Resources

Case T-262/24 Commission v EDPS

Data Processing Agreement (DPA), Data Sharing, Records of processing Activities (ROPA)

Standard contractual clauses for EU-EEA by EU

Standard Contractual Clauses (SCC)

Standard contractual clauses for international transfers by EU

Data Transfers, Standard Contractual Clauses (SCC)

OH Digitale Dienste version 1.2 by German data protection authority

Slovenian SA Decision 0603-42/2023/12 against Dodo Pizza

CCTV, Lawfulness of Processing, Legitimate Interest

Records Management Toolkit Tracker

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Records Management Toolkit Tracker – more information about the Toolkit by UK ICO

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Italian Data Protection Authority (Garante)-Azienda Socio-sanitaria Territoriale Rhodense (5/23/2024)

Accuracy, Data Subjects Rights

Spanish Data Protection Authority (aepd)-BANCO BILBAO VIZCAYA ARGENTARIA, S.A. (6/12/2024)

Accuracy, Principles

Spanish Data Protection Authority (aepd)-VODAFONE ESPAÑA, S.A.U. (4/5/2024)

Accuracy, Principles

Cypriot Data Protection Commissioner-Bank of Cyprus Public Company Ltd. (7/15/1905)

Accuracy, Principles

Spanish Data Protection Authority (aepd)-Oney Servicios Financieros E.F.C. (10/23/2023)

Accuracy, Principles

Italian Data Protection Authority (Garante)-Mednow Medical Center di Giugni Marco (8/31/2023)

Accuracy, Data Subjects Rights, Principles, Sensitive Data

Austrian Data Protection Authority (dsb)-Operator of a public toilet (8/23/2022)

Lawfulness of Processing, Legitimate Interest, Sensitive Data

Belgian Data Protection Authority (APD)-Company (8/23/2022)

Accuracy, Controllers and Processors, Principles, Representative, Technical and Organisational Measures (TOMs)

Italian Data Protection Authority (Garante)-Areti spa (11/24/2022)

Accountability, Accuracy, Data Subjects Rights, Principles, Sensitive Data

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-SC Raiffeisen Bank SA (9/9/2022)

Accuracy, Principles

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Workshop (3/29/2022)

Legitimate Interest, Principles, Purpose limitation, Sensitive Data

Norwegian Supervisory Authority (Datatilsynet)-Elektro & Automasjon Systemer AS (12/13/2021)

Lawfulness of Processing, Legitimate Interest

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Telekom Romania Communications SA (12/6/2021)

Access Requests (DSAR), Accountability, Accuracy, Data Subjects Rights, Principles, Sensitive Data

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Magyar Telekom Nyrt. (6/18/2021)

Accuracy, Controllers and Processors, Data Subjects Rights, Principles, Representative

Spanish Data Protection Authority (aepd)-Caixabank S.A. (7/8/2021)

Lawfulness of Processing, Legitimate Interest

Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)-Storstockholms Lokaltrafik (6/21/2021)

Data Subjects Rights, Lawfulness of Processing, Legitimate Interest, Principles, Sensitive Data

Spanish Data Protection Authority (aepd)-TNT EXPRESS WORLDWIDE SPAIN, S.L. (6/22/2021)

Accuracy, Principles

Spanish Data Protection Authority (aepd)-Equifax Iberica S.L. (3/10/2021)

Lawfulness of Processing, Legitimate Interest

Spanish Data Protection Authority (aepd)-Iberdrola Clientes (2/3/2021)

Accuracy, Data Subjects Rights, Principles

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Unknown (11/18/2020)

Accuracy, Principles

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (1/4/2021)

Accuracy, Principles, Sensitive Data

Spanish Data Protection Authority (aepd)-Banco Bilbao Vizcaya Argentaria, S.A. (12/21/2020)

Accuracy, Principles

Lithuanian Data Protection Authority (VDAI)-Vilnius City Municipality Administration (10/21/2020)

Accuracy, Controllers and Processors, Principles, Representative

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (Unknown)

Accuracy, Principles

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (Unknown)

Accuracy, Principles

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Bank (2/8/2019)

Accuracy, Principles

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg discussion paper on “Legal Foundations in Data Protection for the Use of AI”

AI, Lawfulness of Processing, Legitimate Interest, Specific processing situations

Case C‑621/22 CJEU

Lawfulness of Processing, Legitimate Interest, Marketing and Advertising, Specific processing situations

Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR by EDPB

Lawfulness of Processing, Legitimate Interest

Belgian DPA General Secretariat Artificial intelligence systems and the RGPD from a data protection perspective

AI, Lawfulness of Processing, Principles, Specific processing situations, Transparency

Reprimand issued by the UK ICO concerning infringements of Article 5(1)(a), Article 6(1)(a) and Article 7(1) UK GDPR

Consent, Cookies, Lawfulness of Processing, Liability and Remedies

THE NEW STANDARD CONTRACTUAL CLAUSES – QUESTIONS AND ANSWERS

Data Transfers, Standard Contractual Clauses (SCC)

Transparency and Consent Framework Policies by IAB Europe

Consent, Cookies, Lawfulness of Processing, Principles, Transparency

Recommendations 02/2020 on the European Essential Guarantees for surveillance measures

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

Processing Personal Data on the Basis of Legitimate Interests under the GDPR by FPF

Lawfulness of Processing, Legitimate Interest

A Guide to Cookies and Compliance by DMA

Consent, Cookies, Lawfulness of Processing

GUIDELINES ON LEGITIMATE INTEREST by the NPC of the Republic of Philippines

Lawfulness of Processing, Legitimate Interest

Annex: A summary of the Transparency in Health and Social Care guidance impact assessment by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

Transparency in health and social care by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

GDPR guidance: Legitimate Inerersts Assessments (LIA) for Digital Advertising

Lawfulness of Processing, Legitimate Interest, Marketing and Advertising, Specific processing situations

C-460/20

Data Subjects Rights, Right to Erasure, Search Engines, Specific processing situations

C-597/19

Lawfulness of Processing, Legitimate Interest

C-708/18

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

C-136/17

Data Subjects Rights, Principles, Right to Erasure, Search Engines, Sensitive Data, Specific processing situations

Relying on the legal basis of legitimate interests to develop an AI system by CNIL

Lawfulness of Processing, Legitimate Interest

Office of the Privacy Commissioner of Canada Sweep Report 2024

Consent, Cookies, Lawfulness of Processing

Opinion 18/2021 on the draft Standard Contractual Clauses submitted by the LT SA (Article 28(8) GDPR) |EDPB

Controllers and Processors, Data Transfers, Standard Contractual Clauses (SCC)

Opinion on legitimate interests of the data controller (Opinion 06/2014)

Legitimate Interest

Joint statement on data scraping and the protection of privacy

Personal Data Collection

Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González [2014] Case C-131/12

Search Engines

Planet49 GmbH, C-673/17, Grand Chamber, 1 October 2019.

Consent, Cookies

CNIL and others v Google Case C 136/17

Search Engines, Specific processing situations

Google v CNIL Case C 507/17

Search Engines

Records of Processing Activities under Article 30 GDPR | Irish DPC

Records of processing Activities (ROPA)

WORKING PARTY 29 POSITION PAPER on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR

Records of processing Activities (ROPA)

Joint Guide to ASEAN MCC and EU SCC

Data Transfers, Standard Contractual Clauses (SCC)

Records of processing activities template by the CNIL

Records of processing Activities (ROPA)

Guidelines on transparency under Regulation 2016/679

Transparency

Guidance on the rules on use of cookies and similar technologies [pdf] [Official Guidelines]

Consent, Cookies

Cookies Instructions Kit by DMA Italy, FedoWEB et al.

Consent, Cookies

Report of the work undertaken by the Cookie Banner Taskforce [Official EDPB Guidelines] [pdf]

Consent, Cookies

CIPL Examples of Legitimate Interest Grounds for Processing of Personal Data [PDF] [Official Guidelines]

Lawfulness of Processing, Legitimate Interest

Telegram CEO’s Arrest Sparks Debate on Privacy vs. Regulation

Personal Data Collection, Technical and Organisational Measures (TOMs)

Salvatore Manni Case C 398/15

Data Retention, Legitimate Interest, Storage limitation

A Guide to UK GDPR Principles | UK ICO

Accountability, Accuracy, Data minimisation, Integrity and confidentiality, Lawfulness of Processing, Principles, Purpose limitation, Storage limitation, Transparency

A Guide to Lawful Basis | UK ICO

Consent, Lawfulness of Processing, Legal Obligation, Legitimate Interest, Performance of Contract, Public Interests, Vital Interests