# Standards and Regulatory References

## Primary Legislation

### GDPR Article 40 -- Codes of Conduct
- **Art. 40(1)**: Encouragement of codes to contribute to proper GDPR application.
- **Art. 40(2)**: Codes may cover fair processing, legitimate interests, pseudonymisation, data subject information, children protection, security measures, breach notification, transfers, and dispute resolution.
- **Art. 40(5)**: Draft codes submitted to supervisory authority for approval.
- **Art. 40(9)**: Commission may grant general EU validity.

### GDPR Article 41 -- Monitoring of Approved Codes
- **Art. 41(1)**: Accredited monitoring bodies oversee compliance.
- **Art. 41(2)**: Bodies must demonstrate independence and expertise.
- **Art. 41(4)**: Bodies inform supervisory authority of infringements.

## Regulatory Guidance and Enforcement

- **EDPB Guidelines 1/2019 on Codes of Conduct (adopted 12 February 2019)**: Comprehensive guidance on drafting codes, monitoring bodies, and the approval process.
- **EU Cloud Code of Conduct (CISPE, 2021)**: First transnational code approved under GDPR Art. 40 for cloud infrastructure service providers.

## ISO/IEC Standards

- **ISO/IEC 27701:2019**: Privacy Information Management System extending ISO 27001/27002 with privacy-specific controls aligned to GDPR.
- **ISO/IEC 27001:2022**: Information Security Management System providing security foundation for GDPR compliance.