/**
 * Japan APPI (Act on Protection of Personal Information) Compliance Pack
 *
 * Regulation: Act on Protection of Personal Information (個人情報の保護に関する法律)
 *             Act No. 57 of 2003; comprehensive amendment 2020 (effective 2022);
 *             further amendments 2021/2022; ongoing PPC guidance updates.
 *
 * Jurisdiction: JP (Japan)
 * Regulator: Personal Information Protection Commission (PPC, 個人情報保護委員会)
 *             Established under the 2016 revision; supreme authority for APPI enforcement.
 *
 * Scope:
 *   Applies to any "business operator handling personal information" (個人情報取扱事業者)
 *   -- any entity that processes personal information of individuals in Japan for
 *   business purposes, including overseas entities doing business in Japan
 *   (extra-territorial scope introduced in 2020 amendment).
 *
 * Key data categories:
 *   1. Personal information (個人情報): any information relating to an identified or
 *      identifiable living individual, including name, DOB, and any information that
 *      combined with other data enables identification.
 *   2. Special care-required personal information (要配慮個人情報): sensitive data --
 *      race, creed (信条), social status (社会的身分), medical history, criminal record,
 *      crime victim history, disability. Requires opt-in consent.
 *   3. Personal related information (個人関連情報): cookies, advertising IDs, and
 *      other web browsing records that can be combined with other data to identify an
 *      individual. Introduced in 2020 amendment.
 *   4. Pseudonymously processed information (仮名加工情報): de-identified but can be
 *      re-linked with a key; special handling rules.
 *   5. Anonymously processed information (匿名加工情報): irreversibly de-identified;
 *      cannot be re-linked.
 *
 * Key obligations:
 *   1. Purpose of use: must specify purpose before or at time of collection and disclose
 *      publicly. Processing beyond specified purpose requires new consent.
 *   2. Opt-in consent for special care-required personal information.
 *   3. Third-party transfer restriction: consent (opt-in) required for transfer to third
 *      parties, OR opt-out (オプトアウト) procedure with PPC notification for certain
 *      categories (not applicable for special-care data -- must use opt-in).
 *   4. Cross-border transfer restriction: PPC-recognized adequate countries (currently
 *      EU per GDPR adequacy, UK) OR additional contractual safeguards equivalent to
 *      Japanese standards (similar to but NOT identical to GDPR SCCs).
 *   5. Data subject rights: disclosure (開示), correction (訂正), addition (追加),
 *      deletion (削除), suspension of use (利用停止), erasure (消去), and third-party
 *      transfer record disclosure.
 *   6. Breach notification to PPC and affected individuals: within 60 days for reportable
 *      incidents. "Reportable" = leak, loss, or unauthorized provision of personal
 *      information that could cause significant harm. Expedited 30-day report for
 *      likely unauthorized use or large-scale leakage.
 *      IMPORTANT: Verify against latest PPC guidance for current deadlines.
 *   7. DPO-equivalent (個人情報保護管理者) designation recommended; mandatory for
 *      certain regulated sectors.
 *   8. ROPA-equivalent: internal records of personal information holdings required.
 *
 * Critical cross-border transfer rule:
 *   Diverges significantly from GDPR. Pack must:
 *   (a) Check destination country against PPC's current adequacy list
 *       (EU, UK as of 2023 PPC determination -- verify current list).
 *   (b) For non-adequate countries: require contractual safeguards with the
 *       overseas recipient ensuring equivalent APPI-standard protections.
 *   (c) Disclosure to data subject of cross-border transfer destination REQUIRED.
 *   (d) Third-party transfer records must be maintained and disclosed on request.
 *
 * Retention:
 *   Per business purpose (no fixed statutory minimum like GDPR 6/10 years).
 *   PPC requires periodic review and disposal when data is no longer needed.
 *   Third-party transfer records: 3 years.
 *   Breach notification records: retained as required by PPC guidance.
 *
 * @connexum/ai-governance
 */
export const JP_APPI_CATEGORY_CLASSIFIERS = {
    PERSONAL_INFORMATION_JAPAN: {
        references: ['APPI Art. 2(1) -- kojin joho (個人情報) defined; name, DOB, address, any identifying information'],
        classifier: (input) => {
            if (/\b(?:kojin\s+joho|個人情報|appi\s+personal\s+information|japan\s+personal\s+information|japanese\s+personal\s+data)\b/i.test(input))
                return true;
            if (/\b(?:japan\s+pii|jp\s+personal\s+data|appi\s+data|japan\s+data\s+subject|japanese\s+resident\s+data)\b/i.test(input))
                return true;
            if (/\b(?:my\s+number\s+japan|マイナンバー|individual\s+number\s+japan|japan\s+id\s+number|japanese\s+national\s+id)\b/i.test(input))
                return true;
            if (/\b(?:japan\s+address\s+data|japanese\s+name\s+record|japan\s+dob\s+record|japan\s+customer\s+data|日本\s+個人)\b/i.test(input))
                return true;
            return false;
        },
    },
    SPECIAL_CARE_REQUIRED_PERSONAL_INFORMATION: {
        references: ['APPI Art. 2(3) -- yohairyo kojin joho (要配慮個人情報): race, creed, social status, medical history, criminal record, victim of crime, disability'],
        classifier: (input) => {
            if (/\b(?:yohairyo|要配慮個人情報|special.care.required\s+personal\s+information\s+japan|appi\s+sensitive\s+data)\b/i.test(input))
                return true;
            if (/\b(?:japan\s+sensitive\s+personal\s+information|appi\s+special\s+category|japanese\s+sensitive\s+data\s+appi)\b/i.test(input))
                return true;
            if (/\b(?:race\s+data\s+japan|creed\s+japan|medical\s+history\s+japan|criminal\s+record\s+japan\s+appi|disability\s+data\s+japan)\b/i.test(input))
                return true;
            if (/\b(?:social\s+status\s+japan|crime\s+victim\s+japan|日本\s+要配慮)\b/i.test(input))
                return true;
            return false;
        },
    },
    PERSONAL_RELATED_INFORMATION: {
        references: ['APPI Art. 26-6 (2020 amendment) -- kojin kanren joho (個人関連情報): cookies, advertising IDs, web browsing records combinable with personal info'],
        classifier: (input) => {
            if (/\b(?:kojin\s+kanren\s+joho|個人関連情報|personal\s+related\s+information\s+japan|appi\s+cookie\s+data)\b/i.test(input))
                return true;
            if (/\b(?:japan\s+cookie\s+identifier|japan\s+advertising\s+id|japanese\s+browser\s+data\s+appi|appi\s+2020\s+cookie)\b/i.test(input))
                return true;
            if (/\b(?:japan\s+tracking\s+data\s+appi|appi\s+personal\s+related|third.party.provision\s+cookie\s+japan)\b/i.test(input))
                return true;
            return false;
        },
    },
    PSEUDONYMOUSLY_PROCESSED_INFORMATION: {
        references: ['APPI Art. 41 -- kamei kakou joho (仮名加工情報): de-identified but re-linkable with key; special handling rules'],
        classifier: (input) => {
            if (/\b(?:kamei\s+kakou|仮名加工情報|pseudonymously\s+processed\s+information\s+japan|appi\s+pseudonymization)\b/i.test(input))
                return true;
            if (/\b(?:japan\s+pseudonymized\s+data|appi\s+kamei|japanese\s+de.identified\s+re.linkable|appi\s+pseudonymous)\b/i.test(input))
                return true;
            return false;
        },
    },
    ANONYMOUSLY_PROCESSED_INFORMATION: {
        references: ['APPI Art. 43 -- tokumei kakou joho (匿名加工情報): irreversibly de-identified; cannot be re-linked'],
        classifier: (input) => {
            if (/\b(?:tokumei\s+kakou|匿名加工情報|anonymously\s+processed\s+information\s+japan|appi\s+anonymization)\b/i.test(input))
                return true;
            if (/\b(?:japan\s+anonymized\s+data|appi\s+tokumei|japanese\s+irreversibly\s+de.identified|appi\s+anonymous)\b/i.test(input))
                return true;
            return false;
        },
    },
    CROSS_BORDER_TRANSFER_JAPAN: {
        references: ['APPI Art. 24 (Art. 28 post-2022) -- gaikoku daisankasha teikyou (外国第三者提供): cross-border transfer requires adequate country or contractual safeguards'],
        classifier: (input) => {
            if (/\b(?:appi\s+cross.border\s+transfer|japan\s+cross.border\s+data|appi\s+gaikoku\s+transfer|japanese\s+data\s+transfer\s+overseas)\b/i.test(input))
                return true;
            if (/\b(?:appi\s+adequacy|japan\s+ppc\s+adequacy|appi\s+contractual\s+safeguards|japanese\s+overseas\s+transfer\s+safeguards)\b/i.test(input))
                return true;
            if (/\b(?:外国第三者提供|外国への個人情報移転|japan\s+data\s+export\s+appi|appi\s+transfer\s+restriction)\b/i.test(input))
                return true;
            return false;
        },
    },
    THIRD_PARTY_TRANSFER_RECORD: {
        references: ['APPI Art. 25-2 (Art. 29-30 post-2022) -- third-party transfer records: 3-year retention; available on data subject request'],
        classifier: (input) => {
            if (/\b(?:appi\s+third.party\s+transfer\s+record|japan\s+daisansha\s+teikyou|third.party\s+provision\s+record\s+japan)\b/i.test(input))
                return true;
            if (/\b(?:appi\s+transfer\s+log|japan\s+transfer\s+record\s+appi|japanese\s+third.party\s+transfer\s+log)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['APPI Art. 2(1) -- personal information (individual identification); My Number Act -- special individual number protection'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            // My Number (Japan individual number) -- 12 digits
            if (/\b\d{12}\b/.test(input) && /\b(?:my\s*number|マイナンバー|kojin\s+bango|個人番号)\b/i.test(input))
                return true;
            if (/\b(?:japan\s+ssn|japanese\s+national\s+id|kojin\s+bangou|my\s+number\s+card)\b/i.test(input))
                return true;
            if (/\b(?:氏名|住所|生年月日|電話番号)\s*[:：]/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['APPI Art. 20 -- security measures; PPC guidance on technical security controls'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const JP_APPI_PACK = {
    categoryClassifiers: JP_APPI_CATEGORY_CLASSIFIERS,
    id: 'jp-appi',
    aliases: ['appi', 'appi-japan', 'japan-privacy', 'appi-2022', 'act-on-protection-of-personal-information'],
    name: 'Japan APPI (Act on Protection of Personal Information)',
    version: '1.0.0',
    description: 'Japan Act on Protection of Personal Information (個人情報の保護に関する法律, Act No. 57 of 2003, comprehensively amended 2020/2022). Governs all business operators handling personal information of individuals in Japan, including overseas entities doing business in Japan (extra-territorial scope). Key obligations: (1) purpose specification and public disclosure before collection; (2) opt-in consent for special care-required personal information (race, creed, social status, medical history, criminal record, disability); (3) third-party transfer restriction (opt-in consent or opt-out procedure with PPC notification); (4) cross-border transfer restriction -- destination must be PPC-adequate country (EU, UK as of current PPC list) or APPI-standard contractual safeguards required (diverges from GDPR SCCs); (5) data subject rights: disclosure, correction, deletion, suspension of use, third-party transfer records; (6) breach notification to PPC and affected individuals within 60 days for reportable incidents (expedited 30-day for large-scale/unauthorized use); (7) DPO-equivalent designation. Enforced by PPC (個人情報保護委員会).',
    authority: 'Personal Information Protection Commission (PPC, 個人情報保護委員会) -- Japan',
    industries: ['all', 'technology', 'financial-services', 'healthcare', 'retail', 'manufacturing', 'media', 'telecommunications'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Enforce APPI purpose specification gate: processing beyond declared purpose requires new consent. Special care-required personal information opt-in gate. Cross-border transfer adequacy check against current PPC adequacy list (EU, UK).',
            reference: 'APPI Art. 18 -- purpose specification; Art. 17 -- purpose limitation; Art. 20-2 (Art. 17 post-2022) -- special care-required personal info consent; Art. 24/28 -- cross-border transfer adequacy check',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human review gate before: (1) third-party transfer of personal information -- verify consent or opt-out procedure; (2) cross-border transfer -- verify PPC adequacy or contractual safeguards; (3) processing of special care-required personal information -- verify opt-in consent.',
            reference: 'APPI Art. 23/27 -- third-party transfer consent or opt-out; Art. 24/28 -- cross-border transfer gate; Art. 20-2/17 -- special care-required data prior review',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify: personal information (kojin joho), special care-required personal information (yohairyo), personal related information (cookies/IDs), pseudonymously processed information, anonymously processed information. Distinct handling rules for each category.',
            reference: 'APPI Art. 2 -- data category definitions; Art. 41 -- pseudonymous information; Art. 43 -- anonymous information; Art. 26-6/28 -- personal related information (2020 amendment)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail for: purpose specification decisions, special care-required data consent records, third-party transfer records (3-year retention), cross-border transfer records, breach notification records. Required for PPC inspection.',
            reference: 'APPI Art. 25-2/29-30 -- third-party transfer records 3-year retention; PPC inspection powers; breach notification audit trail; purpose specification audit for PPC accountability review',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'DPO-equivalent (個人情報保護管理者) designation documentation; ROPA-equivalent internal records of personal information holdings; third-party transfer record lifecycle; cross-border transfer contractual safeguards documentation; opt-out procedure PPC notification records.',
            reference: 'APPI Art. 10 (ministerial guidelines) -- internal governance and DPO-equivalent; Art. 25-2/30 -- third-party transfer records; Art. 24/28 -- cross-border transfer documentation; PPC guidelines on Records of Processing (ROPA-equivalent)',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Special care-required personal information and personal information encrypted at rest and in transit per APPI Art. 20 security obligation and PPC technical security guidance.',
            reference: 'APPI Art. 20 -- security management measures; PPC Guidelines (General Edition) -- technical security controls including encryption; personal information security obligations',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Breach notification workflow: reportable incident triggers PPC notification (60-day window; expedited 30-day for large-scale or unauthorized use) and affected individual notification. Third-party transfer opt-out PPC notification workflow.',
            reference: 'APPI Art. 26 (post-2022) -- breach notification obligation; PPC guidance on 60-day and expedited 30-day notification; Art. 23(2) -- opt-out PPC notification procedure',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Entrustment (委託) of personal information to third parties: APPI requires sufficient oversight of entrusted processors. Cross-border transfer recipients must maintain APPI-equivalent protections. Vendor contracts must include security and purpose limitation clauses.',
            reference: 'APPI Art. 24 (pre-2022) / Art. 25 (post-2022) -- entrustment oversight; Art. 24/28 -- cross-border transfer recipient safeguards; PPC guidelines on processor/entrusted party oversight',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-business-purpose retention: no fixed statutory minimum but PPC requires periodic review and disposal when no longer needed. Third-party transfer records: 3 years. Pseudonymous information key separation. Enforce retention limits and periodic review triggers.',
            reference: 'APPI Art. 19 -- disposal when no longer needed; Art. 25-2/30 -- third-party transfer records 3-year retention; PPC guidelines on retention period and periodic review; Art. 41 -- pseudonymous information key management',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Purpose of use public disclosure (required before or at collection). Notification of cross-border transfer destination country to data subjects. Opt-out procedure disclosure. Special care-required data collection notice.',
            reference: 'APPI Art. 18 -- purpose disclosure; Art. 18(2)/21 -- notification at collection; Art. 24/28 -- cross-border transfer destination disclosure; Art. 23(2) -- opt-out procedure public notice',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'APPI Art. 18 purpose limitation and anti-discrimination principle: AI processing of personal information must not be used for purposes that could result in discriminatory profiling. Monitor AI outputs for discriminatory use of special care-required personal information.',
            reference: 'APPI Art. 18 -- purpose limitation prevents discriminatory repurposing; APPI basic policy -- fundamental human rights protection; PPC guidance on AI and personal information non-discriminatory use',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            purposeSpecificationGateRequired: true,
            specialCareRequiredOptInGateRequired: true,
            crossBorderTransferAdequacyCheckRequired: true,
            ppcAdequateCountries: ['eu', 'uk'],
            personalRelatedInformationThirdPartyCheckRequired: true,
        },
        'approval-queue': {
            thirdPartyTransferConsentVerificationRequired: true,
            crossBorderTransferSafeguardsVerificationRequired: true,
            specialCareRequiredDataOptInVerificationRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['PERSONAL_INFORMATION_JAPAN', 'SPECIAL_CARE_REQUIRED_PERSONAL_INFORMATION', 'PERSONAL_RELATED_INFORMATION', 'PSEUDONYMOUSLY_PROCESSED_INFORMATION', 'ANONYMOUSLY_PROCESSED_INFORMATION', 'CROSS_BORDER_TRANSFER_JAPAN', 'THIRD_PARTY_TRANSFER_RECORD', 'PII', 'CREDENTIALS'],
            personalInformationJapanAction: 'WARN',
            specialCareRequiredAction: 'BLOCK',
            personalRelatedInformationAction: 'WARN',
            crossBorderTransferAction: 'WARN',
            credentialsAction: 'BLOCK',
        },
        'transparency-injector': {
            purposeOfUsePublicDisclosureRequired: true,
            crossBorderTransferDestinationDisclosureRequired: true,
            optOutProcedureDisclosureRequired: true,
            specialCareRequiredCollectionNoticeRequired: true,
            aiUseDisclosureRequired: true,
        },
        'attestation-manager': {
            dpoEquivalentDesignationRequired: true,
            ropaEquivalentRequired: true,
            thirdPartyTransferRecordLifecycleRequired: true,
            crossBorderTransferSafeguardsDocumentationRequired: true,
            optOutPpcNotificationRecordsRequired: true,
        },
        'event-bus': {
            breachNotificationPpcDeadlineDays: 60,
            expeditedBreachNotificationDays: 30,
            affectedIndividualNotificationRequired: true,
            optOutPpcNotificationWorkflowRequired: true,
        },
        'session-persistence': {
            thirdPartyTransferRecordRetentionDays: 1095, // 3 years
            periodicReviewRequired: true,
            disposalWhenPurposeAchievedRequired: true,
            pseudonymousKeyManagementRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-JP', 'PROCESSOR-CONTRACT-APPI', 'CROSS-BORDER-TRANSFER-SAFEGUARDS'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law. Japan PPC has not granted adequacy to PRC. Transfer of Japanese personal information and special care-required personal information to PRC requires APPI-standard contractual safeguards that are incompatible with PRC government access obligations. PPC enforcement risk is high.',
            baidu: 'PRC jurisdiction. No PPC adequacy determination for PRC. Transfer of Japanese personal information and special care-required personal information (medical, criminal, disability) to PRC violates APPI Art. 24/28 cross-border transfer rules without enforceable contractual safeguards.',
            alibaba: 'PRC jurisdiction. No PPC adequacy determination for PRC. Transfer of Japanese personal information to PRC requires contractual safeguards that cannot be guaranteed given PRC National Intelligence Law obligations of Chinese entities.',
        },
    },
    dataPolicy: {
        scanCategories: ['PERSONAL_INFORMATION_JAPAN', 'SPECIAL_CARE_REQUIRED_PERSONAL_INFORMATION', 'PERSONAL_RELATED_INFORMATION', 'PSEUDONYMOUSLY_PROCESSED_INFORMATION', 'ANONYMOUSLY_PROCESSED_INFORMATION', 'CROSS_BORDER_TRANSFER_JAPAN', 'THIRD_PARTY_TRANSFER_RECORD', 'PII', 'CREDENTIALS'],
        categoryActions: {
            PERSONAL_INFORMATION_JAPAN: 'WARN',
            SPECIAL_CARE_REQUIRED_PERSONAL_INFORMATION: 'BLOCK',
            PERSONAL_RELATED_INFORMATION: 'WARN',
            PSEUDONYMOUSLY_PROCESSED_INFORMATION: 'WARN',
            ANONYMOUSLY_PROCESSED_INFORMATION: 'WARN',
            CROSS_BORDER_TRANSFER_JAPAN: 'WARN',
            THIRD_PARTY_TRANSFER_RECORD: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'INTERNAL',
    },
    retentionPolicy: {
        // No fixed statutory minimum for general personal information.
        // PPC requires periodic review and disposal when no longer needed.
        // Third-party transfer records: 3 years (APPI Art. 25-2/30).
        // Using 3 years as operational baseline; specific data types may vary.
        auditLogRetentionDays: 1095, // 3 years
        sessionRetentionDays: 1095,
        incidentRetentionDays: 1095,
        reference: 'APPI Art. 19 -- disposal when no longer needed for business purpose; PPC guidelines -- periodic review required; Art. 25-2/30 -- third-party transfer records 3-year retention; breach notification records per PPC guidance',
        forceDelete: false,
        requiresLegalHoldSupport: false,
        sovereignty: ['jp'],
    },
    incidentPolicy: {
        // APPI post-2022: reportable breach notification to PPC within 60 days.
        // Expedited: 30 days for likely unauthorized use, large-scale, or sensitive data.
        // Verify current PPC guidance for latest deadlines.
        notificationDeadlineHours: 1440, // 60 days in hours
        reference: 'APPI Art. 26 (post-2022 amendment) -- breach notification to PPC and affected individuals; 60-day general deadline; expedited 30-day for large-scale (1000+ individuals) or special care-required data breach; PPC guidelines on reportable incident definition',
        requiredRecipients: ['ppc-japan', 'affected-individuals', 'data-protection-officer-equivalent', 'chief-privacy-officer'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'jp-appi-purpose-specification-gate',
            description: 'APPI purpose specification gate ACTIVE: personal information processed only for declared and publicly disclosed purposes. Processing beyond declared purpose requires new consent or notification. Purpose gate enforced before AI inference on personal information.',
            reference: 'APPI Art. 18 -- purpose specification and public disclosure; Art. 17 -- purpose limitation; PPC guidelines on purpose specification for AI processing of personal information',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'jp-appi-special-care-opt-in',
            description: 'Special care-required personal information opt-in gate ACTIVE: race, creed, social status, medical history, criminal record, disability data BLOCKED without explicit opt-in consent record. No implied or bundled consent accepted.',
            reference: 'APPI Art. 20-2 (Art. 17 post-2022) -- opt-in consent required for special care-required personal information (yohairyo kojin joho); PPC guidelines on special care-required data handling',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'jp-appi-cross-border-transfer-gate',
            description: 'Cross-border transfer gate ACTIVE: destination country checked against PPC adequacy list (EU, UK as of current determination). Non-adequate countries require APPI-equivalent contractual safeguards documentation before transfer. Diverges from GDPR SCCs -- Japan-specific standard.',
            reference: 'APPI Art. 24 (pre-2022) / Art. 28 (post-2022) -- cross-border transfer restriction; PPC adequacy determinations (EU, UK); contractual safeguards standard for non-adequate countries',
            check: 'approval_queue_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'jp-appi-third-party-transfer-records',
            description: 'Third-party transfer record lifecycle ACTIVE: all third-party provisions of personal information logged with 3-year retention; records disclosed to data subjects on request; opt-out procedure PPC notification records maintained.',
            reference: 'APPI Art. 25-2 (Art. 29-30 post-2022) -- third-party transfer records 3-year retention; Art. 23(2)/27 -- opt-out procedure PPC notification; data subject right to third-party transfer record disclosure',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'jp-appi-breach-notification-ppc',
            description: 'PPC breach notification workflow ACTIVE: reportable incidents trigger 60-day PPC notification; expedited 30-day for large-scale (1000+ individuals) or special care-required data breaches; affected individual notification required.',
            reference: 'APPI Art. 26 (post-2022) -- breach notification obligation; PPC guidelines on 60-day and 30-day expedited notification deadlines; reportable incident definition',
            check: 'event_bus_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'jp-appi-purpose-public-disclosure',
            description: 'Purpose of use public disclosure ACTIVE: declared purposes publicly disclosed (website privacy policy or equivalent). Cross-border transfer destination country disclosed to data subjects. Opt-out procedure publicly noticed.',
            reference: 'APPI Art. 18 -- purpose disclosure before or at collection; Art. 24/28 -- cross-border transfer destination disclosure; Art. 23(2) -- opt-out procedure public notice; PPC guidelines on transparency',
            check: 'transparency_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'jp-appi-dpo-equivalent',
            description: 'DPO-equivalent (個人情報保護管理者) designation documented; ROPA-equivalent internal records of personal information holdings maintained; cross-border transfer contractual safeguards on file.',
            reference: 'APPI Art. 10 and ministerial guidelines -- internal governance including DPO-equivalent; PPC guidelines on Records of Processing (ROPA-equivalent); Art. 24/28 -- cross-border safeguards documentation',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'jp-appi-personal-related-information',
            description: 'Personal related information (個人関連情報) gate ACTIVE: cookies and advertising IDs that could be combined with other data to identify individuals tracked for third-party transfer; third-party recipient consent verification required before provision.',
            reference: 'APPI Art. 26-6 (2020 amendment) / Art. 31 (post-2022) -- personal related information third-party provision check; recipient must confirm data subject consent before combination',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'jp-appi-security-measures',
            description: 'APPI security management measures ACTIVE: personal information and special care-required personal information encrypted at rest and in transit; access controls enforced; security incident detection active.',
            reference: 'APPI Art. 20 -- security management measures; PPC guidelines (General Edition) -- technical security controls; encryption requirement for sensitive personal information',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'jp-appi-entrustment-oversight',
            description: 'Entrustment (委託) oversight ACTIVE: personal information processors (entrusted parties) subject to sufficient supervision; processor contracts include security and purpose limitation clauses; cross-border transfer recipient contractual safeguards on file.',
            reference: 'APPI Art. 24/25 -- entrustment oversight obligation; Art. 24/28 -- cross-border transfer recipient must maintain equivalent protections; PPC guidelines on third-party processor oversight',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'jp-appi-bias-monitor',
            description: 'AI processing fairness monitoring ACTIVE: AI outputs for personal information processing monitored for discriminatory use, particularly for special care-required personal information (race, creed, social status, medical, criminal, disability).',
            reference: 'APPI Art. 18 -- purpose limitation prevents discriminatory repurposing; APPI basic policy -- fundamental human rights; PPC guidance on AI fairness and non-discriminatory personal information use',
            check: 'bias_monitor_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=jp-appi.js.map