Further Response to the Data Protection and Digital Information Bill (DPDI Bill)

Principles, Sensitive Data

RISK FRAMEWORK FOR BODY-RELATED DATA IN IMMERSIVE TECHNOLOGIES BY FPF

Principles, Sensitive Data

A Guide to Cookies and Compliance by DMA

Consent, Cookies, Lawfulness of Processing

European Commision press release on AI Act Agreement

AI, Specific processing situations

Privacy-Enhancing and Privacy Preserving Technologies: Understanding the Role of PETs and PPTs in the Digital Age by CIPL

Controllers and Processors, Technical and Organisational Measures (TOMs)

Cybersecurity of Artificial Intelligence in the AI Act by the European Commision

Controllers and Processors, Technical and Organisational Measures (TOMs)

New rules for Artificial Intelligence – Questions and Answers by the European Commision

AI, Specific processing situations

Understanding the Role of PETs and PPTs in the Digital Age

Controllers and Processors, Technical and Organisational Measures (TOMs)

Everything Recruiters Need to Know About GDPR by ZOHO

Employment, Specific processing situations

SME Guide on Information Security Controls by European Digital SME Alliance

Controllers and Processors, Technical and Organisational Measures (TOMs)

AI Act Provisional Agreement Press Release

AI, Specific processing situations

PRACTICAL GUIDANCE FOR THE USE OF GENERATIVE ARTIFICIAL INTELLIGENCE IN THE PRACTICE OF LAW by State Bar of California

AI, Specific processing situations

GDPR guidance: Legitimate Inerersts Assessments (LIA) for Digital Advertising

Lawfulness of Processing, Legitimate Interest, Marketing and Advertising, Specific processing situations

The impact of the General Data Protection Regulation (GDPR) on artificial intelligence by the EU Parliamnet

AI, Specific processing situations

Benefits and Risks of Generative Artificial Intelligence Report by the State of California

AI, Specific processing situations

Opinion on processing of CCTV data in regard to employee performance analytics by the Bulgarian DPA

CCTV, Employment, Specific processing situations

Artificial intelligence for healthcare and well-being during exceptional times | European Commision

Generative AI: The Data Protection Implications by CEDPO

AI, Specific processing situations

Exceeding customer expectations by Google

Principles, Privacy by Design

Global Toolkit on AI and the Rule of Law for the Judiciary by UNESCO

AI, Specific processing situations

TOWARDS A SUSTAINABLE, MULTILATERAL, AND UNIVERSAL SOLUTION FOR INTERNATIONAL DATA TRANSFER by the UK Government

Data Transfers

Automated Decision-Making Under the GDPR by the FPF

AI, Automated Decision-making, Controllers and Processors, Specific processing situations

Protection of workers’ personal data: General principles by ILO

Employment, Specific processing situations

Study on the essence of the fundamental rights to privacy and to protection of personal data by EDPS

Data Subjects Rights

Human rights Impact Assessments for AI

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Opinion 44/2023 on the Proposal for Artificial Intelligence Act in the light of legislative developments

AI, Specific processing situations

Government access to datain third countries

Data Processing by the Government, Specific processing situations

Decision of the Data Protection Commission made pursuant to Section 111 of the DPA, 2018 and Articles 60 and 65 of the GDPR

Fairness, Liability and Remedies, Principles, Supervisory Authorities

Practice Guide to Anonymising Personal Data

Anonymisation, Controllers and Processors

Baseline Cyber Security for SMEs

Controllers and Processors, Technical and Organisational Measures (TOMs)

One-Stop-Shop thematic case digest: RIGHT TO OBJECTAND RIGHT TO ERASURE

Data Subjects Rights, Right to Erasure, Right to Object

Study on the appropriate safeguards under Article 89(1) GDPR for the processing of personal data for scientific research

Material scope, Scientific Research, Specific processing situations

Study on the national administrative rules impacting the cooperation duties for the national supervisory authorities

Supervisory Authorities

Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

Demonstration of a privacy-preserving age verification process by CNIL

Children as data subjects, Data Subjects Rights

Voluntary AI Safety Standard by the Australian Government

AI, Specific processing situations

Safe and responsible AI in Australia Proposals paper for introducing mandatory guardrails for AI in high-risk settings by Australian Government

AI, Specific processing situations

Frequently Asked Questions (FAQs) on the Data Act by the EU Commission

Controllers and Processors, Data Sharing

Multidisciplinary Perspectives on Artificial Intelligence and the Law by Springer

AI, Specific processing situations

Meta CAN Use Brazilian User Data for AI Training with Restrictions

Irish Watchdog Ends Case Against X Following AI Data Restrictions

Council of Europe Unveils First Global AI Treaty

FBI Audit Reveals Major Data Handling Flaws

Artificial Intelligence Security Governance Framework 1.0 by China Cybersecurity Standardization Technical Committee

AI, Specific processing situations

UNESCO: Consultation paper on AI Regulation

AI, Lawfulness of Processing, Public Interests, Specific processing situations

Saudi Data & Artificial Intelligence Authority: Rules governing the appointment of Personal DPOs under the Kingdom of Saudi Arabia’s (KSA) Personal Data Protection Law (PDPL)

AI, Specific processing situations

Briefing EU Legislation in Progress by EPRS on AI Act

AI, Specific processing situations

GDPR in practice – Experiences of data protection authorities by FRA

Data Processing by the Government, Specific processing situations

Effective Cyber Risk Management: A best practice governance guide for digitally secure and resilient organisations by Governance Institute of Australia

Risk Management, Technical and Organisational Measures (TOMs)

Online age verification: balancing privacy and the protection of minors by CNIL

Children as data subjects, Data Subjects Rights

Online age verification: balancing privacy and the protection of minors by CNIL | French

Children as data subjects, Data Subjects Rights

EU Parliament Faces noyb Complaints After Major Data Breach

California’s New AB 3048: Opt-Out Signals in Every Browser

Dutch DPA Fines Clearview €30.5M: Directors Could be Held Liable

OpenAI and Anthropic Partner with U.S. Government for AI Safety Research

Massive Data Breach: Exposed 31.5 Million Sensitive Records from ServiceBridge

NIST Special Publication_1800: Implementing a Zero Trust Architecture

Technical and Organisational Measures (TOMs)

ON THE ANTITRUST IMPLICATIONS OF EMBEDDING GENERATIVE AI IN CORE PLATFORM SERVICES BY SSRN

AI, Specific processing situations

Policy for the responsible use of AI in government by Australian Government

AI, Data Processing by the Government, Specific processing situations

Consumer Protection in respect of Use of Generative Artificial Intelligence by Hong Kong Monetary Authority

AI, Specific processing situations

The State of Artificial Intelligence in the Pacific Islands

AI, Specific processing situations

Google’s Gemini AI on Android with Enhanced Privacy Features

NPD Confirms Major Breach: Sensitive Data of Millions Exposed

ICO Provisional £6 Million Penalty for Software Provider Following NHS Data Breach

X Closes Brazil Operations Citing “Censorship Orders” from Judge

South Africa National Artificial Intelligence Policy Framework

AI, Specific processing situations

Data protection code of practice for digital identity schemes in Afrtica

Code of Conduct, Controllers and Processors

Relying on the legal basis of legitimate interests to develop an AI system by CNIL

Lawfulness of Processing, Legitimate Interest

Website privacy controls a guide for business by New York State Attorney General

Data Subjects Rights

Data protection compliant AI by Bavarian State Office for Data protection Supervision

AI, Specific processing situations

NIST Special Publication_1800-29 Data Confidentiality- Detect, Respond to, and Recover from Data Breaches

Controllers and Processors, Data Breaches

Meta Faces $1.4 Billion Penalty for Unauthorized Biometric Data Collection in Texas

Noyb Sues Hamburg DPA Over ‘Pay or OK’ Consent System

Google Officially Declared a Monopoly by U.S. Federal Judge

Noyb Files Nine Complaints Against Twitter/X for Unlawful AI Data Usage

Meta Challenges EDPB Opinion on “Consent or Pay” Model at EU Court

Lithuanian SA Fines Vinted UAB €2.38 Million for GDPR Violations

EU AI Act Now in Force: Prepare for Compliance

Meta and OpenAI Unveil New AI Models: Llama 3.1 and SearchGPT

Confidential Computing and Privacy: Policy Implications of Trusted Execution Environments by Future of Privacy Forum

AI, Specific processing situations

Frequently Asked Questions (FAQ) NIS2 in Belgium by Centre for cybersecurity Belgium

Technical and Organisational Measures (TOMs)

Formal Opinion 512 on Generative Artificial Intelligence Tools by AMERICAN BAR ASSOCIATION

AI, Specific processing situations

EU-U.S. DATA PRIVACY FRAMEWORK F.A.Q. FOR EUROPEAN BUSINESSES BY EDPB

Data Transfers

Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework by EDPB

AI, Specific processing situations

Today’s and tomorrow’s means of payment facing the challenge of data protection by CNIL

Definitions, Processing of personal data

Artificial Intelligence and Algorithms in Risk Assessment by the European Labour Authority

Risk Management

PRIVACY ENHANCING TECHNOLOGY (PET): PROPOSED GUIDE ON SYNTHETIC DATA GENERATION BY PDPC

Principles, Sensitive Data

ENFORCEMENT ADVISORY NO. 2024-01 APPLYING DATA MINIMIZATION TO CONSUMER REQUESTS BY CALIFORNIA PRIVACY PROTECTION AGENCY

Data minimisation, Principles

Global Third Party Cybersecurity Breaches by SecurityScorecard

Controllers and Processors, Data Breaches

National framework for the assurance of artificial intelligence in government by the Australian, state and territory governments

AI, Specific processing situations

Generative AI Controls Framework Safe, Secure, and Compliant AI Adoption Approach Whitepaper by IBM

AI, Specific processing situations

GDPR & Generative AI A Guide for Customers by Microsoft

AI, Specific processing situations

Principles on Children & Online Gaming Adopted at the Nordic Data Protection Meeting in Oslo 30 May 2024

Children as data subjects, Data Subjects Rights

DECISION OF THE INFORMATION COMMISSIONER Snap Inc. and Snap Group Limited

AI, Specific processing situations

Artificial intelligence (AI) and human rights: Using AI as a weapon of repression and its impact on human rights by EU Parliament

AI, Specific processing situations

GDPR in practice: Experience of data protection authorities by FRA

Data Processing by the Government, Specific processing situations

Opinion 11/2024 on the use of facial recognition to streamline airport passengers’ flow (compatibility with Articles 5(1)(e) and(f), 25 and 32 GDPR by EDPB

Facial Recognition, Specific processing situations

Information note by EDPB on data transfers under the GDPR to the United States after the adoption of the adequacy decision on 10 July 2023

Adequacy Decisions, Data Transfers

Regulating targeted and behavioural advertising in digital services by EU Parliament

Marketing and Advertising, Specific processing situations

Data protection impact assessment on the processing of personal data on government Facebook Pages

Controllers and Processors, Data Protection Impact Assessment (DPIA)

The Standard Data Protection Model Version 3.0a by the Conference of Independent Federal and State Data Protection Supervisory Authorities Germany

GDPR & GENERATIVE AI – A GUIDE FOR THE PUBLIC SECTOR BY MICROSOFT

AI, Specific processing situations

Comments on Guidelines 07/2020 on the concepts of controller and processor in the GDPR from the perspective of the Translation and Interpreting Sector by FIT Europe and EUATC

Controllers and Processors

Information Note by EDPB on the redress mechanism for EU/EEA individuals in relation to alleged violations of U.S. law with respect to their data collected by U.S authorities competent for national security

Adequacy Decisions, Data Transfers

Opinion 18/2021 on the draft Standard Contractual Clauses submitted by the LT SA (Article 28(8) GDPR) |EDPB

Controllers and Processors, Data Transfers, Standard Contractual Clauses (SCC)

Opinion 26/2021 on the draft decision of the Supervisory Authority of North Rhine-Westphalia (Germany) regarding the Controller Binding Corporate Rules of the Internet Initiative Japan Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 27/2021 on the draft decision of the Supervisory Authority of North Rhine-Westphalia (Germany) regarding the Processor Binding Corporate Rules of the Internet Initiative Japan Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 28/2021 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules of Oregon Tool, Inc (formerly “Blount”) |EDPB

Binding Corporate Rules, Data Transfers

Opinion 29/2021 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of Oregon Tool, Inc (Formerly “Blount”) |EDPB

Binding Corporate Rules, Data Transfers

Opinion 30/2021 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the COLT Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 31/2021 on the draft decision of the Spanish Supervisory Authority regarding the Processor Binding Corporate Rules of the COLT Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 21/2021 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the CGI Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 22/2021 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the CGI Group |EDPB

Binding Corporate Rules, Data Transfers

Opinion 14/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the United Kingdom |EPDB

Adequacy Decisions, Data Transfers

Opinion 15/2021 regarding the European Commission Draft Implementing Decision pursuant to Directive (EU) 2016/680 on the adequate protection of personal data in the United Kingdom |EDPB

Adequacy Decisions, Data Transfers

Opinion 19/2021 on the draft decision of the competent supervisory authority of Hungary regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EDPB

Accreditation

Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea |EDPB

Adequacy Decisions, Data Transfers

EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)

AI, Specific processing situations

Opinion 20/2021 on Tobacco Traceability System |EDPB

Controllers and Processors, Data Sharing

Generative Artificial Intelligence Risk Assessment by State of California Department of Technology

AI, Risk Management, Specific processing situations

Perspectives on Issues in AI Governance by Google

AI, Specific processing situations

Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms by EDPB

Consent, Lawfulness of Processing

Opinion 23/2021 on the draft decision of the competent supervisory authority of Czech Republic regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EDPB

Code of Conduct, Controllers and Processors

Opinion 24/2021 on the draft decision of the competent supervisory authority of Slovakia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EDPB

Code of Conduct, Controllers and Processors

Opinion 25/2021 on the draft decision of the competent supervisory authority of Lithuania regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EDPB

Accreditation

Opinion 16/2021 on the draft decision of the Belgian Supervisory Authority regarding the “EU Data Protection Code of Conduct for Cloud Service Providers” submitted by Scope Europe |EDPB

Code of Conduct, Controllers and Processors

Opinion 17/2021 on the draft decision of the French Supervisory Authority regarding the European code of conduct submitted by the Cloud Infrastructure Service Providers (CISPE) |EDPB

Code of Conduct, Controllers and Processors

Opinion 03/2022 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the WEBHELP Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 30/2021 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the COLT Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 31/2021 on the draft decision of the Spanish Supervisory Authority regarding the Processor Binding Corporate Rules of the COLT Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 33/2021 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules of Carrier |EPDB

Binding Corporate Rules, Data Transfers

Opinion 34/2021 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules of Otis |EPDB

Binding Corporate Rules, Data Transfers

Opinion 39/2021 on whether Article 58(2)(g) GDPR could serve as a legal basis for a supervisory authority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject |EPDB

Data Controller, Data Subjects Rights, Definitions

Opinion 35/2021 on the draft decision of the competent supervisory authority of Belgium regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 36/2021 on the draft decision of the competent supervisory authority of Norway regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 37/2021 on the draft decision of the competent supervisory authority of Malta regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Accreditation

Opinion 38/2021 on the draft decision of the competent supervisory authority of Latvia regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 08/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Bioclinica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 06/2022 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of Groupon International Limited |EPDB

Binding Corporate Rules, Data Transfers

Opinion 05/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Lundbeck Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 07/2022 on the draft decision of the Hungarian Supervisory Authority regarding the Controller Binding Corporate Rules of MOL Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 04/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Norican Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea |EPDB

Adequacy Decisions, Data Transfers

EDPB-EDPS Joint Opinion 1/2022 on the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2021/953 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic |EPDB

Health Data, Principles, Sensitive Data

EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act)

Data Transfers

Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria |EPDB

Certification, Controllers and Processors

Opinion 12/2022 on the draft decision of the competent supervisory authority of France regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 13/2022 on the draft decision of the competent supervisory authority of Bulgaria regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 14/2022 on the draft decision of the competent supervisory authority of Bulgaria regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 15/2022 on the draft decision of the competent supervisory authority of Luxembourg regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 16/2022 on the draft decision of the competent supervisory authority of Slovenia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 17/2022 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the ANTOLIN Group |EPDB

Binding Corporate Rules, Data Transfers

EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space

Health Data, Principles, Sensitive Data

EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse

Children as data subjects, Data Subjects Rights

Opinion 25/2022 regarding the European Privacy Seal (EuroPriSe ) certification criteria for the certification of processing operations by processors |EPDB

Certification, Controllers and Processors

Opinion 18/2022 on the draft decision of the Baden-Württemberg (Germany) Supervisory Authority regarding the Controller Binding Corporate Rules of the Daimler Truck Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 19/2022 on the draft decision of the Baden-Württemberg (Germany) Supervisory Authority regarding the Controller Binding Corporate Rules of the MercedesBenz Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 20/2022 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Ellucian Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 21/2022 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Ellucian Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 22/2022 on the draft decision of the Liechtenstein Supervisory Authority regarding the Controller Binding Corporate Rules of Hilti Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 23/2022 on the draft decision of the Swedish Supervisory Authority regarding the Controller Binding Corporate Rules of the Samres Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 24/2022 on the draft decision of the Swedish Supervisory Authority regarding the Processor Binding Corporate Rules of the Samres Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 26/2022 on the draft decision of the Data Protection Authority of Bavaria for the Private Sector regarding the Controller Binding Corporate Rules of the Munich Re Reinsurance Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 09/2022 on the draft decision of the Danish Supervisory Authority regarding the Processor Binding Corporate Rules of Bioclinica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 10/2022 on the draft decision of the Hesse Supervisory Authority (Germany) regarding the Controller Binding Corporate Rules of Fresenius Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 02/2022 on the draft decision of the French Supervisory Authority regarding the Controller Binding Corporate Rules of the WEBHELP Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 31/2022 on the draft decision of the Slovak Supervisory Authority regarding the Processor Binding Corporate Rules of Piano Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 32/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Ramboll Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 11/2023 on the draft decision of the competent supervisory authority of Sweden regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Accreditation

Opinion 12/2023 on the draft decision of the competent supervisory authority of Cyprus regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 13/2023 on the draft decision of the competent supervisory authority of Croatia regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 14/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the Vestas Wind Systems Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria |EPDB

Certification, Controllers and Processors

Opinion 18/2023 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of the Collibra Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 19/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the American Express Global Business Travel Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 20/2023 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the Comcast Corporation Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 21/2023 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of the UPS Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 22/2023 on the draft decision of the Belgian Supervisory Authority regarding the Controller Binding Corporate Rules for employee data of the UPS Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 7/2023 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of Autodesk Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 8/2023 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of Autodesk Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework |EPDB

Adequacy Decisions, Data Transfers

Opinion 9/2023 on the draft decision of the Italian Supervisory Authority regarding the Controller Binding Corporate Rules of Vertiv |EPDB

Binding Corporate Rules, Data Transfers

Opinion 10/2023 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the PROSEGUR Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 16/2023 on the draft decision of the Irish Supervisory Authority regarding the Controller Binding Corporate Rules of the Informatica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 17/2023 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Informatica Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 11/2022 on the draft decision of the competent supervisory authority of Poland regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

Opinion 1/2023 on the draft decision of the competent supervisory authority of Croatia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to Article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 02/2023 on the draft decision of the competent supervisory authority of Latvia regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to Article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 03/2023 on the draft decision of the competent supervisory authority of Romania regarding the approval of the requirements for accreditation of a code of conduct monitoring body pursuant to article 41 GDPR |EPDB

Code of Conduct, Controllers and Processors

Opinion 4/2023 on the draft decision of the competent supervisory authority of Malta regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Accreditation

EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro

Accreditation

EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

Accreditation

Opinion 6/2023 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of Royal Greenland Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 27/2022 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of LEYTON Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 28/2022 on the Europrivacy criteria of certification regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 (GDPR) |EPDB

Certification, Controllers and Processors

Opinion 29/2022 on the draft decision of the Danish Supervisory Authority regarding the Controller Binding Corporate Rules of the DSV Group |EPDB

Binding Corporate Rules, Data Transfers

Opinion 30/2022 on the draft decision of the Slovak Supervisory Authority regarding the Controller Binding Corporate Rules of Piano Group |EPDB

Binding Corporate Rules, Data Transfers

Certified Data Protection Officer by PECB

Data Protection Officer (DPO)

Artificial Intelligence and Privacy

Practice Guide to Anonymising Personal Data by Stiftung Dateschutz

Anonymisation

Human rights Impact Assessments for AI by Access Now

AI, Data Protection Impact Assessment (DPIA)

GenAI and data protection: how organisations and their employees can use it appropriately and lawfully

AI, Employment

Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines | NIST

Opinion on legitimate interests of the data controller (Opinion 06/2014)

Legitimate Interest

Opinion 05/2014 on Anonymisation Techniques | WP216

Anonymisation

Information note on data transfers under the GDPR to the US | EDPB

Data Transfers

UK MRC Identifiability, anonymisation and pseudonymisation

Anonymisation

How to manage DPIAs by Data Protection Network (DPN)

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Methodology by CNIL

Data Protection Impact Assessment (DPIA)

Data Protection Code of Conduct for Cloud Infrastructure Service Providers

Cloud Services

Members of the Code of Conduct for Cloud Infrastructure Service Providers

Code of Conduct

Artificial Intelligence Risk Management Framework (AI RMF 1.0) by NIST

Cookies Instructions Kit by DMA Italy, FedoWEB et al.

Consent, Cookies

Australian Information Commissioner (OAIC): Corporate Plan for 2024-25

Data Processing by the Government, Specific processing situations

Telegram CEO’s Arrest Sparks Debate on Privacy vs. Regulation

Personal Data Collection, Technical and Organisational Measures (TOMs)

AI Meets Media: OpenAI Secures Another Multi-Year Deal with Media Giant

AI models collapse when trained on recursively generated data

AI, Specific processing situations

The NSW AI Assessment Framework

Controllers and Processors, Data Protection Impact Assessment (DPIA)

The government-wide vision on Generative Al of the Netherlands

AI, Data Processing by the Government, Specific processing situations

AI Possible Risks & Mitigations Optical Character Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

AI Possible Risks & Mitigations Named Entity Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

The 10-Step Plan for Solid Privacy Compliance Based On The Most Common Fines

5310-C Privacy Threshold Assessments and Privacy Impact Assessments by Office of Information Security

Controllers and Processors, Data Protection Impact Assessment (DPIA)

THE INTERSECTION BETWEEN COMPETITION AND DATA PRIVACY by OECD – OCDE

Data Subjects Rights

Supervision of AI systems in the EU by Dutch DPA and RDI (english)

AI, Specific processing situations

Statement on the interplay between AI Act and GDPR for private sector by the The Austrian DPA

AI, Specific processing situations

Statement 2/2024 on the financial data access and payments package bg EDPB

Finance and Fintech

Review of cybersecurity news in Ukraine, tendencies, and world events related to the First World Cyber War by U.S. Agency for International Development

National Security, Specific processing situations

Rules of Procedure by EDPB on the cooperation and respective roles of national SAs and the EDPB Secretariat regarding the submission of complaints in the redress mechanism available to EU individuals in relation to alleged violations of U.S law with respect to their data collected by U.S. authorities competent for national security

Adequacy Decisions, Data Transfers, Risk Management

Automated Decision-Making in Online Platforms: Protection Against Discrimination and Manipulation of Behavior

Automated Decision-making, Controllers and Processors

Artificial Intelligence Risk Management Framework by NIST: Generative Artificial Intelligence Profile

AI, Risk Management, Specific processing situations

Rules of Procedure for the “Informal Panel of EU DPAs”according to the EU-US Data Privacy Framework by EDPB

Adequacy Decisions, Data Transfers

Building a Cybersecurity and Privacy Learning Program | NIST | Initial Public Draft

Data Breaches, Employment, Risk Management, Technical and Organisational Measures (TOMs)

Spanish AEPD: 10 MISUNDERSTANDINGS RELATED TO ANONYMISATION

Anonymisation

Board of Directors Handbook for Cloud Risk Governance | Google

Governance

The EDPB data protection guide for small business

AI, Risk Management

GDPR Data Incidents – The Step-by-Step Playbook for Effective Response

Data Breaches