Appendix B — Key references

Check these sources again before each launch; guidance changes.

Data (Use and Access) Act 2025: https://www.legislation.gov.uk/ukpga/2025/18 · commencement plan: https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement
Data Protection Act 2018: https://www.legislation.gov.uk/ukpga/2018/12 · PECR 2003: https://www.legislation.gov.uk/uksi/2003/2426
ICO guidance, including the storage and access technologies guidance (29 Apr 2026), data protection complaints (Feb 2026), the Age Appropriate Design Code and employment monitoring: https://ico.org.uk · data protection fee: https://ico.org.uk/for-organisations/data-protection-fee/
Ofcom Online Safety Act guidance: https://www.ofcom.org.uk

GDPR: https://eur-lex.europa.eu/eli/reg/2016/679/oj
AI Act transparency (Art. 50) guidelines: https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations
UK adequacy renewal: Commission Implementing Decision (EU) 2025/2574 (to 27 Dec 2031) · EU–US DPF: General Court T‑553/23 (3 Sep 2025), appeal C‑703/25 P
Consent cases: CJEU C‑673/17 Planet49 (pre-ticked boxes) · LG München I, 3 O 17493/20 (Google Fonts, 20 Jan 2022)

Nigeria

Nigeria Data Protection Act 2023 (Official Gazette copy): https://ncc.gov.ng/media/801/view
GAID 2025: https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf · NDPC: https://ndpc.gov.ng

FTC COPPA Rule (amended; compliance date 22 Apr 2026) and the CAN-SPAM compliance guide: https://www.ftc.gov

Technical

Prisma 7 configuration: https://pris.ly/d/config-datasource
Next.js fonts (self-hosting): https://nextjs.org/docs/app/getting-started/fonts
Supabase Row Level Security: https://supabase.com/docs/guides/database/postgres/row-level-security · server-side auth: https://supabase.com/docs/guides/auth/server-side/nextjs · signing out: https://supabase.com/docs/guides/auth/signout
Microsoft Clarity consent: https://learn.microsoft.com/en-us/clarity/setup-and-installation/consent-management
Hotjar data suppression: https://help.hotjar.com/hc/en-us/articles/36819956605329-How-to-Suppress-Text-Images-Videos-and-User-Input-from-Collected-Data
WCAG 2.2: https://www.w3.org/TR/WCAG22/
OWASP ASVS: https://owasp.org/www-project-application-security-verification-standard/ · OWASP Top 10 for LLM Applications: https://owasp.org/www-project-top-10-for-large-language-model-applications/
OWASP Cheat Sheet Series, Authentication: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html · Session Management: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html
RFC 8058 (one-click unsubscribe): https://www.rfc-editor.org/rfc/rfc8058 · RFC 9457 (Problem Details): https://www.rfc-editor.org/rfc/rfc9457 · RFC 9116 (security.txt): https://www.rfc-editor.org/rfc/rfc9116
Gmail sender guidelines: https://support.google.com/a/answer/81126
OWASP Top 10 for Agentic Applications (2026): https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
GitHub Actions secure use (pinned actions, token permissions, pull_request_target): https://docs.github.com/en/actions/reference/security/secure-use
GitHub Actions script injections: https://docs.github.com/en/actions/concepts/security/script-injections · securely using pull_request_target: https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target · workflow dependency lockfiles: https://docs.github.com/en/actions/concepts/security/workflow-dependency-lockfiles
npm trusted publishing: https://docs.npmjs.com/trusted-publishers · requiring 2FA for publishing: https://docs.npmjs.com/requiring-2fa-for-package-publishing-and-settings-modification
Dependabot cooldown: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown- · Renovate minimumReleaseAge: https://docs.renovatebot.com/configuration-options/#minimumreleaseage
Third-party app access: Google Workspace: https://knowledge.workspace.google.com/admin/apps/control-which-apps-access-google-workspace-data · Microsoft Entra user consent: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent

Delivery methods (Appendix E; summarised, not copied)

Scrum Guide (2020): https://scrumguides.org/scrum-guide.html · Kanban Guide (2025.5): https://kanbanguides.org/the-kanban-guide/
PRINCE2® 7 (PeopleCert): https://www.peoplecert.org · PMBOK® Guide 8th edition (PMI): https://www.pmi.org/standards/pmbok
Shape Up (37signals): https://basecamp.com/shapeup · LeSS rules: https://less.works/less/rules/index · SAFe® 6.0: https://framework.scaledagile.com
Boehm and Turner, “Using Risk to Balance Agile and Plan-Driven Methods”, IEEE Computer, 2003: https://doi.org/10.1109/MC.2003.1204376
Mermaid gantt charts: https://mermaid.js.org/syntax/gantt.html · forecasting from throughput: https://prokanban.org/kanban-playbook/forecasting-delivery