# Standards and Regulatory References

## Primary Legislation
- **GDPR Art. 35(11)**: Mandatory review obligation when risk changes.
- **GDPR Art. 24(1)**: Controller must demonstrate compliance, including through maintained DPIAs.
- **GDPR Art. 5(2)**: Accountability principle — up-to-date DPIAs demonstrate ongoing compliance.

## Guidance
- **EDPB WP248rev.01**: Section III.D specifies that DPIAs must be reviewed when risk changes and that controllers should proactively monitor for changes.
- **ISO/IEC 29134:2023**: Section 8 covers PIA review and maintenance requirements.
- **ICO DPIA Guidance (2023)**: Recommends regular review and provides criteria for triggering re-assessment.

## Best Practice Standards
- **ISO 31000:2018**: Risk management framework requiring monitoring and review (Clause 6.6).
- **ISO/IEC 27001:2022**: Continuous improvement and periodic review of information security management.