# Standards and Regulatory References

## Primary Legislation

### GDPR Article 24(1) -- Controller Implementation Obligation
The controller shall implement appropriate technical and organisational measures to ensure and demonstrate compliance, reviewed and updated where necessary.

### GDPR Article 83(2) -- Fine Calculation Factors
Relevant mitigating factors: (c) actions taken to mitigate damage; (f) degree of cooperation with supervisory authority. Proactive remediation is a recognised mitigating factor.

## Regulatory Guidance and Enforcement

- **EDPB Guidelines on Administrative Fines (2017)**: Remediation efforts considered mitigating under Art. 83(2)(c) and (f).
- **British Airways (ICO, 2020, GBP 20M)**: Post-breach remedial actions cited as mitigating factor in fine reduction.

## ISO/IEC Standards

- **ISO/IEC 27701:2019**: Privacy Information Management System extending ISO 27001/27002 with privacy-specific controls aligned to GDPR.
- **ISO/IEC 27001:2022**: Information Security Management System providing security foundation for GDPR compliance.