# Standards and Regulatory References

## Primary Legislation

### GDPR Article 5(2) -- Accountability
The controller shall be responsible for, and be able to demonstrate compliance with, the data protection principles.

### GDPR Article 24 -- Controller Responsibility
Controllers must implement appropriate measures to ensure and demonstrate compliance.

### GDPR Article 39(1)(b) -- DPO Monitoring
The DPO shall monitor compliance including assignment of responsibilities, awareness-raising, training, and related audits.

## Regulatory Guidance and Enforcement

- **EDPB Coordinated Enforcement Framework**: Annual enforcement focus areas provide benchmark for self-assessment weighting.
- **CNIL Compliance Toolkit**: Self-assessment tool covering GDPR requirements with sector-specific modules.

## ISO/IEC Standards

- **ISO/IEC 27701:2019**: Privacy Information Management System extending ISO 27001/27002 with privacy-specific controls aligned to GDPR.
- **ISO/IEC 27001:2022**: Information Security Management System providing security foundation for GDPR compliance.