/**
 * UK GDPR Compliance Pack
 *
 * The EU General Data Protection Regulation as retained and adapted in
 * UK law following the UK's exit from the EU, combined with the Data
 * Protection Act 2018 (DPA 2018).
 *
 * Primary authority:
 *   - UK GDPR: the EU GDPR (Regulation (EU) 2016/679) as retained in
 *     UK law by the European Union (Withdrawal) Act 2018, as amended
 *     by the Data Protection, Privacy and Electronic Communications
 *     (Amendments etc.) (EU Exit) Regulations 2019.
 *   - Data Protection Act 2018 (DPA 2018): the primary UK data
 *     protection statute that sits alongside UK GDPR. Provides
 *     Schedule 1 (special category processing conditions), Schedule 2
 *     (exemptions including immigration exemption at Part 4), and
 *     implementation detail not in UK GDPR itself.
 *   - ICO (Information Commissioner's Office): UK supervisory authority.
 *
 * Key divergences from EU GDPR to encode:
 *   1. Fines: up to £17.5 million or 4% of global annual turnover
 *      (whichever higher) for Tier 1 violations; up to £8.7 million
 *      or 2% for Tier 2. (Note: UK figures not automatically linked
 *      to EU GDPR standard amounts post-Brexit.)
 *   2. International transfers: UK has its own adequacy framework.
 *      UK-EU adequacy decision in place; UK-US adequacy (UK Extension
 *      to EU-US DPF) in place as of 2023. UK adequacy decisions may
 *      diverge from EU decisions over time.
 *   3. DPA 2018 Schedule 1: conditions for processing special category
 *      data differ in some respects from EU GDPR Art. 9 conditions.
 *   4. DPA 2018 Schedule 2 Part 4 (Immigration Exemption): no
 *      equivalent in EU GDPR -- an exemption to certain data subject
 *      rights for immigration control. ICO and courts continue to
 *      scrutinise this exemption.
 *   5. ICO Guidance: ICO publishes UK-specific guidance that may
 *      diverge from EDPB guidance (e.g., on legitimate interests,
 *      AI, purpose limitation).
 *   6. DPDI Bill / Data (Use and Access) Act: legislation modernising
 *      UK data protection in some areas (e.g., recognised legitimate
 *      interests, smart data, etc.) -- track enactment status.
 *
 * Current state (2026):
 *   - UK-EU adequacy decision under review; UK adequacy recognised
 *     by EU Commission through at least mid-2025 (review cycle).
 *   - ICO AI guidance active: guidance on generative AI, purpose
 *     limitation for AI training, and AI transparency obligations.
 *   - Data (Use and Access) Act 2025: expected to introduce
 *     recognised legitimate interests list; smart data frameworks;
 *     digital verification services regulation.
 *   - Pairs with: EU GDPR (for EU/UK cross-border operations), UK
 *     FCA rules (financial services context), UK DSIT AI Framework.
 *
 * Distinction from EU GDPR pack:
 *   - Different supervisory authority (ICO vs relevant EU SA)
 *   - Different fine scale (£ amounts not € amounts)
 *   - Different adequacy mechanism (UK-EU, UK-US Extension)
 *   - DPA 2018 Schedule overlays (especially immigration exemption)
 *   - ICO guidance vs EDPB guidance may diverge
 *
 * @connexum/ai-governance
 */
/**
 * UK GDPR category classifiers.
 * Mirrors EU GDPR special category structure but with UK-specific
 * DPA 2018 Schedule 1 processing conditions and immigration exemption
 * awareness.
 */
export const UK_GDPR_CATEGORY_CLASSIFIERS = {
    PII: {
        references: ['UK GDPR Art. 4(1) -- personal data definition as retained in UK law'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:name|full name|first name|last name)[:\s]+[A-Z][a-z]+ [A-Z][a-z]+/i.test(input))
                return true;
            // UK National Insurance Number
            if (/\b[A-CEGHJ-PR-TW-Z]{2}\s?\d{2}\s?\d{2}\s?\d{2}\s?[A-D]\b/i.test(input))
                return true;
            // UK passport / driving licence
            if (/\b(?:passport\s*(?:number|no\.?)?)[:\s]*[A-Z0-9]{9}\b/i.test(input))
                return true;
            return false;
        },
    },
    SPECIAL_CATEGORY: {
        references: ['UK GDPR Art. 9(1) -- special categories; DPA 2018 Schedule 1 processing conditions'],
        classifier: (input) => {
            if (/\b(?:HIV|AIDS|cancer|diabetes|mental health|psychiatric|therapy|disability|chronic illness)\b/i.test(input))
                return true;
            if (/\b(?:fingerprint|retinal|biometric|facial recognition|voiceprint)\s*(?:data|id|hash|template)?\b/i.test(input))
                return true;
            if (/\b(?:racial|ethnic|race|ethnicity|national origin)\s*(?:origin|background|group)?\b/i.test(input))
                return true;
            if (/\b(?:political|party membership|trade union|union member)\b/i.test(input))
                return true;
            if (/\b(?:religion|religious belief|faith|church|mosque|synagogue)\b/i.test(input))
                return true;
            if (/\b(?:sexual orientation|sexuality|LGBT|gay|lesbian|bisexual|transgender|queer)\b/i.test(input))
                return true;
            if (/\b(?:genetic data|DNA|genome|genotype|genetic profile)\b/i.test(input))
                return true;
            if (/\b(?:criminal conviction|criminal record|offence|felony|criminal history)\b/i.test(input))
                return true;
            return false;
        },
    },
    IMMIGRATION_DATA: {
        references: ['DPA 2018 Schedule 2 Part 4 -- immigration exemption; Home Office processing'],
        classifier: (input) => {
            if (/\b(?:immigration|visa|right\s+to\s+work|asylum|border\s+control|Home\s+Office|BRP|biometric\s+residence\s+permit)\b/i.test(input))
                return true;
            if (/\b(?:leave\s+to\s+remain|settled\s+status|EU\s+Settlement|EUSS|naturalisation)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['UK GDPR Art. 32 -- security of processing'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const UK_GDPR_PACK = {
    categoryClassifiers: UK_GDPR_CATEGORY_CLASSIFIERS,
    id: 'uk-gdpr',
    name: 'UK GDPR + Data Protection Act 2018',
    version: '1.0.0',
    description: 'UK General Data Protection Regulation (EU GDPR as retained in UK law) + Data Protection Act 2018 compliance for AI systems processing personal data of UK data subjects or operated by UK-established controllers/processors. Enforced by the ICO with fines up to £17.5M / 4% global turnover. Covers UK-specific adequacy mechanisms, DPA 2018 Schedule overlays (immigration exemption, special category processing conditions), and ICO AI guidance.',
    authority: 'ICO (Information Commissioner\'s Office) + Secretary of State (Data Protection)',
    industries: ['technology', 'financial-services', 'healthcare', 'retail', 'hr-employment', 'public-sector', 'legal', 'marketing', 'education', 'charity'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Lawful basis enforcement per UK GDPR Art. 6; purpose limitation (Art. 5(1)(b)); data minimisation; immigration exemption scope control',
            reference: 'UK GDPR Art. 5 -- principles; Art. 6 -- lawful basis; Art. 22 -- automated decision-making; DPA 2018 Schedule 2 Part 4',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Personal data detection; special category data classification per UK GDPR Art. 9; immigration data detection for DPA 2018 Schedule 2 Part 4 exemption awareness',
            reference: 'UK GDPR Art. 4(1) -- personal data; Art. 9 -- special categories; DPA 2018 Sch. 1 -- special category processing conditions',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Records of processing activities (ROPA) per UK GDPR Art. 30; tamper-evident audit trail for ICO investigations; accountability principle documentation',
            reference: 'UK GDPR Art. 5(2) -- accountability; Art. 30 -- records of processing activities; Art. 83 -- fine assessment',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Access control for personal data; unique agent identification for audit trail; access limited to authorised personnel',
            reference: 'UK GDPR Art. 32(1)(b) -- access control; Art. 25 -- data protection by design',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Personal data encrypted at rest and in transit per Art. 32(1)(a); pseudonymisation and encryption as safeguards for special category data',
            reference: 'UK GDPR Art. 32(1)(a) -- encryption and pseudonymisation; Art. 34 -- communication to data subjects',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Art. 22 human review gate for automated decision-making with legal/similarly significant effects; DPIA authorisation workflow',
            reference: 'UK GDPR Art. 22 -- automated decision-making; Art. 35 -- DPIA; ICO guidance on AI and data protection',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Records of Processing Activities (ROPA) per Art. 30; Data Protection Impact Assessment (DPIA) per Art. 35; DPO designation tracking',
            reference: 'UK GDPR Art. 30 -- ROPA; Art. 35 -- DPIA; Art. 37 -- DPO designation; ICO accountability framework',
        },
        {
            name: 'event-bus',
            required: true,
            reason: '72-hour personal data breach notification to ICO per Art. 33; communication to data subjects per Art. 34',
            reference: 'UK GDPR Art. 33 -- notification to supervisory authority (ICO) within 72 hours; Art. 34 -- communication to data subjects',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Data processor contractual obligations per Art. 28; international transfer mechanism verification (UK-EU adequacy, UK-US DPF Extension, SCCs)',
            reference: 'UK GDPR Art. 28 -- processor contracts; Art. 46 -- appropriate safeguards for transfers; UK adequacy regulations',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Storage limitation enforcement (Art. 5(1)(e)); data subject request tracking (DSR); consent revocation continuity',
            reference: 'UK GDPR Art. 5(1)(e) -- storage limitation; Art. 7(3) -- withdrawal of consent; Arts. 15-22 -- data subject rights',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Privacy notices per Arts. 13-14; AI processing transparency; automated decision-making disclosure',
            reference: 'UK GDPR Arts. 13-14 -- transparency obligations; Art. 22(3) -- right to explanation; ICO AI transparency guidance',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            lawfulBasisEnforced: true,
            purposeLimitationEnforced: true,
            dataMinimisationRequired: true,
            immigrationExemptionScopeRequired: true,
            dpfdTransferMechanismSupported: true, // UK-US DPF Extension
            ukEuAdequacyTransferMechanismSupported: true,
        },
        'data-classifier': {
            enabledCategories: ['PII', 'SPECIAL_CATEGORY', 'IMMIGRATION_DATA', 'CREDENTIALS'],
            specialCategoryAction: 'BLOCK',
            immigrationDataAction: 'WARN',
        },
        'approval-queue': {
            article22HumanReviewRequired: true,
            dpiaAuthorizationRequired: true,
            specialCategoryProcessingApprovalRequired: true,
        },
        'attestation-manager': {
            ropaRequired: true,
            dpiaRequired: true,
            dpoDesignationTracked: true,
        },
        'event-bus': {
            breachNotificationToIcoHours: 72,
            dataSubjectCommunicationRequired: true,
        },
        'supply-chain': {
            processorContractRequired: true,
            internationalTransferMechanismVerificationRequired: true,
        },
        'encryption-layer': {
            algorithm: 'aes-256-gcm',
            encryptionRequiredForPersonalData: true,
            pseudonymisationEncouraged: true,
        },
        'session-persistence': {
            storageLimitationEnforced: true,
            dsrDeadlineDays: 30, // UK GDPR Art. 12 -- 1 month
            consentRevocationContinuityRequired: true,
        },
        'agent-auth': {
            accessLimitedToAuthorisedPersonnel: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-UK-OR-EU', 'PROCESSOR-CONTRACT'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law incompatible with UK GDPR Art. 46 transfer requirements; no UK adequacy decision for PRC; no adequate transfer mechanism available.',
            baidu: 'PRC jurisdiction. No UK adequacy decision. Transfer to PRC without adequate safeguards violates UK GDPR Art. 44.',
            alibaba: 'PRC jurisdiction. No UK adequacy decision. Transfer to PRC without adequate safeguards violates UK GDPR Art. 44.',
        },
    },
    dataPolicy: {
        scanCategories: ['PII', 'SPECIAL_CATEGORY', 'IMMIGRATION_DATA', 'CREDENTIALS'],
        categoryActions: {
            PII: 'WARN',
            SPECIAL_CATEGORY: 'BLOCK',
            IMMIGRATION_DATA: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // UK GDPR Art. 5(1)(e): storage limitation -- no longer than necessary
        // ICO audit logs: 3 years recommended minimum; 6 years for significant decisions
        auditLogRetentionDays: 2190, // 6 years for significant processing decisions
        sessionRetentionDays: 1095, // 3 years default; override per sector guidance
        incidentRetentionDays: 2190,
        reference: 'UK GDPR Art. 5(1)(e) -- storage limitation; Art. 30 ROPA retention; ICO recommended retention periods; Limitation Act 1980 -- 6-year claims period',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb', 'eu'], // UK and EU both adequate for UK GDPR transfers
    },
    incidentPolicy: {
        notificationDeadlineHours: 72,
        reference: 'UK GDPR Art. 33 -- notification to ICO within 72 hours of becoming aware of personal data breach; Art. 34 -- communication to data subjects without undue delay when high risk',
        requiredRecipients: ['ico', 'data-protection-officer', 'affected-data-subjects'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'uk-gdpr-lawful-basis',
            description: 'Lawful basis enforced for all personal data processing under UK GDPR Art. 6',
            reference: 'UK GDPR Art. 6 -- lawfulness of processing; Art. 5(1)(a) -- lawfulness principle',
            check: 'gdpr_lawful_basis_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-gdpr-breach-notification-72h',
            description: 'ICO breach notification within 72 hours of becoming aware of a personal data breach',
            reference: 'UK GDPR Art. 33 -- 72-hour notification to ICO',
            check: 'gdpr_breach_72h_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-gdpr-encryption',
            description: 'Personal data encrypted at rest and in transit per Art. 32(1)(a)',
            reference: 'UK GDPR Art. 32(1)(a) -- encryption as an appropriate technical measure',
            check: 'encryption_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-gdpr-data-classifier',
            description: 'Personal data and special category data detection active; immigration data flagged for DPA 2018 Schedule 2 Part 4 awareness',
            reference: 'UK GDPR Art. 4(1), Art. 9; DPA 2018 Sch. 2 Part 4 -- immigration exemption',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-gdpr-article22-review',
            description: 'Human review gate active for automated decision-making with legal or similarly significant effects',
            reference: 'UK GDPR Art. 22 -- rights related to automated decision-making; ICO AI guidance',
            check: 'gdpr_article22_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-gdpr-ropa',
            description: 'Records of Processing Activities (ROPA) maintained per Art. 30',
            reference: 'UK GDPR Art. 30 -- records of processing activities',
            check: 'gdpr_ropa_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-gdpr-dpia',
            description: 'Data Protection Impact Assessment (DPIA) conducted for high-risk AI processing',
            reference: 'UK GDPR Art. 35 -- DPIA requirement for high-risk processing including AI with large-scale profiling',
            check: 'gdpr_dpia_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-gdpr-transfer-mechanism',
            description: 'Adequate transfer mechanism in place for international transfers (UK-EU adequacy, UK-US DPF Extension, SCCs)',
            reference: 'UK GDPR Arts. 44-46 -- transfers to third countries; UK adequacy regulations',
            check: 'gdpr_transfer_mechanism_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-gdpr-access-control',
            description: 'Access to personal data limited to authorised personnel; audit trail active',
            reference: 'UK GDPR Art. 32(1)(b) -- ongoing confidentiality, integrity, availability; Art. 5(2) accountability',
            check: 'rbac_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-gdpr-purpose-limitation',
            description: 'Purpose limitation enforced: personal data not processed for incompatible purposes',
            reference: 'UK GDPR Art. 5(1)(b) -- purpose limitation; ICO guidance on AI and purpose limitation for model training',
            check: 'gdpr_purpose_limitation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-gdpr-transparency',
            description: 'Privacy notices and AI processing transparency per Arts. 13-14 and Art. 22(3)',
            reference: 'UK GDPR Arts. 13-14 -- transparency to data subjects; Art. 22(3) -- right to explanation; ICO AI transparency guidance',
            check: 'transparency_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=uk-gdpr.js.map