# Standards and Regulatory References

## Primary Legislation

### GDPR (Regulation (EU) 2016/679)
- **Article 14** — Information to be provided where personal data have not been obtained from the data subject
- **Article 14(5)** — Exemptions from the information obligation
- **Article 12** — Transparent information, communication and modalities
- **Article 89(1)** — Safeguards for archiving, research, and statistical purposes (referenced in Art. 14(5)(b))
- **Recital 61** — Information should be provided at the time of first contact if used for communication
- **Recital 62** — Exemptions: where data subject already has info, or where provision would involve disproportionate effort

### UK Data Protection Act 2018
- **Section 12** — Right to be informed supplementary provisions
- **Schedule 2, Part 1** — Exemptions from the information requirements, including research and statistics exemption

## Regulatory Guidance

### European Data Protection Board (EDPB) / Article 29 Working Party
- **Guidelines on Transparency under Regulation 2016/679 (WP260 rev.01)** (adopted 11 April 2018): Definitive guidance on Art. 14, including the timing obligations, the distinction between Art. 13 and Art. 14, the interpretation of "disproportionate effort," and the requirement for compensatory measures when the Art. 14(5)(b) exemption is relied upon.

### Information Commissioner's Office (ICO) — United Kingdom
- **Right to be informed guidance** (updated 2024): Practical guidance on Art. 14 obligations, including examples of when the disproportionate effort exemption may apply and the compensatory measures required.

## Technical Standards

### ISO/IEC 27701:2019 — Privacy Information Management
- **Section 7.3.3** — Providing information about PII processing to PII principals where data is obtained from third parties.