Home › Knowledge Hub › Publications
Knowledge HubKey Publications & Reports
Specific, authoritative privacy and data-protection publications worth knowing exist — regulator and expert-body guidance, opinions and recommendations, and recognised research. Grouped by domain. Know one we should add or retire? Tell us.
What's listed: official guidance, opinions and recommendations from regulators and recognised bodies, plus research with a disclosed methodology. What isn't: legislation (see Regulators), standards and frameworks (see Standards & Frameworks), and vendor marketing. Time-sensitive reports are kept for about two years; older editions are retired.
- EU/UK GDPR Core Guidance
- International Data Transfers
- Data Breach & Security
- AI & Automated Decision-Making
- Children's Privacy
- Health & Biometric Data
- Consent & Legitimate Interests
- Data Subject Rights
- Privacy by Design & Engineering
- International Frameworks & Instruments
- Research, Statistics & Archiving
- Marketing, Tracking & Cookies
- Benchmarks & Profession Reports
- Regulator Guidance & Tools
| Issuer | Title | Reference | Year |
|---|---|---|---|
| EDPB | Guidelines on personal data breach notification | Guidelines 01/2021 | 2021 |
| EDPB | Guidelines on the concepts of controller and processor | Guidelines 07/2020 | 2021 |
| EDPB | Guidelines on transparency under Regulation 2016/679 | Guidelines 2/2018 | 2018 |
| EDPB | Guidelines on the territorial scope of the GDPR | Guidelines 3/2018 | 2019 |
| EDPB | Guidelines on data protection by design and by default | Guidelines 4/2019 | 2020 |
| EDPB | Guidelines on the right to erasure | Guidelines 5/2018 | 2019 |
| EDPB | Guidelines on processing of personal data through video devices | Guidelines 3/2019 | 2020 |
| EDPB | Guidelines on purpose limitation | WP203 | 2013 |
| EDPB | Guidelines on Data Protection Officers | WP243 rev.01 | 2017 |
| EDPB | Guidelines on consent under Regulation 2016/679 | WP259 rev.01 | 2018 |
| EDPB | Opinion on the notion of legitimate interests | WP217 | 2014 |
| EDPB | Guidelines on the right of access | Guidelines 01/2022 | 2023 |
| EDPB | Guidelines on the interplay between Article 3 and Chapter V | Guidelines 05/2021 | 2022 |
| ICO | Guide to the UK GDPR | — | 2021 |
| ICO | Accountability and Governance guidance | — | 2020 |
| ICO | Data Protection Impact Assessments guidance | — | 2021 |
| ICO | Records of Processing Activities guidance | — | 2021 |
| EDPB | Guidelines on codes of conduct as tools for transfers | Guidelines 04/2021 | 2022 |
| EDPB | Annual Report 2023 (published 2024) | — | 2024 |
| Issuer | Title | Reference | Year |
|---|---|---|---|
| EDPB | Recommendations on measures that supplement transfer tools | Recommendations 01/2020 | 2021 |
| ICO | International data transfer agreement (IDTA) | — | 2022 |
| ICO | International data transfer addendum to EU SCCs | — | 2022 |
| ICO | Completing a transfer risk assessment, and the TRA tool · Detail page → | Now the “data protection test” (DUAA 2025); updated 15 Jan 2026 | 2026 |
| CNIL (France) | Practical guide: Transfer Impact Assessment · Detail page → | Final version, January 2025; English and French, with template | 2025 |
| EDPB | Recommendations on the European Essential Guarantees | Recommendations 02/2020 | 2020 |
| EDPB | Opinion on the UK adequacy decisions | Opinion 14/2021 | 2021 |
| EDPB | Adequacy referential | WP254 rev.01 | 2018 |
| EDPB | Guidelines on binding corporate rules for processors | Guidelines 07/2022 | 2022 |
| EDPB | Guidelines on binding corporate rules for controllers | Guidelines 05/2022 | 2022 |
| OECD | Declaration on Government Access to Personal Data held by Private Sector Entities | — | 2022 |
| EDPB | Information note on data transfers to the US post-Schrems II | — | 2020 |
| EDPB | Guidelines on the interplay between Article 3 and Chapter V GDPR | Guidelines 05/2021 | 2022 |
| Issuer | Title | Reference | Year |
|---|---|---|---|
| EDPB | Guidelines on personal data breach notification under GDPR | Guidelines 01/2021 | 2021 |
| EDPB | Guidelines on personal data breach notification | WP250 rev.01 | 2018 |
| ENISA | Threat Landscape 2024 | — | 2024 |
| ENISA | Data pseudonymisation: Advanced implementation guide | — | 2022 |
| ENISA | Technical guidelines for the implementation of minimum security measures for DSPs | — | 2017 |
| NIST | Guide to Protecting the Confidentiality of PII | SP 800-122 | 2010 |
| ICO | Guidance on security of personal data | — | 2022 |
| UK NCSC | Cyber Security Toolkit for Boards | — | 2023 |
| IBM / Ponemon Institute | Cost of a Data Breach Report 2024 | — | 2024 |
| Verizon | Data Breach Investigations Report 2024 | DBIR 2024 | 2024 |
| Issuer | Title | Reference | Year |
|---|---|---|---|
| EDPB | Guidelines on automated individual decision-making and profiling | Guidelines 5/2017 | 2018 |
| EDPB | Guidelines on Artificial Intelligence and data protection | Guidelines 02/2024 | 2024 |
| ICO | Guidance on AI and data protection | — | 2023 |
| ICO / Alan Turing Institute | Explaining decisions made with AI | — | 2020 |
| OECD | Recommendation of the Council on Artificial Intelligence | OECD/LEGAL/0449 | 2019 |
| ICO | Data protection and AI auditing framework | — | 2022 |
| Ada Lovelace Institute | Algorithmic Impact Assessment: A Case Study in Healthcare | — | 2022 |
| Ada Lovelace Institute | Examining the Black Box: Tools for Assessing Algorithmic Systems | — | 2020 |
| FPF | Understanding Automated Decisions | — | 2019 |
| ENISA | Artificial Intelligence Cybersecurity Challenges | — | 2021 |
| Issuer | Title | Reference | Year |
|---|---|---|---|
| ICO | Age Appropriate Design Code (Children's Code) | — | 2021 |
| ICO | Children's code guidance and resources | — | 2022 |
| DPC (Ireland) | Children Front and Centre: Fundamentals for a Child-Oriented Approach to Data Processing | — | 2021 |
| CNIL | 8 recommendations to enhance the protection of children online | — | 2021 |
| UNICEF | Children's Online Privacy and Freedom of Expression | — | 2018 |
| FPF | Student Privacy Compass resources | — | 2023 |
| 5Rights Foundation | Risky Business: Children and Online Privacy | — | 2021 |
| ICO | Children's privacy — regulatory approach and strategy | — | 2022 |
| OFCOM | Children's safety online technology guide | — | 2023 |
| EDPB | Statement on Age Assurance | Statement 1/2025 | 2025 |
| Issuer | Title | Reference | Year |
|---|---|---|---|
| EDPB | Guidelines on processing of health data for research | Guidelines 03/2019 | 2019 |
| EDPB | Opinion on the European Health Data Space | Opinion 03/2021 | 2021 |
| EDPB | Guidelines on the use of location data in the context of COVID-19 | Guidelines 04/2020 | 2020 |
| EDPB | Guidelines on processing of genetic data | Guidelines 05/2023 | 2023 |
| EDPB | Guidelines on scientific research under GDPR | Guidelines 1/2026 | 2026 |
| ICO | Special category data guidance | — | 2021 |
| ICO | Guidance on processing health data | — | 2022 |
| ENISA | Pseudonymisation techniques and best practices | — | 2019 |
| WHO | Ethics and Governance of Artificial Intelligence for Health | — | 2021 |
| ENISA | Data protection engineering — from theory to practice | — | 2022 |
| Issuer | Title | Reference | Year |
|---|---|---|---|
| EDPB | Guidelines on consent under Regulation 2016/679 | Guidelines 05/2020 | 2020 |
| EDPB | Guidelines on consent under Regulation 2016/679 | WP259 rev.01 | 2018 |
| EDPB | Opinion on legitimate interest of the data controller | WP217 | 2014 |
| EDPB | Guidelines on the interplay of PSD2 and GDPR | Guidelines 06/2020 | 2020 |
| ICO | Lawful basis for processing guidance | — | 2022 |
| ICO | Consent guidance | — | 2022 |
| ICO | Legitimate interests guidance | — | 2023 |
| EDPB | Opinion on the notion of personal data | WP136 | 2007 |
| EDPB | Guidelines on automated individual decision-making and profiling | WP251 rev.01 | 2018 |
| Issuer | Title | Reference | Year |
|---|---|---|---|
| EDPB | Guidelines on the right of access | Guidelines 01/2022 | 2023 |
| EDPB | 2024 Coordinated Enforcement Action: Implementation of the right of access by controllers (report + national annex) | CEF 2024 report | 2025 |
| EDPB | Guidelines on restrictions under Article 23 of the GDPR | Guidelines 10/2020 | 2021 |
| EDPB | Guidelines on the right to erasure | Guidelines 05/2018 | 2019 |
| ICO | Right of access (subject access request) guidance | — | 2022 |
| ICO | Right to erasure guidance | — | 2021 |
| ICO | Right to data portability guidance | — | 2021 |
| ICO | Right to object guidance | — | 2021 |
| ICO | Exemptions guidance — data subject access requests | — | 2021 |
| EDPB | Guidelines on the right to data portability | WP242 rev.01 | 2017 |
| EDPB | Guidelines on the right to be forgotten in search engines | Guidelines 5/2019 | 2019 |
| EDPB | Interplay of ePrivacy and GDPR concerning individual rights | — | 2021 |
| Issuer | Title | Reference | Year |
|---|---|---|---|
| EDPB | Guidelines on data protection by design and by default | Guidelines 4/2019 | 2020 |
| ENISA | Data protection engineering — from theory to practice | — | 2022 |
| ENISA | Pseudonymisation techniques and best practices | — | 2019 |
| ENISA | Privacy and data protection in mobile applications | — | 2021 |
| ICO | Privacy by design and default guidance | — | 2021 |
| ICO | Guidance on Data Protection Impact Assessments (DPIAs) | — | 2021 |
| FPF | Privacy by Design: Essential Building Blocks | — | 2022 |
| Issuer | Title | Reference | Year |
|---|---|---|---|
| OECD | Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data | — | 2013 |
| UN | Resolution on the right to privacy in the digital age | A/RES/68/167 | 2013 |
| OECD | Recommendation on Health Data Governance | OECD/LEGAL/0433 | 2017 |
| CoE / FRA / EDPS | Handbook on European Data Protection Law | — | 2018 |
| OECD | Declaration on Government Access to Personal Data | — | 2022 |
| G7 | Data Free Flow with Trust (DFFT) — Osaka Track | — | 2019 |
| UNESCO | Recommendation on the Ethics of Artificial Intelligence | — | 2021 |
| Issuer | Title | Reference | Year |
|---|---|---|---|
| EDPB | Guidelines on processing of personal data for scientific research | Guidelines 03/2019 | 2019 |
| EDPB | Guidelines on scientific research under GDPR (updated) | Guidelines 1/2026 | 2026 |
| ICO | Research, public task and official authority guidance | — | 2021 |
| ICO | Anonymisation, pseudonymisation and privacy enhancing technologies guidance | — | 2022 |
| ONS | Data Access and Research — UK statistics authority guidance | — | 2022 |
| UKRI | Policy on open access and research data | — | 2021 |
| EDPB | Opinion on the concept of personal data | WP136 | 2007 |
| ENISA | Recommendations on shaping technology according to GDPR provisions | — | 2018 |
| Issuer | Title | Reference | Year |
|---|---|---|---|
| ICO | Guidance on the use of storage and access technologies (final, updated for the Data (Use and Access) Act 2025; supersedes the earlier cookies guidance) | — | 2026 |
| EDPB | Guidelines on the Technical Scope of Art. 5(3) of the ePrivacy Directive (adopted V2.0) | Guidelines 2/2023 | 2024 |
| EDPB | Report of the work undertaken by the Cookie Banner Taskforce (minimum-threshold positions of the DPAs on banner design and consent) | — | 2023 |
| EDPB | Guidelines on the use of location data and contact tracing tools | Guidelines 04/2020 | 2020 |
| EDPB | Opinion on cookie consent exemption | WP194 | 2012 |
| ICO | Direct marketing guidance | — | 2021 |
| ICO | Guide to Privacy and Electronic Communications Regulations (PECR) | — | 2021 |
| ICO | Live chat and online messaging guidance | — | 2022 |
| EDPB | Guidelines on the use of dark patterns in social media | Guidelines 03/2022 | 2022 |
| CNIL | Cookie depositing conditions | — | 2020 |
| CNIL | GDPR guides for professionals | — | 2022 |
| FPF | Understanding the Digital Advertising Ecosystem | — | 2021 |
| EDPB | Guidelines on the use of personal data in the electoral process | Guidelines 03/2019 | 2019 |
| EDPB | Opinion on online behavioural advertising | WP188 | 2010 |
| Issuer | Title | Reference | Year |
|---|---|---|---|
| IAPP | Privacy Tech Vendor Report 2024 | — | 2024 |
| IAPP | Organizational Digital Governance Report 2024 | — | 2024 |
| IAPP | AI Governance Profession Report 2024 | — | 2024 |
| IAPP-EY | Annual Privacy Governance Report 2024 | — | 2024 |
| Cisco | Data Privacy Benchmark Study 2024 | — | 2024 |
| TrustArc | Global Privacy Benchmarks Report 2024 | — | 2024 |
| ISACA | State of Privacy 2024 | — | 2024 |
| OneTrust DataGuidance | Global Privacy Laws and Regulations Guide | — | 2024 |
Regulator guidance & tools. A curated highlight set of practical, self-assessable frameworks and free tools published by regulators and expert bodies — the material that helps you actually do the work. Links point to each issuer’s own landing page; we host no template files. Gem marks authoritative resources that are under-known. UK first, then EU, then rest of world.
| Issuer | Title | Reference | Year |
|---|---|---|---|
| ICO (UK) | Accountability Framework | Self-assessment across 10 categories, with tracker | — |
| ICO (UK) | Data protection self-assessment (SME toolkit) | Online checklists generating an action report | — |
| ICO (UK) | Data protection audit framework & toolkits | Audit framework across 9 control areas | — |
| EDPB | Common DPIA template (in public consultation, 2026) (Gem) | EDPB standard DPIA template + explainer (in public consultation, 2026) | 2026 |
| EDPB | Website Auditing Tool (Gem) | Free desktop cookie/tracker audit tool — no coding needed; imports WEC evidence | 2024 |
| EDPS | Website Evidence Collector (WEC) & WEC Online (Gem) | Open-source website-inspection tool producing reproducible evidence (CLI + self-hostable web app) | — |
| Datatilsynet (Norway) | Software development with Data Protection by Design & by Default (Gem) | Art. 25 translated into 7 development activities | — |
| CNIL (France) | Privacy Impact Assessment (PIA) 1: Methodology · Detail page → | How to carry out a PIA/DPIA — the approach, actors and workflow; guide 1 of a three-guide suite with templates and a knowledge base, and the method the CNIL’s free PIA software implements (February 2018 edition, English) | 2018 |
| CNIL (France) | Privacy Impact Assessment (PIA) 3: Knowledge bases · Detail page → | A catalogue of controls for treating privacy risks — the reference base behind the CNIL PIA method, usable standalone as a control library in security and DPIA work (February 2018 edition, English) | 2018 |
| CNIL (France) | Open-source PIA software | Free tool for the CNIL PIA/DPIA method | — |
| CNIL (France) | Record of processing activities (model register, Art. 30) | Guidance with a downloadable model register | — |
| DSK / German DPAs | Standard Data Protection Model (SDM) (Gem) | Maps GDPR to 7 protection goals for TOM selection | — |
| AEPD (Spain) | GDPR compliance tools suite (Facilita, Gestiona, Evalúa-Riesgo) (Gem) | Free web tools for ROPA, DPIA-need, breach decisions | — |
| OAIC (Australia) | Privacy Management Framework | Four steps: embed, establish, evaluate, enhance | — |
| OVIC (Victoria, AU) | Privacy Management Framework + self-assessment (Gem) | Maturity self-assessment scoring by category | — |
| IPC NSW (Australia) | Privacy Governance Framework / Privacy Management Plans | Governance framework + PMP guidance | — |
| OPC Canada + AB/BC OIPC | Getting Accountability Right with a Privacy Management Program (Gem) | Joint tri-regulator building-blocks guide | — |
| PCPD (Hong Kong) | Privacy Management Programme: A Best Practice Guide | Commitment, controls and assessment (v2.0) | — |
| OPC New Zealand | Poupou Matatapu (“doing privacy well”) | Expectations-based toolkit across good-practice pillars | — |
| GCPO / Digital.govt.nz (NZ) | Privacy Maturity Assessment Framework (PMAF) | Central-government maturity self-assessment | — |
| PDPC (Singapore) | Guide to Developing a Data Protection Management Programme (DPMP) | Four-step DPMP | 2023 |
| APPA | Guide to Getting Started with Anonymisation | Five-step method for structured datasets, anchored to ISO/IEC 27559, with a worked example. Nine authorities; hosted by PCPD Hong Kong | 2025 |
| AEPD (Spain) | La protección de datos en las relaciones laborales · Detail page → | Data protection across the employment relationship — recruitment, social-media screening, automated sifting, monitoring, worker representation, health surveillance and biometrics at work. Drafted with the Spanish labour ministry, employers’ confederations and trade unions; non-binding; Spanish only | 2025 |
| Autoriteit Persoonsgegevens (Netherlands) | Handreiking scraping door particulieren en private organisaties · Detail page → | Practical handbook on scraping by private organisations and individuals, not limited to AI training — April 2025 edition, Dutch only, summarised in English with the UK position alongside | 2025 |
| CNIL (France), with SIAF | Guide pratique : Les durées de conservation · Detail page → | Method for setting defensible retention periods — the three-phase data lifecycle, conditions for intermediate archiving, a one-page analysis grid, and the sector retention référentiels (HR table 2026). July 2020 edition, French only | 2020 |
| Datatilsynet (Denmark) | Vejledning om tilsyn med databehandlere · Detail page → | How much to check on a processor under Art. 28 — a four-factor point scale and six supervision concepts with a worked example at each level. October 2021, Danish only, summarised in English | 2021 |
| EDPB | Recommendations 1/2026 — Processor Binding Corporate Rules (Art. 47 GDPR) · Detail page → | Draft — adopted for public consultation 15 January 2026; consultation closed 2 March 2026; final version pending. Will replace WP257 rev.01 and WP265 on publication of the final text | 2026 |
| European Commission | Cloud Sovereignty Framework · Detail page → | Eight weighted sovereignty objectives and SEAL-0 to SEAL-4 assurance levels, written for the Commission’s own cloud procurement. Version 1.2.1, October 2025 | 2025 |
| Bank of England, PRA & FCA | Operational resilience: Critical third parties to the UK financial sector (PS16/24) · Detail page → | Rules for critical third parties; four cloud providers designated under SI 2026/777, in force 13 July 2026 | 2024 |
| NCSC (UK) | Supply chain security guidance · Detail page → | Twelve principles in four stages, from knowing your suppliers to building assurance and trust. Reviewed 22 October 2025 | 2018 |
| NIS Cooperation Group (EU) | EU ICT Supply Chain Security Toolbox · Detail page → | A common method to identify, assess and mitigate ICT supply-chain risk, with two sector risk assessments | 2026 |