It’s important that the requested information is necessary information and proportional.
https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/
Privacy Design Strategies by Jaap-Henk Hoepman (The Little Blue Book)
UK: ICO Guide to Privacy and Electronic Communications Regulations
Cookies, similar technologies, incl. trackers, ..
https://ico.org.uk/for-organisations/guide-to-pecr/
Article: How much is your personal data worth?
Germany: complaint against behavorial advertising
Digitale Gesellschaft e.V./Netzwerk Datenschutzexpertise/Deutsche Vereinigung für Datenschutz e. V./Digitalcourage e. V. Beschwerde bei den deutschen Datenschutz-Aufsichtsbehörden wegen VERHALTENSBASIERTER WERBUNG im Internet und Aufforderung, hierzu Datenschutzleitlinien zu erarbeiten und zu veröffentlichen.
https://www.golem.de/news/datenschutz-massenbeschwerde-gegen-verhaltensbasierte-werbung-1906-141743.html
https://digitalcourage.de/sites/default/files/2019-06/Beschwerde_verhaltensbasierte_Werbung_04062019.pdf
UK: ICO Blog: Why special category personal data needs to be handled even more carefully
“Due to the possible risks, the ICO expects controllers to take all necessary precautions to protect this data and we have published new guidance to help you do this.”
https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/special-category-data/
“Many of the DPA 2018 conditions require you to have an appropriate policy document in place. This is a short document that should outline your compliance measures and retention policies with respect to the data you are processing.”
https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/documentation/
Appropriate policy document template:
https://ico.org.uk/media/for-organisations/documents/2616286/appropriate-policy-document.docx
Full blog article
https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/11/why-special-category-personal-data-needs-to-be-handled-even-more-carefully/
Bavaria: Google Analytics needs consent
Press release – covering “Reichweitenmessung” vs. “Tracking”
Deutsche Wohnen SE – Berlin Commissioner for Data Protection Imposes Fine on Real Estate Company
TeleTrust Technical and Organizational Measures (TOM) – 2019 version
Honestly, I am not sure how good these really are.