# Purpose-Based Access Control — Standards References

## Academic Foundations
- Byun, J. and Li, N. "Purpose Based Access Control of Complex Data for Privacy Protection." ACM SACMAT, 2008.
- Ni, Q. et al. "Privacy-Aware Role-Based Access Control." ACM TOPS, 2010.
- Jafari, M. et al. "Towards Defining Semantic Foundations for Purpose-Based Privacy Policies." ACM CODASPY, 2014.

## Standards
- NIST SP 800-162: Guide to Attribute Based Access Control Definition and Considerations
- ISO/IEC 29101:2018: Privacy Architecture Framework
- XACML 3.0: eXtensible Access Control Markup Language (OASIS standard)

## Regulatory Basis
- GDPR Article 5(1)(b): Purpose limitation principle
- GDPR Article 6(4): Compatible purpose assessment criteria
- CCPA Section 1798.100(b): Collection limited to disclosed purposes
- LGPD Article 6(I): Purpose limitation principle