Resources

AI and the audiovisual sector: navigating the current legal landscape by IRIS European Audiovisual Observatory

Harmonised Standards for the European AI Act by EU Commission

AI Principles and Best Practices for Developers and Employers by U.S. DEPARTMENT OF LABOR

Cyber Security Handbook for Small Business and Not-for-Profit Directors by Australian Information Security Association

Technical and Organisational Measures (TOMs)

Data (Use and Access) Bill [HL] Draft

Age-Appropriate Design Toolkit Tracker

Children as data subjects

AI Toolkit Tracker

Personal Data Breach Management and Reporting Toolkit Tracker

Data Breaches

Requests for Access Toolkit Tracker

Access Requests (DSAR)

Data Sharing Toolkit Tracker

Data Sharing

Training and Awareness Toolkit Tracker

Technical and Organisational Measures (TOMs)

Information & Cyber Security Checklist Tracker

Technical and Organisational Measures (TOMs)

Records Management Toolkit Tracker

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Accountability Toolkit Tracker

Accountability

Age Appropriate Design Toolkit Tracker- more information about the Toolkit by UK ICO

Children as data subjects

Artificial Intelligence (AI) Toolkit Tracker – more information about the Toolkit by UK ICO

Data Sharing Toolkit Tracker – more information about the Toolkit by UK ICO

Data Sharing

Information & Cyber Security Checklist Tracker – more information about the Toolkit by UK ICO

Technical and Organisational Measures (TOMs)

Records Management Toolkit Tracker – more information about the Toolkit by UK ICO

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Requests For Access Toolkit Tracker – more information about the Toolkit by UK ICO

Access Requests (DSAR)

Training and Awareness Toolkit Tracker – more information about the Toolkit by UK ICO

Technical and Organisational Measures (TOMs)

Accountability Toolkit Tracker – more information about the Toolkit by UK ICO

Accountability

EU Cyber Resilience Act (CRA)

Technical and Organisational Measures (TOMs)

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg discussion paper on “Legal Foundations in Data Protection for the Use of AI”

AI, Lawfulness of Processing, Legitimate Interest, Specific processing situations

Japan AI Safety Institute’s “Guide to Red Teaming Methodology on AI Safety”

AI, Specific processing situations

Supreme Court of Singapore’s Circular on the Use of GenAI Tools in Court Documents

Data Processing by the Government, Specific processing situations

“The Landscape of Consent Management Tools – A Data Altruism Perspective” by EU Commission

Consent, Lawfulness of Processing

Guidelines on Securing AI Systems by The Cyber Security Agency of Singapore (CSA)

AI, Risk Management, Specific processing situations

Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive Version 2.0 by EDPB

New technology

AIPact by the European Artificial Intelligence Office

AI, Data Subjects Rights, Specific processing situations

The EU’s International Cooperation on Cyber Capacity Building| second edition

Technical and Organisational Measures (TOMs)

Cyber Threat Modelling for Risk Assessment by CSB

Risk Management, Technical and Organisational Measures (TOMs)

Guide to Good Governance in Cybersecurity by DCSD

Technical and Organisational Measures (TOMs)

ENISA Threat Landscape 2024 EU Agency for Cybersecurity

Technical and Organisational Measures (TOMs)

Chief Information Security Officer_ HANDBOOK

Risk Management

National Strategy on AI by Sri Lanka

AI, Lawfulness of Processing, Specific processing situations

The Future of European Competitiveness by EU Commission

AI, New technology, Specific processing situations

Belgian DPA General Secretariat Artificial intelligence systems and the RGPD from a data protection perspective

AI, Lawfulness of Processing, Principles, Specific processing situations, Transparency

Privacy Impact Assessment (PIA) Templates by CNIL

Data Protection Impact Assessment (DPIA)

NIST Special Publication NIST SP 800-221A_Information and Communications Technology (ICT) Risk Outcomes Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio

Risk Management

Artificial Intelligence and Machine Learning in Health Care and Medical Sciences Best Practices by Pitfalls Gyorgy J. Simon Constantin Aliferis Springer

AI, Health Data, Principles, Sensitive Data, Specific processing situations

Report and Guidance on Privacy in Social Network Services – ”Rome Memorandum” by International Working Group on Data Protection in Telecommunications

Definitions, Processing of personal data

ENFORCEMENT ADVISORY NO. 2024-02 by CALIFORNIA PRIVACY PROTECTION AGENCY AVOIDING DARK PATTERNS: CLEAR AND UNDERSTANDABLE LANGUAGE, SYMMETRY IN CHOICE

Data Subjects Rights

National Strategy to Advance Privacy-Preserving Data Sharing and Analytics by the EO by the US President

Anonymisation, Controllers and Processors, Technical and Organisational Measures (TOMs)

Rethinking Privacy in the AI Era | White Paper by Stanford University

AI, Specific processing situations

EO 13800 on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

Controllers and Processors, Technical and Organisational Measures (TOMs)

THE NEW STANDARD CONTRACTUAL CLAUSES – QUESTIONS AND ANSWERS

Data Transfers, Standard Contractual Clauses (SCC)

A pro-innovation approach to AI regulation by UK ICO

AI, Specific processing situations

Comparison of U.S. State Privacy Laws. Data Protection Assessments by CIPL

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Biometric Data Guidance by the UK ICO

Principles, Sensitive Data

DRAFT RISK ASSESSMENT REGULATIONS FOR CALIFORNIA PRIVACY PROTECTION AGENCY

Risk Management

GDPR: a culture of non-compliance? Numbers of evidence-based enforcement efforts by nyob

Liability and Remedies, Supervisory Authorities

Analysis of the final compromise text of the EU AI Act with a view to agreement by the Belgian Presidency

AI, Specific processing situations

International Data Transfer Agreements – Transitional Provisions

Data Transfers

Transfer Risk Assessment Tool by the UK ICO

Data Transfers

Transfer Impact Assessment (TIA) Template by HSE

Data Transfers

Datenschutzkonforme Künstliche Intelligenz Checkliste mit Prüfkriterien nach DS-GVO

AI, Specific processing situations

Recommendations 02/2020 on the European Essential Guarantees for surveillance measures

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

[UK] International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Data Transfers

[UK] Standard Data Protection Clauses to be issued by the Commissioner under S119A(1) Data Protection Act 2018

Data Transfers

Guide to Technical and Organisational Data Protection Measures (TOM) by the Swiss FDPIC

Controllers and Processors, Technical and Organisational Measures (TOMs)

EU DATA ACT

[PROPOSAL 2024] EU AI ACT

AI, Specific processing situations

Artificial Intelligence Strategy of the CJEU

AI, Specific processing situations

GUIDELINES CLOCKING AND ATTENDANCE CONTROL PROCESSING USING BIOMETRIC SYSTEMS BY THE AEPD

Employment, Principles, Sensitive Data, Specific processing situations

Report on the first review of the functioning of the adequacy decisions adopted pursuant to Article 25(6) of Directive 95/46/EC

Adequacy Decisions, Data Transfers

Guide to Binding Corporate Rules by the UK ICO

Data Transfers

Processing Personal Data on the Basis of Legitimate Interests under the GDPR by FPF

Lawfulness of Processing, Legitimate Interest

Interim Report – Governing AI for Humanity by UN AI Advisory Body

AI, Specific processing situations

AI fairness in practice by the Alan Turing Institute

AI, Specific processing situations

[Draft] Transfer Impact Assessment by the CNIL

Data Transfers

Privacy Notice Template by the UK ICO

Data Subjects Rights

How to handle someone’s data subject access request when there is information about other individuals involved by the Irish DPA

Access Requests (DSAR), Data Subjects Rights

[DRAFT] FRAMEWORK CONVENTION ON ARTIFICIAL INTELLIGENCE, HUMAN RIGHTS, DEMOCRACY AND THE RULE OF LAW

AI, Specific processing situations

RISK FRAMEWORK FOR BODY-RELATED DATA IN IMMERSIVE TECHNOLOGIES BY FPF

Principles, Sensitive Data

A Guide to Cookies and Compliance by DMA

Consent, Cookies, Lawfulness of Processing

International data transfer agreement and guidance by the UK ICO

Data Transfers

Annex: A summary of the Transparency in Health and Social Care guidance impact assessment by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

Transparency in health and social care by the UK ICO

Controllers and Processors, Data Protection Impact Assessment (DPIA), Principles, Sensitive Data, Transparency

GUIDELINES ON LEGITIMATE INTEREST by the NPC of the Republic of Philippines

Lawfulness of Processing, Legitimate Interest

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL LAYING DOWN HARMONISED RULES ON ARTIFICIAL INTELLIGENCE (ARTIFICIAL INTELLIGENCE ACT)

AI, Specific processing situations

European Commision press release on AI Act Agreement

AI, Specific processing situations

Privacy-Enhancing and Privacy Preserving Technologies: Understanding the Role of PETs and PPTs in the Digital Age by CIPL

Controllers and Processors, Technical and Organisational Measures (TOMs)

Cybersecurity of Artificial Intelligence in the AI Act by the European Commision

Controllers and Processors, Technical and Organisational Measures (TOMs)

New rules for Artificial Intelligence – Questions and Answers by the European Commision

AI, Specific processing situations

Understanding the Role of PETs and PPTs in the Digital Age

Controllers and Processors, Technical and Organisational Measures (TOMs)

Guidelines on submission of signals under the Whistleblowing directive by the Bulgarian CPDP

Whistleblowing

[Draft] Guidelines on the processing of personal data in regard to recruitment by the UK ICO

Automated Decision-making, Controllers and Processors, Data Protection Impact Assessment (DPIA), Employment, Specific processing situations

[DRAFT] Data Confidentiality – Identifying and Protecting Assets Against Data Breaches by NIST

Controllers and Processors, Data Breaches

[Draft] Guidelines on the processing of personal data in regard to employment by the UK ICO

Employment, Specific processing situations

Everything Recruiters Need to Know About GDPR by ZOHO

Employment, Specific processing situations

SME Guide on Information Security Controls by European Digital SME Alliance

Controllers and Processors, Technical and Organisational Measures (TOMs)

AI Act Provisional Agreement Press Release

AI, Specific processing situations

Guidelines issued by the Malta Gaming Authority for the Maltese Gaming Industry

Gaming, Specific processing situations

Practical Guide on Controller to Processor Contracts by the Irish DPC

Controllers and Processors, Data Processing Agreement (DPA)

Privacy Impact Assessment Tool by the Australian Government

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Guidelines for evaluating differential priavacy gurantees by NIST

Anonymisation, Controllers and Processors, Technical and Organisational Measures (TOMs)

Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence (PROPOSED MEMORANDUM )

AI, Specific processing situations

PRACTICAL GUIDANCE FOR THE USE OF GENERATIVE ARTIFICIAL INTELLIGENCE IN THE PRACTICE OF LAW by State Bar of California

AI, Specific processing situations

GDPR guidance: Legitimate Inerersts Assessments (LIA) for Digital Advertising

Lawfulness of Processing, Legitimate Interest, Marketing and Advertising, Specific processing situations

The impact of the General Data Protection Regulation (GDPR) on artificial intelligence by the EU Parliamnet

AI, Specific processing situations

Benefits and Risks of Generative Artificial Intelligence Report by the State of California

AI, Specific processing situations

AUTOMATED DECISIONMAKING TECHNOLOGY REGULATIONS (DRAFT) by CPPA

Automated Decision-making, Controllers and Processors

Guidelines for secure AI system development by UK NCSC and US CISA

AI, Specific processing situations

Guidance on the Use of CCTV – For Data Controllers by the Irish DPC

CCTV, Specific processing situations

Artificial intelligence for healthcare and well-being during exceptional times | European Commision

Generative AI: The Data Protection Implications by CEDPO

AI, Specific processing situations

Exceeding customer expectations by Google

Principles, Privacy by Design

Global Toolkit on AI and the Rule of Law for the Judiciary by UNESCO

AI, Specific processing situations

TOWARDS A SUSTAINABLE, MULTILATERAL, AND UNIVERSAL SOLUTION FOR INTERNATIONAL DATA TRANSFER by the UK Government

Data Transfers

DPIA for AI template

Controllers and Processors, Data Protection Impact Assessment (DPIA)

AI Privacy Policy template

AI, Specific processing situations

COMMON GUIDEPOSTS TO PROMOTE INTEROPERABILITY IN AI RISK MANAGEMENT | German Ministry of labor and social Affairs

AI, Specific processing situations

Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive by EDPB

Consent, Lawfulness of Processing

Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence by the US President

AI, Specific processing situations

Online Safety Bill | UK

Automated Decision-Making Under the GDPR by the FPF

AI, Automated Decision-making, Controllers and Processors, Specific processing situations

Protection of workers’ personal data: General principles by ILO

Employment, Specific processing situations

Study on the essence of the fundamental rights to privacy and to protection of personal data by EDPS

Data Subjects Rights

AI and Data Protection Risk Toolkit by UK ICO

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

Audit Requirements for Personal Data Processing Activities involving AI by AEPD

Controllers and Processors, Data Protection Impact Assessment (DPIA), Technical and Organisational Measures (TOMs)

Child oriented approach to data processing by DPC Ireland

Children as data subjects, Data Subjects Rights

Bulgarian CPPD Newsletter

Children as data subjects, Controllers and Processors, Data Subjects Rights, Technical and Organisational Measures (TOMs)

DSAR management for controllers by Bailiwick of Guernsey’s DPA

Access Requests (DSAR), Data Subjects Rights

Human rights Impact Assessments for AI

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Description of the dataset template by CNIL

AI, Specific processing situations

Drones and Data Protection Guidelines by AEPD

Drones, Specific processing situations

AI How-to Sheets by CNIL

AI, Specific processing situations

Mobile Privacy Disclosures by the FTC

Data Subjects Rights, Right to know

Data breach preparation and response by the Australian Information Commisioners

Controllers and Processors, Data Breaches

Artificial intelligence and the Information Privacy Principles by the Privacy Commisioner (New Zealand)

AI, Specific processing situations

Government access to datain third countries

Data Processing by the Government, Specific processing situations

Decision of the Data Protection Commission made pursuant to Section 111 of the DPA, 2018 and Articles 60 and 65 of the GDPR

Fairness, Liability and Remedies, Principles, Supervisory Authorities

Practice Guide to Anonymising Personal Data

Anonymisation, Controllers and Processors

Data Breach Process Guidance by HSE

Controllers and Processors, Data Breaches

Public Benefit and Privacy Panel for Health and Social Care (Guidance for applicants)

Health Data, Principles, Sensitive Data

How to use AI and personal data

AI, Specific processing situations

Data protection and monitoring workers

Employment, Specific processing situations

One-Stop-Shop thematic case digest: RIGHT TO OBJECTAND RIGHT TO ERASURE

Data Subjects Rights, Right to Erasure, Right to Object

Study on the appropriate safeguards under Article 89(1) GDPR for the processing of personal data for scientific research

Material scope, Scientific Research, Specific processing situations

Study on the national administrative rules impacting the cooperation duties for the national supervisory authorities

Supervisory Authorities

Guidelines 01/2023 on Article 37 Law Enforcement Directive

Data Transfers

Recommendations 1-2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR)

Code of Conduct, Controllers and Processors

Demonstration of a privacy-preserving age verification process by CNIL

Children as data subjects, Data Subjects Rights

Voluntary AI Safety Standard by the Australian Government

AI, Specific processing situations

Safe and responsible AI in Australia Proposals paper for introducing mandatory guardrails for AI in high-risk settings by Australian Government

AI, Specific processing situations

Frequently Asked Questions (FAQs) on the Data Act by the EU Commission

Controllers and Processors, Data Sharing

Multidisciplinary Perspectives on Artificial Intelligence and the Law by Springer

AI, Specific processing situations

UNESCO: Consultation paper on AI Regulation

AI, Lawfulness of Processing, Public Interests, Specific processing situations

Saudi Data & Artificial Intelligence Authority: Rules governing the appointment of Personal DPOs under the Kingdom of Saudi Arabia’s (KSA) Personal Data Protection Law (PDPL)

AI, Specific processing situations

Briefing EU Legislation in Progress by EPRS on AI Act

AI, Specific processing situations

GDPR in practice – Experiences of data protection authorities by FRA

Data Processing by the Government, Specific processing situations

Effective Cyber Risk Management: A best practice governance guide for digitally secure and resilient organisations by Governance Institute of Australia

Risk Management, Technical and Organisational Measures (TOMs)

Online age verification: balancing privacy and the protection of minors by CNIL

Children as data subjects, Data Subjects Rights

Online age verification: balancing privacy and the protection of minors by CNIL | French

Children as data subjects, Data Subjects Rights

Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on adapting non-contractual civil liability rules to artificial intelligence (AI Liability Directive)

AI, Liability and Remedies, Specific processing situations, Supervisory Authorities

NIST Special Publication_1800: Implementing a Zero Trust Architecture

Technical and Organisational Measures (TOMs)

ON THE ANTITRUST IMPLICATIONS OF EMBEDDING GENERATIVE AI IN CORE PLATFORM SERVICES BY SSRN

AI, Specific processing situations

Policy for the responsible use of AI in government by Australian Government

AI, Data Processing by the Government, Specific processing situations

Consumer Protection in respect of Use of Generative Artificial Intelligence by Hong Kong Monetary Authority

AI, Specific processing situations

The State of Artificial Intelligence in the Pacific Islands

AI, Specific processing situations

UK ICO Privacy Policy Generator

Data Subjects Rights

Conformally Privacy Policy Generator

Data Subjects Rights

KOSPA Passed by Senate: Strengthening Online Protections for Children and Teens

Data protection code of practice for digital identity schemes in Afrtica

Code of Conduct, Controllers and Processors

Relying on the legal basis of legitimate interests to develop an AI system by CNIL

Lawfulness of Processing, Legitimate Interest

Website privacy controls a guide for business by New York State Attorney General

Data Subjects Rights

Data protection compliant AI by Bavarian State Office for Data protection Supervision

AI, Specific processing situations

NIST Special Publication_1800-29 Data Confidentiality- Detect, Respond to, and Recover from Data Breaches

Controllers and Processors, Data Breaches

CNIL open source PIA software – data protection impact assessment

Data Protection Impact Assessment (DPIA)

Confidential Computing and Privacy: Policy Implications of Trusted Execution Environments by Future of Privacy Forum

AI, Specific processing situations

Frequently Asked Questions (FAQ) NIS2 in Belgium by Centre for cybersecurity Belgium

Technical and Organisational Measures (TOMs)

Formal Opinion 512 on Generative Artificial Intelligence Tools by AMERICAN BAR ASSOCIATION

AI, Specific processing situations

Today’s and tomorrow’s means of payment facing the challenge of data protection by CNIL

Definitions, Processing of personal data

Artificial Intelligence and Algorithms in Risk Assessment by the European Labour Authority

Risk Management

PRIVACY ENHANCING TECHNOLOGY (PET): PROPOSED GUIDE ON SYNTHETIC DATA GENERATION BY PDPC

Principles, Sensitive Data

ENFORCEMENT ADVISORY NO. 2024-01 APPLYING DATA MINIMIZATION TO CONSUMER REQUESTS BY CALIFORNIA PRIVACY PROTECTION AGENCY

Data minimisation, Principles

Global Third Party Cybersecurity Breaches by SecurityScorecard

Controllers and Processors, Data Breaches

Data protection impact assessment for AI Solutions by Danish DPA

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

GDPR & Generative AI A Guide for Customers by Microsoft

AI, Specific processing situations

Principles on Children & Online Gaming Adopted at the Nordic Data Protection Meeting in Oslo 30 May 2024

Children as data subjects, Data Subjects Rights

DECISION OF THE INFORMATION COMMISSIONER Snap Inc. and Snap Group Limited

AI, Specific processing situations

Artificial intelligence (AI) and human rights: Using AI as a weapon of repression and its impact on human rights by EU Parliament

AI, Specific processing situations

GDPR in practice: Experience of data protection authorities by FRA

Data Processing by the Government, Specific processing situations

Orientations for ensuring data protection compliance when using Generative AI systems by EDPS

AI, Specific processing situations

Guidance document on how to approach the protection of personal data and commercially confidential information while using the Clinical Trials Information System (CTIS) Version 2 by EMA

Data Subjects Rights

Guidelines 01/2023 on Article 37 Law Enforcement Directive by EDPB

Data Transfers

Convention on AI, Human Rights, Democracy and the Rule of Law – by the Council of Europe (draft)

AI, Specific processing situations

Information note by EDPB on data transfers under the GDPR to the United States after the adoption of the adequacy decision on 10 July 2023

Adequacy Decisions, Data Transfers

Regulating targeted and behavioural advertising in digital services by EU Parliament

Marketing and Advertising, Specific processing situations

Data protection impact assessment on the processing of personal data on government Facebook Pages

Controllers and Processors, Data Protection Impact Assessment (DPIA)

The Standard Data Protection Model Version 3.0a by the Conference of Independent Federal and State Data Protection Supervisory Authorities Germany

GDPR & GENERATIVE AI – A GUIDE FOR THE PUBLIC SECTOR BY MICROSOFT

AI, Specific processing situations

Comments on Guidelines 07/2020 on the concepts of controller and processor in the GDPR from the perspective of the Translation and Interpreting Sector by FIT Europe and EUATC

Controllers and Processors

Controller – Processor Assessment Tool

Controllers and Processors

Guidelines scraping by private organizations and individuals by the Dutch Data Protection Authority

Automated Decision-making, Controllers and Processors

Orientation guide of the Conference of Independent Federal and State Data Protection Supervisory Authorities by the German Data Protection Conference (DSK)

AI, Specific processing situations

A Guide to ICO Audit Artificial Intelligence (AI) Audits by UK ICO

AI, Specific processing situations

Guideline on the massive collection of personal data from the web for the training of generative artificial intelligence (GenAI) models by the Italian Data Protection Authority (Garante)

AI, Data scraping, Specific processing situations

Information Note by EDPB on the redress mechanism for EU/EEA individuals in relation to alleged violations of U.S. law with respect to their data collected by U.S authorities competent for national security

Adequacy Decisions, Data Transfers

EU-US Data Privacy Framework Template Complaint Form for Submitting Commercial Related Complaints to EU DPAs by EDPB

Adequacy Decisions, Data Transfers

REGULATION (EU) 2024/900 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 13 March 2024 on the transparency and targeting of political advertising

Marketing and Advertising, Specific processing situations

Generative Artificial Intelligence Risk Assessment by State of California Department of Technology

AI, Risk Management, Specific processing situations

Perspectives on Issues in AI Governance by Google

AI, Specific processing situations

Personal data breach report form

Controllers and Processors, Data Breaches

Data Sharing Code of Practice by UK ICO [Controller to Controller]

Controllers and Processors, Data Sharing

PRACTICE GUIDE SECURITY OF PERSONAL DATA Version 2024 by CNIL

Definitions, Personal Data

Deploying AI Systems Securely by NSA

AI, Specific processing situations

Data Protection Fining Guidelines by UK ICO

Liability and Remedies, Supervisory Authorities

ЕО Order on Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern

Certified Data Protection Officer by PECB

Data Protection Officer (DPO)

EO 13800 on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure

Technical and Organisational Measures (TOMs)

Artificial Intelligence and Privacy

Zapier’s Transfer Impact Assessment

Data Transfers

Transfer Impact Assessment (TIA)

Data Transfers

Handling vexatious requests under FOIA by the UK ICO

Federal Data Protection Act (Germany)

Practice Guide to Anonymising Personal Data by Stiftung Dateschutz

Anonymisation

Human rights Impact Assessments for AI by Access Now

AI, Data Protection Impact Assessment (DPIA)

GenAI and data protection: how organisations and their employees can use it appropriately and lawfully

AI, Employment

How to deal with SARs as an employer by the UK ICO

Access Requests (DSAR), Employment

DIRECTIVE (EU) 2016/680 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (Law Enforcement Directive)

REGULATION (EU) 2022/868 (Data Governance Act)

REGULATION (EU) 2022/1925 (Digital Markets Act)

DIRECTIVE (EU) 2019/1937 on the protection of persons who report breaches of Union law (Whistleblower Directive)

Whistleblowing

Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines | NIST

Guidance Note: Employer Vehicle Tracking | Irish DPC

Employment

GUIDE TO BASIC ANONYMISATION | PDPC Singapore

Anonymisation

Guidance on Anonymisation and Pseudonymisation | Irish DPC

Anonymisation

Directive 2002/58/EC on privacy and electronic communications

REGULATION (EU) 2018/1725 “GDPR for EU Institutions”

Directive (EU) 2016/1148 “NIS2 Directive”

UK Data Protection Act 2018

European Convention on Human Rights

Federal Act on Data Protection (Switzerland)

EU AI Act

Personal Information Protection and Electronic Documents Act (PIPEDA, CANADA)

Personal data protection law (Saudi Arabia)

Information note on data transfers under the GDPR to the US | EDPB

Data Transfers

UK MRC Identifiability, anonymisation and pseudonymisation

Anonymisation

What is Personal Data | UK ICO

Personal Data

Data Subjects Rights | UK ICO

Data Subjects Rights

Data Protection and Journalism | UK ICO

Freedom of expression and information

Records of Processing Activities under Article 30 GDPR | Irish DPC

Records of processing Activities (ROPA)

Connecticut Data Privacy Act

Utah Consumer Privacy Act

How to manage DPIAs by Data Protection Network (DPN)

Data Protection Impact Assessment (DPIA)

Joint Guide to ASEAN MCC and EU SCC

Data Transfers, Standard Contractual Clauses (SCC)

Data Protection Impact Assessments (DPIA) Template by UK ICO

Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessment (DPIAs) by APDCAT

Data Protection Impact Assessment (DPIA)

GDPR Risk Assessment by the AEPD

Data Protection Impact Assessment (DPIA)

WORKING PARTY 29 POSITION PAPER on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR

Records of processing Activities (ROPA)

Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679

Automated Decision-making

Guide to Data Protection Impact Assessments by PDPC Singapore

Data Protection Impact Assessment (DPIA)

Guide to Data Protection Impact Assessments (DPIAs) by the Irish DPC

Data Protection Impact Assessment (DPIA)

Guidance on ai and data protection 2.0 | UK ICO

Children and the GDPR | UK ICO

Children as data subjects

Data Sharing Code | UK ICO

Data Processing Agreement (DPA)

Guide to Accountability and Governance | UK ICO

Accountability

Guidance on Video Surveillance | UK ICO

CCTV

CALIFORNIA CONSUMER PRIVACY ACT REGULATIONS

Privacy Impact Assessment (PIA) Methodology by CNIL

Data Protection Impact Assessment (DPIA)

Data Protection Code of Conduct for Cloud Infrastructure Service Providers

Cloud Services

Members of the Code of Conduct for Cloud Infrastructure Service Providers

Code of Conduct

Records of processing activities template by the CNIL

Records of processing Activities (ROPA)

Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679

Data Transfers

Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Knowledge Bases by CNIL

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Methodology Mindmap by CNIL

Data Protection Impact Assessment (DPIA)

Elaboration of the Code of Conduct for Cloud Infrastructure Service Providers (CNIL)

Cloud Services

Privacy Impact Assessment – Internet of Things Devices (CNIL)

Data Protection Impact Assessment (DPIA)

Guidelines on Data Protection Officers (‘DPOs’)

Data Protection Officer (DPO)

Guidelines on transparency under Regulation 2016/679

Transparency

Guidelines 01/2021 on Examples regarding Personal Data Breach Notification

Data Breaches

Guidelines 10/2020 on restrictions under Article 23 GDPR

Data Subject Rights Restrictions, Data Subjects Rights

Guidelines 07/2020 on the concepts of controller and processor in the GDPR

Data Controller, Data Processors, Definitions

Guidelines 02/2021 on virtual voice assistants

Voice Assistants

Guidelines 8/2020 on the targeting of social media users

Data Subjects Rights

Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679

Data Subjects Rights, Right to Object

Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications

Connected Vihicles

Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies

Data Transfers

Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default

Privacy by Design

Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR

Right to Erasure

Guidelines 05/2020 on consent under Regulation 2016/679

Consent, Lawfulness of Processing

Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak

Health Data

Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak

Health Data

Guidelines 3/2019 on processing of personal data through video devices

CCTV

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

Territorial Scope

Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects

Performance of Contract

Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679

Code of Conduct

Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation

Certification

Guidelines 4/2018 on the accreditation of certification bodies under Article 43 of the General Data Protection Regulation (2016/679)

Certification

CCPA Full Text

Cookies Instructions Kit by DMA Italy, FedoWEB et al.

Consent, Cookies

How Google Uses Information on websites [link]

CIPL Examples of Legitimate Interest Grounds for Processing of Personal Data [PDF] [Official Guidelines]

Lawfulness of Processing, Legitimate Interest

Guidance on the rules on use of cookies and similar technologies [pdf] [Official Guidelines]

Consent, Cookies

Guidelines 9/2022 on personal data breach notification under GDPR [Official EDPB Guidelines] [pdf]

Data Breaches

Guidelines 04/2022 on the calculation of administrative fines under the GDPR

Liability and Remedies

Guidelines 03/2021 on the application of Article 65(1)(a) GDPR

Supervisory Authorities

Guidelines 8/2022 on identifying a controller or processor’s lead supervisory authority

Supervisory Authorities

Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement

Guidelines 01/2022 on data subject rights – Right of access

Data Subjects Rights

Guidelines 07/2022 on certification as a tool for transfers

Certification

Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR

Territorial Scope

Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them

Privacy by Design

Guidelines 06/2022 on the practical implementation of amicable settlements

Guidelines 04/2021 on Codes of Conduct as tools for transfers

Data Transfers

Australian Information Commissioner (OAIC): Corporate Plan for 2024-25

Data Processing by the Government, Specific processing situations

AT&T Privacy Notice

Data Subjects Rights

AI models collapse when trained on recursively generated data

AI, Specific processing situations

The government-wide vision on Generative Al of the Netherlands

AI, Data Processing by the Government, Specific processing situations

AI Possible Risks & Mitigations Optical Character Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

AI Possible Risks & Mitigations Named Entity Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

The 10-Step Plan for Solid Privacy Compliance Based On The Most Common Fines

5310-C Privacy Threshold Assessments and Privacy Impact Assessments by Office of Information Security

Controllers and Processors, Data Protection Impact Assessment (DPIA)

THE INTERSECTION BETWEEN COMPETITION AND DATA PRIVACY by OECD – OCDE

Data Subjects Rights

Supervision of AI systems in the EU by Dutch DPA and RDI (english)

AI, Specific processing situations

Statement on the interplay between AI Act and GDPR for private sector by the The Austrian DPA

AI, Specific processing situations

The Colorado AI Act “Senate Bill SB24-205”

AI, Specific processing situations

Review of cybersecurity news in Ukraine, tendencies, and world events related to the First World Cyber War by U.S. Agency for International Development

National Security, Specific processing situations

Rules of Procedure by EDPB on the cooperation and respective roles of national SAs and the EDPB Secretariat regarding the submission of complaints in the redress mechanism available to EU individuals in relation to alleged violations of U.S law with respect to their data collected by U.S. authorities competent for national security

Adequacy Decisions, Data Transfers, Risk Management

Automated Decision-Making in Online Platforms: Protection Against Discrimination and Manipulation of Behavior

Automated Decision-making, Controllers and Processors

Rules of Procedure for the “Informal Panel of EU DPAs”according to the EU-US Data Privacy Framework by EDPB

Adequacy Decisions, Data Transfers

Template Complaint Form to the U.S. Office of the Director of National Intelligence’s Civil Liberties Protection Officer (CLPO) by EDPB

Adequacy Decisions, Data Transfers

American Privacy Rights Act Discussion Draft

The American Privacy Rights Act (APRA) section-by-section draft

Technical and organisational measures signed by Superhosting.bg

Controllers and Processors, Technical and Organisational Measures (TOMs)

Technical and Organizational Measures by Adobe Cloud Services

Controllers and Processors, Technical and Organisational Measures (TOMs)

Privacy Program 247.ai

(NEW JERSEY) ACT concerning [commercial Internet websites] online, services, consumers, and [personally identifiable information] personal data and supplementing Title 56 of the Revised Statutes

Technical Recommendations on the use of APIs by CNIL

Controllers and Processors, Technical and Organisational Measures (TOMs)

[UK] International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Data Transfers

[UK] International Data Transfer Agreements – Transitional Provisions

Data Transfers

American Data Privacy And Protection Act (DRAFT)

Senate Bill 262 (Delete Act)

Building a Cybersecurity and Privacy Learning Program | NIST | Initial Public Draft

Data Breaches, Employment, Risk Management, Technical and Organisational Measures (TOMs)

Anonymisation: managing data protection risk code of practice | UK ICO

Anonymisation

Spanish AEPD: 10 MISUNDERSTANDINGS RELATED TO ANONYMISATION

Anonymisation

THE DIGITAL PERSONAL DATA PROTECTION ACT (INDIA)

Board of Directors Handbook for Cloud Risk Governance | Google

Governance

A Guide to UK GDPR Principles | UK ICO

Accountability, Accuracy, Data minimisation, Integrity and confidentiality, Lawfulness of Processing, Principles, Purpose limitation, Storage limitation, Transparency

A Guide to Lawful Basis | UK ICO

Consent, Lawfulness of Processing, Legal Obligation, Legitimate Interest, Performance of Contract, Public Interests, Vital Interests

The Employment Practices Code | UK ICO

Data Subjects Rights, Employment

Consumer Data Protection Act (Virginia CDPA)

Colorado Privacy Act

Risk Management and Impact Assessment (DPIA) by AEPD

Data Protection Impact Assessment (DPIA)

Approach to Data Spaces from GDPR Perspective (AEPD)

Data Spaces, Risk Management

GDPR Data Incidents – The Step-by-Step Playbook for Effective Response

Data Breaches