# Standards and Regulatory References — Post-Breach Remediation

## GDPR

- **Art. 5(2)**: Accountability — controller must demonstrate compliance. Remediation documentation supports accountability.
- **Art. 24(1)**: Controller must implement appropriate measures and be able to demonstrate compliance.
- **Art. 32(1)(d)**: Process for regularly testing and evaluating security measures — post-breach remediation validates and improves these measures.
- **Art. 33(3)(d)**: Notification must describe "measures taken or proposed to be taken" — remediation actions committed to in the notification must be implemented.
- **Art. 33(5)**: Documentation must include "remedial action taken" — the remediation register satisfies this.
- **Art. 83(2)(c)**: Mitigating factor in fines: "any action taken by the controller or processor to mitigate the damage suffered by data subjects."
- **Art. 83(2)(f)**: Mitigating factor: "the degree of cooperation with the supervisory authority, in order to remedy the breach and mitigate the possible adverse effects."

## EDPB Guidelines
- **EDPB Guidelines 9/2022 Section 6**: Post-breach measures should be documented and available for SA review.
- **EDPB Guidelines 04/2022 on Administrative Fines**: Sections on mitigating factors emphasize that demonstrable remediation efforts reduce penalty exposure.

## Enforcement Precedents Rewarding Remediation
- **ICO — British Airways (2020)**: Penalty reduced from GBP 183M to GBP 20M partly due to BA's remediation efforts and cooperation.
- **ICO — Marriott (2020)**: Penalty reduced from GBP 99M to GBP 18.4M. ICO considered remediation steps taken by Marriott.
- **AEPD — CaixaBank (2021)**: Remediation efforts were considered but deemed insufficient because they were not comprehensive enough.

## Standards
- **ISO/IEC 27001:2022** — Clause 10.1 (Continual Improvement): Requires organizations to continually improve the ISMS, including through incident remediation.
- **ISO/IEC 27001:2022** — Clause 10.2 (Nonconformity and Corrective Action): Requires corrective action for identified nonconformities, including those arising from breaches.
- **NIST CSF 2.0** — RC.IM (Recover — Improvements): Incident recovery plans incorporate lessons learned.
- **NIST SP 800-61r3** — Section 3.4 (Post-Incident Activity): Covers lessons learned, evidence retention, and using incident data for improving processes.