# Standards and Regulatory References

## Primary Legislation

### GDPR (Regulation (EU) 2016/679)
- **Article 12** — Transparent communication and modalities (response timelines, fee/refusal provisions)
- **Article 15** — Right of access (DSAR)
- **Article 16** — Right to rectification
- **Article 17** — Right to erasure
- **Article 18** — Right to restriction
- **Article 20** — Right to data portability
- **Article 21** — Right to object
- **Article 22** — Automated decision-making rights
- **Recital 59** — Modalities for facilitating the exercise of data subject rights
- **Recital 64** — Identity verification: the controller should use all reasonable measures to verify identity

### CCPA / CPRA (Cal. Civ. Code Section 1798.100 et seq.)
- **Section 1798.130** — Submission, verification, and response procedures
- **Section 1798.105** — Right to delete
- **Section 1798.110** — Right to know
- **Section 1798.120** — Right to opt-out of sale/sharing

### UK Data Protection Act 2018
- **Section 12** — Supplementary provisions for the right to be informed
- **Section 45** — Right of access in law enforcement context

## Regulatory Guidance

### European Data Protection Board (EDPB)
- **Guidelines 01/2022 on data subject rights — Right of access** (adopted 28 March 2023): Comprehensive guidance on intake, verification, processing, and response procedures for access requests, applicable by extension to all data subject rights.
- **Guidelines on Transparency (WP260 rev.01)** (adopted 11 April 2018): Guidance on communication modalities, including multi-channel accessibility.

### Information Commissioner's Office (ICO) — United Kingdom
- **Individual rights guidance** (updated 2024): Practical guidance on handling all data subject rights requests, including verification, timelines, and refusal provisions.

## Technical Standards

### ISO/IEC 27701:2019 — Privacy Information Management
- **Section 7.3** — PII principal rights: establishes the PIMS framework for managing data subject rights requests.

### ISO/IEC 27001:2022 — Information Security Management
- **Annex A Control 5.31** — Legal, statutory, regulatory, and contractual requirements: supports the framework for managing regulatory compliance obligations including data subject rights.

### NIST Privacy Framework v1.0
- **Govern-P, Control-P**: Governance and control functions applicable to managing data subject rights within a privacy programme.