# Standards and References

## GDPR
- Art. 35(1): DPIA requirement when processing likely results in high risk.
- Art. 35(3)(a)-(c): Specific triggers — profiling, large-scale special categories, systematic monitoring.
- Art. 35(7)(a)-(d): Minimum DPIA content requirements — description, necessity/proportionality, risk assessment, mitigation measures.
- Art. 35(9): Seeking views of data subjects where appropriate.
- Art. 36: Prior consultation with supervisory authority when residual risk remains high.
- Recital 84: DPIA should be carried out prior to processing to assess particular likelihood and severity of high risk.
- Recital 90: DPIA should contain measures, safeguards, and mechanisms to mitigate risk and demonstrate compliance.

## EDPB / WP29 Guidance
- WP248rev.01 (Guidelines on DPIAs): Criteria for acceptable DPIA methodologies, nine screening criteria, examples of processing requiring DPIA.
- WP248rev.01 Annex 2: Criteria that an acceptable DPIA methodology must satisfy (maps to Art. 35(7) requirements).
- EDPB Opinion 5/2019: Interaction between ePrivacy Directive and GDPR in DPIA context.

## CNIL PIA Methodology
- CNIL PIA Guides (2018): Guide 1 — PIA Methodology; Guide 2 — PIA Templates; Guide 3 — Knowledge Bases.
- CNIL Deliberation 2018-327: Ten criteria for an acceptable DPIA methodology.
- CNIL PIA Software Tool: Open-source application implementing the CNIL methodology (available on GitHub).
- CNIL Catalogue of Good Practices: Mapping of security controls to feared events.

## ICO DPIA Guidance
- ICO DPIA Guidance (2018, updated 2021): Step-by-step guidance for conducting DPIAs under UK GDPR.
- ICO DPIA Template: Downloadable Word template implementing the 7-step process.
- ICO DPIA Screening Checklist: Checklist to determine whether DPIA is required.
- ICO List of Processing Requiring DPIA: UK-specific mandatory DPIA list under Art. 35(4).

## NIST Privacy Framework
- NIST Privacy Framework Version 1.0 (January 2020): Core, Profiles, Implementation Tiers.
- NIST PF Quick Start Guide: Introduction to framework adoption.
- NIST SP 800-122: Guide to Protecting the Confidentiality of PII.
- NIST AI RMF (AI 100-1): AI Risk Management Framework with privacy considerations.
- NIST CSF 2.0: Cybersecurity Framework aligned with Privacy Framework.

## ISO/IEC Standards
- ISO/IEC 29134:2017: Guidelines for Privacy Impact Assessment.
- ISO/IEC 29100:2011: Privacy framework (terminology and principles referenced by 29134).
- ISO/IEC 27701:2019: Privacy information management — extension to ISO 27001 and ISO 27002.
- ISO/IEC 27001:2022: Information security management systems — requirements.
- ISO 31000:2018: Risk management — guidelines (risk framework referenced by ISO 29134).
- ISO/IEC 29151:2017: Code of practice for PII protection (aligned with 29134 risk treatment).

## Other National Methodologies (for reference)
- AEPD (Spain): Guia para la Gestion del Riesgo y Evaluacion de Impacto en los tratamientos de datos personales.
- Garante (Italy): Template for DPIA based on WP248rev.01 criteria.
- PIPC (South Korea): PIA methodology under PIPA Art. 33 — references ISO 29134.
- PDPC (Singapore): Guide to Data Protection Impact Assessments — references ISO 29134.
- OPC (Canada): Directive on Privacy Impact Assessment — federal PIA requirements.