DP008Data loss prevention policy and tuning

The rules the capability enforces, the thresholds at which it acts, and their revision against what it turned out to catch. Distinct from its deployment because the two are settled separately: in several jurisdictions the workforce is consulted once on bringing the capability in and again on the manner in which it is used, so changing a threshold reopens the question.

Pillar: DP | Data and asset protection
Sources cited: 4
Added: 30 AUGUST 2026
Updated: 30 AUGUST 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
DP008/ATMandatory	Austria	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	The consent that conditions the capability’s legal effect attaches to the measure as it is operated, so rules that alter what it reaches fall to be consented to as the capability itself was.
DP008/DEMandatory	Germany	Betriebsverfassungsgesetz, section 87(1)(6)Bundestag · read 16 Aug 2026	Co-determination by the works council over the introduction and the use of technical devices intended to monitor conduct or performance.	The agreement is owed twice: once on introducing the capability and again on the manner in which it is used, so a change to the rules it enforces reopens it.
DP008/NLMandatory	Netherlands	Wet op de ondernemingsraden, article 27(1)(l)Staten-Generaal · read 16 Aug 2026	Consent of the works council for an arrangement directed at or merely suitable for observing presence, conduct, or performance.	Consent is owed on the arrangement being amended and on its being withdrawn, not only on its adoption, so the rules cannot be revised around the works council.
DP008/ESMandatory	Spain	Ley Orgánica 3/2018, articles 87, 89, and 90Cortes Generales · read 16 Aug 2026	A right to privacy in employer-provided devices, and the express prior information owed before camera images or location data are processed.	The criteria for using the capability are drawn up with the participation of the workers’ representatives, which places the rules themselves, and not only the decision to deploy, inside what is settled with them.