Resources

OH Digitale Dienste version 1.2 by German data protection authority

Records Management Toolkit Tracker

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Records Management Toolkit Tracker – more information about the Toolkit by UK ICO

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Corint Logistic SRL. (5/30/2024)

Access Requests (DSAR), Data Subjects Rights, Lawfulness of Processing, Principles, Right to Object, Sensitive Data

Data Protection Authority of Hessen-Company (7/15/1905)

Data Subjects Rights, Right to Object

French Data Protection Authority (CNIL)-Candidate for parliamentary elections (12/22/2023)

Data Subjects Rights, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-NN Asigurări de Viață S.A. (9/18/2023)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-CONCENTRA CENTRAL DE COMPRAS Y SERVICIOS S.L. (6/7/2023)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Grizzaffi Management Srl (5/17/2023)

Data Subjects Rights, Lawfulness of Processing, Right to Object

Spanish Data Protection Authority (aepd)-ECOMM MOVADGENCY S.L. (2/28/2023)

Data Subjects Rights, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Tensa Art Design SRL (4/4/2023)

Data Subjects Rights, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Tensa Art Design SA (2/1/2023)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-XASTRE DO PETO, S.L. (11/11/2022)

Consent, Data Subjects Rights, Lawfulness of Processing, Right to Object

French Data Protection Authority (CNIL)-ACCOR SA (8/19/2022)

Access Requests (DSAR), Data Subjects Rights, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-Sephora Cosmetics România SA (8/4/2022)

Data Subjects Rights, Right to Object

French Data Protection Authority (CNIL)-TotalEnergies Electricité et Gaz France (6/23/2022)

Data Subjects Rights, Right to Object

Norwegian Supervisory Authority (Datatilsynet)-Company (3/15/2022)

Consent, Data Subjects Rights, Lawfulness of Processing, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-IAMSAT Muntenia SA (2/22/2022)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-T.S.M. s.r.l. (1/27/2022)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Aimon Srl (11/25/2021)

Controllers and Processors, Data Subjects Rights, Lawfulness of Processing, Representative, Right to Object

French Data Protection Authority (CNIL)-FREE MOBILE (12/28/2021)

Data Subjects Rights, Principles, Privacy by Design, Right to Object

Hellenic Data Protection Authority (HDPA)-ΚΑΠΑ ΛΑΜΔΑ ΩΜΕΓΑ ΔΙΑΦΗΜΙΣΤΙΚΗ ΕΜΠΟΡΙΚΗ ΜΟΝΟΠΡΟΣΩΠΗ ΕΤΑΙΡΕΙΑ ΠΕΡΙΟΡΙΣΜΕΝΗΣ ΕΥΘΥΝΗΣ (10/14/2021)

Data Subjects Rights, Lawfulness of Processing, Right to Object

Hellenic Data Protection Authority (HDPA)-PREMIUMMEDIA ΠΑΡΑΓΩΓΗ ΟΠΤΙΚΟ-ΑΚΟΥΣΤΙΚΩΝ ΕΡΓΩΝ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΙΑ (10/4/2021)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-Vodafone España, S.A.U. (10/19/2021)

Data Subjects Rights, Right to Object

Data Protection Authority of Ireland-Vodafone Ireland Limited (9/7/2021)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-Promotech Digital S.L. (4/6/2021)

Data Subjects Rights, Right to Object

French Data Protection Authority (CNIL)-Perfomeclic (12/7/2020)

Data minimisation, Data Subjects Rights, Principles, Right to Object, Sensitive Data

Spanish Data Protection Authority (aepd)-Tour & People Max S.L. (7/31/2020)

Data Subjects Rights, Right to Object

Spanish Data Protection Authority (aepd)-De Vere Spain S.L. (7/2/2020)

Data Subjects Rights, Right to Object

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Financial Enterprise (6/26/2019)

Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Data Protection Authority of Hamburg-Hamburger Volksbank eG (7/11/1905)

Data Subjects Rights, Right to Object

Italian Data Protection Authority (Garante)-Eni Gas e Luce (12/11/2019)

Access Requests (DSAR), Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Italian Data Protection Authority (Garante)-TIM (telecommunications operator) (1/15/2020)

Access Requests (DSAR), Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Spanish Data Protection Authority (aepd)-Iberia Lineas Aereas de Espana, S.A. Operadora Unipersonal (2/3/2020)

Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Spanish Data Protection Authority (aepd)-Banco Bilbao Vizcaya Argentaria S.L. (2/3/2020)

Controllers and Processors, Data Subjects Rights, Principles, Representative, Right to Object

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-SC Enel Energie S.A. (Electricity Distributor) (12/16/2019)

Consent, Controllers and Processors, Data Subjects Rights, Lawfulness of Processing, Principles, Representative, Right to Object

Hellenic Data Protection Authority (HDPA)-Wind Hellas Telecommunications (10/18/2019)

Data Subjects Rights, Right to Object

Hellenic Data Protection Authority (HDPA)-Telecommunication Service Provider (10/7/2019)

Data Subjects Rights, Right to Object

Data Protection Authority of Berlin-Delivery Hero (9/19/2019)

Access Requests (DSAR), Data Subjects Rights, Right to Object

Guidelines on Securing AI Systems by The Cyber Security Agency of Singapore (CSA)

AI, Risk Management, Specific processing situations

Cyber Threat Modelling for Risk Assessment by CSB

Risk Management, Technical and Organisational Measures (TOMs)

Chief Information Security Officer_ HANDBOOK

Risk Management

“AI & Algorithmic Risks Report” by Dutch Data Protection Authority

AI, Risk Management, Specific processing situations

Reprimand issued by the UK ICO concerning infringements of Article 5(1)(a), Article 6(1)(a) and Article 7(1) UK GDPR

Consent, Cookies, Lawfulness of Processing, Liability and Remedies

Case C 203/22 on AI and automated decisions, the right of access under the GDPR, and the protection of trade secrets

AI, Automated Decision-making, Controllers and Processors, Specific processing situations

NIST Special Publication NIST SP 800-221A_Information and Communications Technology (ICT) Risk Outcomes Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio

Risk Management

National Strategy to Advance Privacy-Preserving Data Sharing and Analytics by the EO by the US President

Anonymisation, Controllers and Processors, Technical and Organisational Measures (TOMs)

Transparency and Consent Framework Policies by IAB Europe

Consent, Cookies, Lawfulness of Processing, Principles, Transparency

DRAFT RISK ASSESSMENT REGULATIONS FOR CALIFORNIA PRIVACY PROTECTION AGENCY

Risk Management

A Guide to Cookies and Compliance by DMA

Consent, Cookies, Lawfulness of Processing

[Draft] Guidelines on the processing of personal data in regard to recruitment by the UK ICO

Automated Decision-making, Controllers and Processors, Data Protection Impact Assessment (DPIA), Employment, Specific processing situations

Guidelines for evaluating differential priavacy gurantees by NIST

Anonymisation, Controllers and Processors, Technical and Organisational Measures (TOMs)

AUTOMATED DECISIONMAKING TECHNOLOGY REGULATIONS (DRAFT) by CPPA

Automated Decision-making, Controllers and Processors

Automated Decision-Making Under the GDPR by the FPF

AI, Automated Decision-making, Controllers and Processors, Specific processing situations

Practice Guide to Anonymising Personal Data

Anonymisation, Controllers and Processors

One-Stop-Shop thematic case digest: RIGHT TO OBJECTAND RIGHT TO ERASURE

Data Subjects Rights, Right to Erasure, Right to Object

Effective Cyber Risk Management: A best practice governance guide for digitally secure and resilient organisations by Governance Institute of Australia

Risk Management, Technical and Organisational Measures (TOMs)

Office of the Privacy Commissioner of Canada Sweep Report 2024

Consent, Cookies, Lawfulness of Processing

Artificial Intelligence and Algorithms in Risk Assessment by the European Labour Authority

Risk Management

Guidelines scraping by private organizations and individuals by the Dutch Data Protection Authority

Automated Decision-making, Controllers and Processors

Generative Artificial Intelligence Risk Assessment by State of California Department of Technology

AI, Risk Management, Specific processing situations

Practice Guide to Anonymising Personal Data by Stiftung Dateschutz

Anonymisation

Planet49 GmbH, C-673/17, Grand Chamber, 1 October 2019.

Consent, Cookies

GUIDE TO BASIC ANONYMISATION | PDPC Singapore

Anonymisation

Guidance on Anonymisation and Pseudonymisation | Irish DPC

Anonymisation

Opinion 05/2014 on Anonymisation Techniques | WP216

Anonymisation

UK MRC Identifiability, anonymisation and pseudonymisation

Anonymisation

Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679

Automated Decision-making

Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679

Data Subjects Rights, Right to Object

Guidance on the rules on use of cookies and similar technologies [pdf] [Official Guidelines]

Consent, Cookies

Cookies Instructions Kit by DMA Italy, FedoWEB et al.

Consent, Cookies

Report of the work undertaken by the Cookie Banner Taskforce [Official EDPB Guidelines] [pdf]

Consent, Cookies

Automated Decision-Making in Online Platforms: Protection Against Discrimination and Manipulation of Behavior

Automated Decision-making, Controllers and Processors

Rules of Procedure by EDPB on the cooperation and respective roles of national SAs and the EDPB Secretariat regarding the submission of complaints in the redress mechanism available to EU individuals in relation to alleged violations of U.S law with respect to their data collected by U.S. authorities competent for national security

Adequacy Decisions, Data Transfers, Risk Management

Artificial Intelligence Risk Management Framework by NIST: Generative Artificial Intelligence Profile

AI, Risk Management, Specific processing situations

Building a Cybersecurity and Privacy Learning Program | NIST | Initial Public Draft

Data Breaches, Employment, Risk Management, Technical and Organisational Measures (TOMs)

Bodil Lindqvist [2003] Case C-101/01, 6 November 2003

Automated Decision-making

Salvatore Manni Case C 398/15

Data Retention, Legitimate Interest, Storage limitation

ANAF Case C‑201/14, 1 October 2015

Automated Decision-making, Data Sharing, Data Transfers, Public Administrative Body

Anonymisation: managing data protection risk code of practice | UK ICO

Anonymisation

Spanish AEPD: 10 MISUNDERSTANDINGS RELATED TO ANONYMISATION

Anonymisation

A Guide to Lawful Basis | UK ICO

Consent, Lawfulness of Processing, Legal Obligation, Legitimate Interest, Performance of Contract, Public Interests, Vital Interests

The EDPB data protection guide for small business

AI, Risk Management

Approach to Data Spaces from GDPR Perspective (AEPD)

Data Spaces, Risk Management