# Standards and Regulatory References

## Primary Legislation

### GDPR (Regulation (EU) 2016/679)
- **Article 12** — Transparent information, communication and modalities for the exercise of the rights of the data subject
- **Article 15** — Right of access by the data subject
- **Article 23** — Restrictions (Member State derogations permitting restrictions on Art. 15)
- **Recital 63** — Right of access: clarifies scope and limitations
- **Recital 64** — Identity verification requirements

### UK Data Protection Act 2018
- **Section 45** — Right of access (law enforcement processing)
- **Section 94** — Exemptions for certain processing
- **Schedule 2, Part 1-4** — Exemptions from data subject rights including legal privilege, management forecasting, negotiations, confidential references

## Regulatory Guidance

### European Data Protection Board (EDPB)
- **Guidelines 01/2022 on data subject rights — Right of access** (adopted 28 March 2023): Comprehensive guidance on the scope of Art. 15, including the concept of personal data in the context of access requests, means of providing access, manifestly unfounded or excessive requests, and the interplay with other data subject rights.
- **Guidelines on Transparency under Regulation 2016/679 (WP260 rev.01)** (adopted 11 April 2018): Guidance on Art. 12 requirements for transparent, intelligible, and easily accessible communication.

### Information Commissioner's Office (ICO) — United Kingdom
- **Right of access guidance** (updated 2024): Practical guidance on handling DSARs including identity verification, exemptions under UK law, and time limits.
- **Manifestly unfounded and excessive requests guidance**: Framework for assessing when a fee or refusal is appropriate.

## International Standards

### ISO/IEC 27701:2019 — Privacy Information Management
- **Section 7.3.6** — Access by PII principals: establishes controls for responding to access requests including verification, response timelines, and format requirements.
- **Annex D.7** — Guidance on the data subject's right of access in the context of a Privacy Information Management System (PIMS).

### ISO/IEC 27001:2022 — Information Security Management
- **Annex A Control 5.34** — Privacy and protection of PII: supports the operational security requirements for secure transmission of DSAR responses.

## Calculation Rules

### Regulation (EEC, Euratom) No 1182/71
- **Article 3** — Rules for calculating periods: when the last day of a period is a Saturday, Sunday, or public holiday, the period ends on the following working day.