Resources

Records Management Toolkit Tracker

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Records Management Toolkit Tracker – more information about the Toolkit by UK ICO

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

French Data Protection Authority (CNIL)-Company (12/22/2023)

Principles, Purpose limitation

National Commission for Data Protection (CNPD)-Unknown (9/21/2023)

Data Subjects Rights, Principles, Purpose limitation, Sensitive Data

Italian Data Protection Authority (Garante)-Douglas Italia S.p.a. (10/20/2022)

Accountability, Lawfulness of Processing, Principles, Purpose limitation, Sensitive Data

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-AMPLIFON Hungary Trade and Service Provider LLC (8/11/2022)

Controllers and Processors, Data Subjects Rights, Principles, Purpose limitation, Representative

Spanish Data Protection Authority (aepd)-BANCO BILBAO VIZCAYA ARGENTARIA, S.A. (10/31/2022)

Controllers and Processors, Principles, Purpose limitation, Representative, Technical and Organisational Measures (TOMs)

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Company (8/8/2022)

Accountability, Consent, Lawfulness of Processing, Principles, Purpose limitation, Sensitive Data

Spanish Data Protection Authority (aepd)-Bar owner (7/19/2022)

Principles, Purpose limitation

Data Protection Authority of Hessen-Restaurant (7/13/1905)

Principles, Purpose limitation

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Workshop (3/29/2022)

Legitimate Interest, Principles, Purpose limitation, Sensitive Data

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-MAYR MELNHOF PACKAGING ROMANIA S.R.L. (5/17/2022)

Accountability, Lawfulness of Processing, Principles, Purpose limitation, Sensitive Data

Data Protection Authority of Hamburg-Company (7/12/1905)

Definitions, Joint Controllers

Bulgarian Commission for Personal Data Protection (KZLD)-Bank (10/26/2021)

Principles, Purpose limitation

Spanish Data Protection Authority (aepd)-Bar owner (9/28/2021)

Principles, Purpose limitation

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-S.C. Tip Top Food Industry S.R.L (4/15/2021)

Accountability, Lawfulness of Processing, Principles, Purpose limitation, Sensitive Data

Spanish Data Protection Authority (aepd)-Certime S.A. (3/15/2021)

Principles, Purpose limitation

Spanish Data Protection Authority (aepd)-I-DE Redes Eléctricas Inteligentes, S.A.U (3/2/2021)

Performance of Contract, Principles, Purpose limitation, Sensitive Data

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Unknown (12/16/2020)

Principles, Purpose limitation, Sensitive Data

Spanish Data Protection Authority (aepd)-Party of the Socialists of Catalonia (8/17/2020)

Principles, Purpose limitation

Spanish Data Protection Authority (aepd)-Bankia S.A. (8/28/2020)

Principles, Purpose limitation

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Digi Távközlési Szolgáltató Kft. (‘Digi’) (electronic communication service provider) (6/12/2020)

Controllers and Processors, Principles, Purpose limitation, Technical and Organisational Measures (TOMs)

Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)-Unnamed financial institution (3/4/2019)

Controllers and Processors, Data Subjects Rights, Principles, Purpose limitation, Representative, Right to Erasure

Belgian Data Protection Authority (APD)-Mayor (5/28/2019)

Controllers and Processors, Principles, Purpose limitation, Representative

Bulgarian Commission for Personal Data Protection (KZLD)-Bank (12/4/2018)

Controllers and Processors, Principles, Purpose limitation, Representative

Supreme Court of Singapore’s Circular on the Use of GenAI Tools in Court Documents

Data Processing by the Government, Specific processing situations

EDPS Model Administrative Arrangement

Data Processing by the Government, Data Transfers, Specific processing situations

Report and Guidance on Privacy in Social Network Services – ”Rome Memorandum” by International Working Group on Data Protection in Telecommunications

Definitions, Processing of personal data

Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR |EPDB

Definitions, Main Establishment

Case C‑740/22

Definitions, Personal Data

Case C‑604/22

Joint Controllers, Personal Data

Recommendations 02/2020 on the European Essential Guarantees for surveillance measures |EPDB

Specific processing situations, Surveillance

National Strategy to Advance Privacy-Preserving Data Sharing and Analytics by the EO by the US President

Anonymisation, Controllers and Processors, Technical and Organisational Measures (TOMs)

Case C 683-2021

Data Controller, Data Processors, Joint Controllers

Guidelines for evaluating differential priavacy gurantees by NIST

Anonymisation, Controllers and Processors, Technical and Organisational Measures (TOMs)

Press Release No 184-23 by the CJEU

Controllers and Processors, Joint Controllers, Liability and Remedies, Supervisory Authorities

Practice Guide to Anonymising Personal Data

Anonymisation, Controllers and Processors

Government access to datain third countries

Data Processing by the Government, Specific processing situations

Case C-101/01

Data Transfers, Definitions, Principles, Processing of personal data, Sensitive Data

C-272/19

Access Requests (DSAR), Data Controller, Data Subjects Rights, Definitions

C-77/21

Principles, Purpose limitation

Case C-60/22

Accountability, Controllers and Processors, Joint Controllers, Principles

GDPR in practice – Experiences of data protection authorities by FRA

Data Processing by the Government, Specific processing situations

Policy for the responsible use of AI in government by Australian Government

AI, Data Processing by the Government, Specific processing situations

Case C‑461/22 CURIA

Data Controller, Definitions

Case C-394/23, Mousse: Request for a preliminary ruling from the Conseil d’État (France) lodged on 28 June 2023 — Association Mousse v Commission nationale de l’informatique et des libertés (CNIL), SNCF Connect

Definitions, Processing of personal data

Today’s and tomorrow’s means of payment facing the challenge of data protection by CNIL

Definitions, Processing of personal data

EditorsTrends in Data Protection and Encryption Technologies by SpringerProfessional

Definitions, New technology, Processing of personal data

GDPR in practice: Experience of data protection authorities by FRA

Data Processing by the Government, Specific processing situations

PRACTICE GUIDE SECURITY OF PERSONAL DATA Version 2024 by CNIL

Definitions, Personal Data

Opinion 39/2021 on whether Article 58(2)(g) GDPR could serve as a legal basis for a supervisory authority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject |EPDB

Data Controller, Data Subjects Rights, Definitions

Practice Guide to Anonymising Personal Data by Stiftung Dateschutz

Anonymisation

Joint statement on data scraping and the protection of privacy

Personal Data Collection

Fashion ID, 29 July 2019, C-40/17, ECLI:EU:C:2019:629

Data Controller, Data Processors

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH, in the presence of Facebook Ireland Ltd (Case C-210/16).

Data Controller

GUIDE TO BASIC ANONYMISATION | PDPC Singapore

Anonymisation

Guidance on Anonymisation and Pseudonymisation | Irish DPC

Anonymisation

Opinion 05/2014 on Anonymisation Techniques | WP216

Anonymisation

Nowak (C-434/16, EU:C:2017:994)

Personal Data

Patrick Breyer v. Germany Case C-582/14, 12 May 2016

Consent, Personal Data

Weltimmo s.r.o. v. Nemzeti Adatvédelmi és Információszabadság Hatóság [2015] Case C-230/14, 1 October 2015

Main Establishment

Records of Processing Activities under Article 30 GDPR | Irish DPC

Records of processing Activities (ROPA)

UK MRC Identifiability, anonymisation and pseudonymisation

Anonymisation

What is Personal Data | UK ICO

Personal Data

WORKING PARTY 29 POSITION PAPER on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR

Records of processing Activities (ROPA)

Records of processing activities template by the CNIL

Records of processing Activities (ROPA)

Guidelines 07/2020 on the concepts of controller and processor in the GDPR

Data Controller, Data Processors, Definitions

Australian Information Commissioner (OAIC): Corporate Plan for 2024-25

Data Processing by the Government, Specific processing situations

Telegram CEO’s Arrest Sparks Debate on Privacy vs. Regulation

Personal Data Collection, Technical and Organisational Measures (TOMs)

The government-wide vision on Generative Al of the Netherlands

AI, Data Processing by the Government, Specific processing situations

Addictive patterns in the processing of personal data Implications for data protection by AEPD

Definitions, Processing of personal data

Salvatore Manni Case C 398/15

Data Retention, Legitimate Interest, Storage limitation

Anonymisation: managing data protection risk code of practice | UK ICO

Anonymisation

Spanish AEPD: 10 MISUNDERSTANDINGS RELATED TO ANONYMISATION

Anonymisation

A Guide to UK GDPR Principles | UK ICO

Accountability, Accuracy, Data minimisation, Integrity and confidentiality, Lawfulness of Processing, Principles, Purpose limitation, Storage limitation, Transparency

Approach to Data Spaces from GDPR Perspective (AEPD)

Data Spaces, Risk Management