# Standards and Regulatory References

## Primary Legislation

### GDPR (Regulation (EU) 2016/679)
- **Article 13** — Information to be provided where personal data are collected from the data subject
- **Article 12** — Transparent information, communication and modalities
- **Article 12(7)** — Standardised icons for providing information
- **Article 6** — Lawfulness of processing (legal bases referenced in Art. 13(1)(c))
- **Article 9(2)(a)** — Explicit consent for special category data (referenced in Art. 13(2)(c))
- **Recital 60** — Information obligation: principles of fair and transparent processing
- **Recital 61** — Timing: information should be provided at the time of collection
- **Recital 62** — Exemption where data subject already has the information

### UK Data Protection Act 2018
- **Section 12** — Supplementary provisions for the right to be informed under UK GDPR

## Regulatory Guidance

### European Data Protection Board (EDPB) / Article 29 Working Party
- **Guidelines on Transparency under Regulation 2016/679 (WP260 rev.01)** (adopted 11 April 2018): Definitive guidance on implementing Art. 13 information obligations, including the layered notice approach, just-in-time notices, and the distinction between Art. 13 and Art. 14.
- **Guidelines 01/2022 on data subject rights** (adopted 28 March 2023): Provides guidance on the Art. 13(2)(b) requirement to inform data subjects of their rights.

### Information Commissioner's Office (ICO) — United Kingdom
- **Right to be informed guidance** (updated 2024): Practical guidance on meeting Art. 13 requirements under UK GDPR.
- **Privacy notices code of practice**: Framework for creating effective, compliant privacy notices.

## Technical Standards

### ISO/IEC 27701:2019 — Privacy Information Management
- **Section 7.3.2** — Providing information to PII principals: establishes PIMS controls for meeting information obligations at the point of collection.

### ISO/IEC 29100:2024 — Privacy Framework
- **Section 5.2** — Openness, transparency and notice: provides the overarching privacy principle that informs the Art. 13 obligation.