# Standards and Regulatory References

## Primary Legislation

### GDPR Article 5 — Principles Relating to Processing of Personal Data
- **Art. 5(1)(a)**: Lawfulness, fairness, and transparency.
- **Art. 5(1)(b)**: Purpose limitation — collected for specified, explicit, and legitimate purposes.
- **Art. 5(1)(c)**: Data minimisation — adequate, relevant, and limited to what is necessary.
- **Art. 5(1)(d)**: Accuracy — kept up to date; inaccurate data erased or rectified without delay.
- **Art. 5(1)(e)**: Storage limitation — kept no longer than necessary for the purposes.
- **Art. 5(1)(f)**: Integrity and confidentiality — appropriate security measures.
- **Art. 5(2)**: Accountability — the controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1.

### GDPR Article 24 — Responsibility of the Controller
- **Art. 24(1)**: Controller shall implement appropriate technical and organisational measures to ensure and demonstrate that processing is performed in accordance with the GDPR, taking into account the nature, scope, context, and purposes of processing and risks.
- **Art. 24(2)**: Where proportionate, shall include implementation of appropriate data protection policies.

### GDPR Article 25 — Data Protection by Design and by Default
- **Art. 25(1)**: Implement technical and organisational measures designed to implement data-protection principles (such as pseudonymisation, data minimisation) at the time of design and during processing.
- **Art. 25(2)**: Implement measures for ensuring that by default only personal data necessary for each specific purpose is processed.

### GDPR Article 28 — Processor
- **Art. 28(1)**: Use only processors providing sufficient guarantees to implement appropriate measures.
- **Art. 28(3)**: Processing governed by a contract or legal act setting out: subject-matter, duration, nature, purpose, type of data, categories of subjects, and obligations/rights of the controller.

### GDPR Article 30 — Records of Processing Activities
- Full field requirements for controller (Art. 30(1)(a)-(g)) and processor (Art. 30(2)(a)-(d)) records.

### GDPR Article 32 — Security of Processing
- **Art. 32(1)**: Controller and processor shall implement measures including: (a) pseudonymisation and encryption; (b) ongoing confidentiality, integrity, availability, and resilience; (c) timely restoration; (d) regular testing.
- **Art. 32(2)**: Account shall be taken of the risks of processing, including accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

### GDPR Article 35 — Data Protection Impact Assessment
- **Art. 35(1)**: DPIA required where processing is likely to result in a high risk to rights and freedoms.
- **Art. 35(3)**: Mandatory for: (a) systematic and extensive profiling with significant effects; (b) large-scale processing of special categories; (c) systematic monitoring of publicly accessible areas.
- **Art. 35(7)**: DPIA shall contain: systematic description, necessity/proportionality assessment, risk assessment, measures to address risks.

### GDPR Articles 37-39 — Data Protection Officer
- **Art. 37(1)**: Mandatory DPO for: (a) public authorities; (b) core activities requiring regular, systematic monitoring at scale; (c) core activities involving large-scale special category data.
- **Art. 38**: Position of the DPO — independence, resources, non-dismissal, direct reporting to highest management.
- **Art. 39**: Tasks — monitoring compliance, advising on DPIAs, cooperating with supervisory authority.

## Audit Standards

### ISO 19011:2018 — Guidelines for Auditing Management Systems
Provides principles of auditing, managing audit programmes, conducting audits, and evaluating auditor competence. Applicable methodology for structuring data protection audits.

### ISACA COBIT 2019
Control Objectives for Information and Related Technologies. Domain DSS05 (Manage Security Services) and DSS06 (Manage Business Process Controls) align with GDPR security and accountability requirements.

### NIST Privacy Framework 1.0 (January 2020)
Provides a voluntary tool for organisations to identify and manage privacy risk. The Govern, Control, Communicate, and Protect functions map to GDPR accountability, data subject rights, transparency, and security respectively.

## Enforcement Priorities

- **EDPB Coordinated Enforcement Framework (2023-2024)**: Focused on the designation and position of DPOs (Art. 37-39), finding widespread non-compliance with DPO independence, resourcing, and involvement requirements.
- **CNIL Enforcement Priority (2024)**: Data retention periods — organisations failing to define and implement retention schedules.
- **BfDI (Germany) Annual Report 2024**: Highlighted processor management (Art. 28) deficiencies as a recurring audit finding across federal institutions.