Resources

Records Management Toolkit Tracker

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Records Management Toolkit Tracker – more information about the Toolkit by UK ICO

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Italian Data Protection Authority (Garante)-Azienda Socio-sanitaria Territoriale Rhodense (5/23/2024)

Accuracy, Data Subjects Rights

Polish National Personal Data Protection Office (UODO)-Committee (4/24/2024)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Spanish Data Protection Authority (aepd)-BANCO BILBAO VIZCAYA ARGENTARIA, S.A. (6/12/2024)

Accuracy, Principles

Italian Data Protection Authority (Garante)-Enel Energia SpA (2/8/2024)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Spanish Data Protection Authority (aepd)-VODAFONE ESPAÑA, S.A.U. (4/5/2024)

Accuracy, Principles

Hellenic Data Protection Authority (HDPA)-Greek Ministry of Immigration and Asylum (4/2/2024)

Controllers and Processors, Data Protection Impact Assessment (DPIA), Data Subjects Rights, Principles, Privacy by Design

Cypriot Data Protection Commissioner-Bank of Cyprus Public Company Ltd. (7/15/1905)

Accuracy, Principles

Spanish Data Protection Authority (aepd)-Open Bank, S.A. (7/28/2023)

Data Subjects Rights, Principles, Privacy by Design

Spanish Data Protection Authority (aepd)-Oney Servicios Financieros E.F.C. (10/23/2023)

Accuracy, Principles

Polish National Personal Data Protection Office (UODO)-Disciplinary officer (4/20/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Italian Data Protection Authority (Garante)-Azienda socio sanitaria territoriale nord Milano, C.F. (12/7/2023)

Lawfulness of Processing, Principles, Privacy by Design, Sensitive Data

Polish National Personal Data Protection Office (UODO)-Polish Minister of Health (12/20/2023)

Data Subjects Rights, Principles, Privacy by Design

Norwegian Supervisory Authority (Datatilsynet)-Norwegian Labor and Welfare Administration (11/27/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Polish National Personal Data Protection Office (UODO)-Company (7/18/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Spanish Data Protection Authority (aepd)-BANCO BILBAO VIZCAYA ARGENTARIA, S.A. (10/20/2023)

Data Subjects Rights, Principles, Privacy by Design

Italian Data Protection Authority (Garante)-Mednow Medical Center di Giugni Marco (8/31/2023)

Accuracy, Data Subjects Rights, Principles, Sensitive Data

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Uipath SRL (8/21/2023)

Data Subjects Rights, Principles, Privacy by Design

Polish National Personal Data Protection Office (UODO)-Company (5/31/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Hellenic Data Protection Authority (HDPA)-Piraeus Bank (6/12/2023)

Lawfulness of Processing, Principles, Privacy by Design, Representative

Polish National Personal Data Protection Office (UODO)-Municipality (5/16/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Polish National Personal Data Protection Office (UODO)-Municipality (5/5/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Italian Data Protection Authority (Garante)-Sorgenia S.p.a. (4/14/2023)

Accountability, Principles, Privacy by Design

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-AUTOMOBILE BAVARIA SRL (5/18/2023)

Controllers and Processors, Principles, Privacy by Design, Sensitive Data, Technical and Organisational Measures (TOMs)

Croatian Data Protection Authority (azop)-Sports betting operator (5/18/2023)

Consent, Lawfulness of Processing, Principles, Privacy by Design

Polish National Personal Data Protection Office (UODO)-Company (2/8/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Polish National Personal Data Protection Office (UODO)-Szczecin-Centrum District Court (1/19/2023)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Belgian Data Protection Authority (APD)-Company (8/23/2022)

Accuracy, Controllers and Processors, Principles, Representative, Technical and Organisational Measures (TOMs)

Italian Data Protection Authority (Garante)-Areti spa (11/24/2022)

Accountability, Accuracy, Data Subjects Rights, Principles, Sensitive Data

Data Protection Authority of Ireland-Meta Platforms Ireland Limited (11/25/2022)

Privacy by Design

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-OTP LEASING ROMANIA IFN SA (11/25/2022)

Data Subjects Rights, Principles, Privacy by Design

Italian Data Protection Authority (Garante)-Azienda Usl Valle d’Aosta (11/10/2022)

Lawfulness of Processing, Principles, Privacy by Design, Sensitive Data

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Casa Rusu S.R.L. (12/9/2022)

Data Subjects Rights, Principles, Privacy by Design

Polish National Personal Data Protection Office (UODO)-Mayor (11/2/2022)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Raiffeisen Bank SA (11/16/2022)

Data Subjects Rights, Principles, Privacy by Design

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Banca Comercială Română SA (9/19/2022)

Data Subjects Rights, Principles, Privacy by Design

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Bitfactor SRL (9/22/2022)

Data Subjects Rights, Principles, Privacy by Design

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-SC Raiffeisen Bank SA (9/9/2022)

Accuracy, Principles

Data Protection Authority of Niedersachsen-Company (7/13/1905)

Data Subjects Rights, Principles, Privacy by Design

Croatian Data Protection Authority (azop)-Telecommunications company (7/21/2022)

Data Subjects Rights, Principles, Privacy by Design

Italian Data Protection Authority (Garante)-Azienda sanitaria universitaria Friuli Centrale (5/26/2022)

Lawfulness of Processing, Principles, Privacy by Design, Sensitive Data

Italian Data Protection Authority (Garante)-Azienda sanitaria universitaria Friuli Occidentale (5/26/2022)

Lawfulness of Processing, Principles, Privacy by Design, Sensitive Data

Polish National Personal Data Protection Office (UODO)-Fortum Marketing and Sales Polska S.A. (1/19/2022)

Controllers and Processors, Data Processing Agreement (DPA), Data Subjects Rights, Integrity and confidentiality, Principles, Privacy by Design

Data Protection Authority of Hamburg-Company (7/12/1905)

Definitions, Joint Controllers

Deputy Data Protection Ombudsman-Travel agency (12/16/2021)

Controllers and Processors, Data Subjects Rights, Integrity and confidentiality, Principles, Privacy by Design, Technical and Organisational Measures (TOMs)

Polish National Personal Data Protection Office (UODO)-Warsaw University of Technology (12/9/2021)

Controllers and Processors, Integrity and confidentiality, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

French Data Protection Authority (CNIL)-FREE MOBILE (12/28/2021)

Data Subjects Rights, Principles, Privacy by Design, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Telekom Romania Communications SA (12/6/2021)

Access Requests (DSAR), Accountability, Accuracy, Data Subjects Rights, Principles, Sensitive Data

Italian Data Protection Authority (Garante)-La Prima S.r.l. (9/16/2021)

Controllers and Processors, Principles, Privacy by Design, Representative, Technical and Organisational Measures (TOMs)

Italian Data Protection Authority (Garante)-Roma Capitale (7/22/2021)

Data Subjects Rights, Principles, Privacy by Design

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Magyar Telekom Nyrt. (6/18/2021)

Accuracy, Controllers and Processors, Data Subjects Rights, Principles, Representative

Spanish Data Protection Authority (aepd)-TNT EXPRESS WORLDWIDE SPAIN, S.L. (6/22/2021)

Accuracy, Principles

Hellenic Data Protection Authority (HDPA)-KARIERA A.E. (5/12/2021)

Access Requests (DSAR), Data Subjects Rights, Principles, Privacy by Design

Italian Data Protection Authority (Garante)-Fondazione Policlinico Tor Vergata di Roma (4/21/2021)

Data Subjects Rights, Lawfulness of Processing, Principles, Privacy by Design, Sensitive Data

Data Protection Authority of Ireland-Irish Credit Bureau DAC (3/23/2021)

Accountability, Data Subjects Rights, Principles, Privacy by Design

Italian Data Protection Authority (Garante)-Istituto Nazionale Previdenza Sociale (INPS) (2/25/2021)

Lawfulness of Processing, Principles, Privacy by Design, Sensitive Data

Spanish Data Protection Authority (aepd)-Iberdrola Clientes (2/3/2021)

Accuracy, Data Subjects Rights, Principles

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Unknown (11/18/2020)

Accuracy, Principles

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (1/4/2021)

Accuracy, Principles, Sensitive Data

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.) (12/16/2020)

Controllers and Processors, Data Breaches, Lawfulness of Processing, Performance of Contract, Principles, Privacy by Design

Spanish Data Protection Authority (aepd)-Banco Bilbao Vizcaya Argentaria, S.A. (12/21/2020)

Accuracy, Principles

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Deichmann Cipőkereskedelmi Korlátolt Felelősségű Társaságnak (10/23/2020)

Data Subjects Rights, Principles, Privacy by Design

Lithuanian Data Protection Authority (VDAI)-Vilnius City Municipality Administration (10/21/2020)

Accuracy, Controllers and Processors, Principles, Representative

Data Protection Commision of Bulgaria (KZLD)-T.K. EOOD (2/20/2020)

Data Subjects Rights, Principles, Privacy by Design

Data Protection Commision of Bulgaria (KZLD)-L.E. EOOD (2/20/2020)

Data Subjects Rights, Lawfulness of Processing, Principles, Privacy by Design

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-UNICREDIT BANK SA (6/27/2019)

Controllers and Processors, Principles, Privacy by Design, Representative

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (Unknown)

Accuracy, Principles

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (Unknown)

Accuracy, Principles

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Bank (2/8/2019)

Accuracy, Principles

Case C‑604/22

Joint Controllers, Personal Data

Opinion 37/2023 on the draft decision of the competent supervisory authority of Luxemburg regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) |EPDB

Certification, Controllers and Processors

Opinion 38/2023 on the draft decision of the competent supervisory authority of Slovenian regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR). |EPDB

Certification, Controllers and Processors

Case C 683-2021

Data Controller, Data Processors, Joint Controllers

Press Release No 184-23 by the CJEU

Controllers and Processors, Joint Controllers, Liability and Remedies, Supervisory Authorities

Exceeding customer expectations by Google

Principles, Privacy by Design

Case C-60/22

Accountability, Controllers and Processors, Joint Controllers, Principles

Noyb Complaint Case: C-082-01 to EU Data protection Supervisor against EU Parliament

Controllers and Processors, Data Breaches, Public Administrative Body

Noyb Complaint Case: C-082-02 to EU Data protection Supervisor against EU Parliament

Controllers and Processors, Data Breaches, Public Administrative Body

Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria |EPDB

Certification, Controllers and Processors

Opinion 25/2022 regarding the European Privacy Seal (EuroPriSe ) certification criteria for the certification of processing operations by processors |EPDB

Certification, Controllers and Processors

Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria |EPDB

Certification, Controllers and Processors

Opinion 28/2022 on the Europrivacy criteria of certification regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 (GDPR) |EPDB

Certification, Controllers and Processors

Guidelines 10/2020 on restrictions under Article 23 GDPR

Data Subject Rights Restrictions, Data Subjects Rights

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default

Privacy by Design

Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them

Privacy by Design

Privacy, seriously by the UK ICO

AI, Privacy by Design, Product Privacy Design

Salvatore Manni Case C 398/15

Data Retention, Legitimate Interest, Storage limitation

ANAF Case C‑201/14, 1 October 2015

Automated Decision-making, Data Sharing, Data Transfers, Public Administrative Body

A Guide to UK GDPR Principles | UK ICO

Accountability, Accuracy, Data minimisation, Integrity and confidentiality, Lawfulness of Processing, Principles, Purpose limitation, Storage limitation, Transparency