"use strict";
/**
 * India Digital Personal Data Protection Act 2023 (DPDP Act) Compliance Pack
 *
 * Regulation: Digital Personal Data Protection Act, 2023
 *             (Act No. 22 of 2023, passed by Parliament 9 August 2023;
 *              received Presidential assent 11 August 2023)
 *
 * Jurisdiction: IN (India)
 * Regulator: Data Protection Board of India (DPBI) -- constituted under
 *            Chapter IV of the DPDP Act 2023
 *
 * Effective date:
 *   The Act was enacted in August 2023. The Central Government will notify
 *   specific provisions to come into force by official Gazette notification.
 *   The DPDP Rules are under consultation and have not been fully notified
 *   as of April 2026. Operational compliance timelines are therefore
 *   subject to rules notification -- verify against current notification
 *   status before relying on specific deadlines below.
 *
 * Scope:
 *   Applies to processing of "digital personal data" of "data principals"
 *   within India (territorial processing), AND processing outside India
 *   where the purpose is offering goods/services to data principals within
 *   India (extra-territorial, mirroring GDPR Art. 3(2) concept).
 *
 *   Key definitions:
 *   - Data principal: the individual to whom personal data relates
 *   - Data fiduciary: person who determines purpose and means of processing
 *   - Data processor: processes data on behalf of data fiduciary
 *   - Significant data fiduciary (SDF): notified by Central Government
 *     based on volume of data, sensitivity, national security risk, etc.
 *
 * Key obligations:
 *   1. Consent with notice (Section 5-6): data fiduciary must provide notice
 *      before or at collection; consent must be free, specific, informed,
 *      unconditional, and unambiguous.
 *   2. Data principal rights (Section 11-14):
 *      - Right to access (s.11)
 *      - Right to correction, completion, and updating (s.12)
 *      - Right to erasure (s.12)
 *      - Right to grievance redressal (s.13)
 *      - Right to nominate (s.14)
 *   3. Child data (Section 9): verifiable parental/guardian consent required
 *      for personal data of children (under 18); prohibition on processing
 *      that is likely to cause detrimental effect on well-being of child.
 *   4. Significant Data Fiduciary obligations (Section 10):
 *      - Data Protection Impact Assessment (DPIA)
 *      - Data audits
 *      - Appointment of Data Protection Officer (DPO)
 *      - AI-related additional obligations may be notified
 *   5. Cross-border transfer restrictions (Section 16): data fiduciaries
 *      may transfer personal data outside India only to countries notified
 *      by the Central Government as permissible (whitelist approach).
 *   6. Breach notification: data fiduciary must notify DPBI and affected
 *      data principals of personal data breach. Timeline per DPDP Rules
 *      (not yet fully notified -- see note above).
 *   7. Consent withdrawal: data principal may withdraw consent at any time;
 *      ease of withdrawal must be comparable to ease of consent (Section 6(4)).
 *
 * Consent withdrawal hard DENY:
 *   Per Section 6(4), processing actions on a data principal's data after
 *   consent withdrawal are prohibited. Pack enforces a BLOCK on any
 *   processing action where evidence shows consent has been withdrawn for
 *   the relevant data principal.
 *
 * Penalties:
 *   Schedule 1 of the DPDP Act specifies penalty tiers:
 *   - Breach of data principal rights / insufficient security: up to
 *     INR 250 crore (~USD 30M) per breach.
 *   - Failure to notify breach: up to INR 200 crore (~USD 24M).
 *   - Significant data fiduciary non-compliance: up to INR 150 crore.
 *   - Note: DPBI constituted and hearing procedures to be notified.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.IN_DPDP_PACK = exports.IN_DPDP_CATEGORY_CLASSIFIERS = void 0;
exports.IN_DPDP_CATEGORY_CLASSIFIERS = {
    DIGITAL_PERSONAL_DATA_INDIA: {
        references: ['DPDP Act s.2(t) -- personal data definition; s.3 -- application of Act; territorial + extra-territorial scope'],
        classifier: (input) => {
            if (/\b(?:digital\s+personal\s+data\s+india|dpdp\s+personal\s+data|data\s+principal\s+india|indian\s+personal\s+data)\b/i.test(input))
                return true;
            if (/\b(?:aadhaar\s+number|pan\s+card\s+number|indian\s+passport\s+number|voter\s+id\s+india|driving\s+licence\s+india)\b/i.test(input))
                return true;
            if (/\b(?:data\s+fiduciary\s+india|india\s+data\s+processing|personal\s+data\s+india)\b/i.test(input))
                return true;
            // Indian mobile number (10 digits, often prefixed with country code +91)
            if (/\b(?:\+91\s?)?\d{10}\b/.test(input) && /\b(?:mobile|phone|contact|number)\b/i.test(input))
                return true;
            return false;
        },
    },
    CHILD_PERSONAL_DATA_INDIA: {
        references: ['DPDP Act s.9 -- special provisions for children (under 18); verifiable parental/guardian consent'],
        classifier: (input) => {
            if (/\b(?:child\s+data\s+india|minor\s+data\s+india|dpdp\s+child|under\s+18\s+india|parental\s+consent\s+india)\b/i.test(input))
                return true;
            if (/\b(?:dpdp\s+s\.9|section\s+9\s+dpdp|child\s+personal\s+data\s+dpdp|guardian\s+consent\s+india)\b/i.test(input))
                return true;
            return false;
        },
    },
    DATA_FIDUCIARY_RECORDS: {
        references: ['DPDP Act s.2(i) -- data fiduciary; s.8 -- general obligations; s.10 -- significant data fiduciary obligations'],
        classifier: (input) => {
            if (/\b(?:data\s+fiduciary\s+record|dpdp\s+fiduciary|data\s+fiduciary\s+india\s+record|processing\s+record\s+india)\b/i.test(input))
                return true;
            if (/\b(?:purpose\s+of\s+processing\s+india|consent\s+record\s+india|dpdp\s+processing\s+log)\b/i.test(input))
                return true;
            return false;
        },
    },
    DATA_PROCESSOR_RECORDS: {
        references: ['DPDP Act s.2(k) -- data processor; s.8(2) -- processor obligations; contractual safeguards'],
        classifier: (input) => {
            if (/\b(?:data\s+processor\s+india|dpdp\s+processor|processor\s+contract\s+india|sub.processor\s+india)\b/i.test(input))
                return true;
            if (/\b(?:data\s+processing\s+agreement\s+india|dpdp\s+dpa|processor\s+audit\s+india)\b/i.test(input))
                return true;
            return false;
        },
    },
    CONSENT_RECORD_INDIA: {
        references: ['DPDP Act s.5 -- notice requirement; s.6 -- consent conditions; s.6(4) -- right to withdraw consent; s.7 -- deemed consent'],
        classifier: (input) => {
            if (/\b(?:dpdp\s+consent|india\s+consent\s+record|data\s+principal\s+consent\s+india|consent\s+withdrawal\s+india)\b/i.test(input))
                return true;
            if (/\b(?:dpdp\s+s\.6|section\s+6\s+dpdp|dpdp\s+notice|consent\s+notice\s+india|informed\s+consent\s+india)\b/i.test(input))
                return true;
            return false;
        },
    },
    SIGNIFICANT_DATA_FIDUCIARY_RECORD: {
        references: ['DPDP Act s.10 -- significant data fiduciary obligations; DPIA; DPO; data audit'],
        classifier: (input) => {
            if (/\b(?:significant\s+data\s+fiduciary|sdf\s+india|dpdp\s+sdf|dpdp\s+s\.10|dpia\s+india|dpo\s+india\s+dpdp)\b/i.test(input))
                return true;
            if (/\b(?:data\s+protection\s+impact\s+assessment\s+india|data\s+audit\s+india|dpdp\s+dpia|dpdp\s+audit)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['DPDP Act s.2(t) -- personal data; s.2(s) -- sensitive personal data (to be notified)'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:aadhaar|pan\s*card|voter\s*id|ration\s*card\s*number)\b/i.test(input))
                return true;
            if (/\b(?:name|full\s+name|first\s+name|last\s+name)[:\s]+[A-Z][a-z]+ [A-Z][a-z]+/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['DPDP Act s.8(5) -- reasonable security safeguards; Schedule 1 penalties for security breaches'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.IN_DPDP_PACK = {
    categoryClassifiers: exports.IN_DPDP_CATEGORY_CLASSIFIERS,
    id: 'in-dpdp',
    name: 'India DPDP Act 2023 (Digital Personal Data Protection Act)',
    version: '1.0.0',
    description: 'India Digital Personal Data Protection Act 2023 (DPDP Act, Act No. 22 of 2023), enacted August 2023; rules notified incrementally -- verify operational timelines against current DPBI notification status. Applies territorially and extra-territorially (offering goods/services to data principals in India). Key obligations: consent with notice (s.5-6); data principal rights -- access, correction, erasure, grievance (s.11-14); child data verifiable parental consent (s.9, under-18); significant data fiduciary obligations -- DPIA, DPO, data audit (s.10); cross-border transfer restrictions to government-whitelisted countries only (s.16); breach notification to DPBI and affected data principals. Consent withdrawal HARD DENY: processing blocked on data where consent has been withdrawn (s.6(4)). Penalties up to INR 250 crore (~USD 30M) per breach.',
    authority: 'Data Protection Board of India (DPBI)',
    industries: ['technology', 'financial-services', 'healthcare', 'e-commerce', 'telecommunications', 'hr-employment', 'education', 'government', 'retail'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Consent collection gate before processing (s.5-6); lawful basis enforcement; consent withdrawal hard DENY -- block processing after withdrawal; deemed consent (s.7) scope verification; cross-border transfer restriction enforcement (s.16)',
            reference: 'DPDP Act s.5 -- notice before consent; s.6 -- conditions for valid consent; s.6(4) -- consent withdrawal ease; s.7 -- deemed consent; s.16 -- cross-border transfer restrictions',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify digital personal data, child personal data, consent records, significant data fiduciary records, and data processor records for appropriate handling and rights enforcement',
            reference: 'DPDP Act s.2(t) -- personal data; s.9 -- child data classification; s.10 -- significant data fiduciary scope; s.2(k) -- data processor',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail for consent records, data principal rights requests, DPIA results, breach notifications, and cross-border transfer records; required for DPBI inquiry and enforcement',
            reference: 'DPDP Act s.8(7) -- records of processing; s.10(2)(c) -- data audit for SDFs; s.20 -- DPBI inquiry powers; Schedule 1 -- penalty assessment evidence',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Access control for personal data processing; ensures only authorised data fiduciary personnel access data principal records; significant data fiduciary access management',
            reference: 'DPDP Act s.8(5) -- reasonable security safeguards; s.10 -- SDF additional controls; Schedule 1 -- security breach penalties',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Reasonable security safeguards for digital personal data per s.8(5); encryption at rest and in transit as expected standard; breach notification obligations reduced when data is encrypted',
            reference: 'DPDP Act s.8(5) -- reasonable security safeguards; Schedule 1 -- data breach penalties; DPDP Rules (under consultation) -- security standards',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Data principal rights request handling gate (access, correction, erasure, grievance per s.11-13); child data verifiable consent verification gate (s.9); significant data fiduciary DPIA approval workflow',
            reference: 'DPDP Act s.11 -- right to information; s.12 -- right to correction and erasure; s.13 -- right to grievance redressal; s.9 -- child data verifiable parental consent; s.10(2)(a) -- DPIA',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Significant data fiduciary DPIA documentation (s.10(2)(a)); DPO designation records (s.10(2)(b)); data audit records (s.10(2)(c)); consent withdrawal records; cross-border transfer whitelist compliance documentation',
            reference: 'DPDP Act s.10(2)(a) -- DPIA; s.10(2)(b) -- DPO appointment; s.10(2)(c) -- independent data audit; s.16 -- cross-border transfer compliance documentation',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Personal data breach notification event to DPBI and affected data principals; consent withdrawal event triggering processing DENY; data principal rights request deadline tracking',
            reference: 'DPDP Act s.8(6) -- breach notification to DPBI and data principals; s.6(4) -- consent withdrawal; s.11-13 -- data principal rights request timelines per DPDP Rules',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Data processor contractual safeguards (s.8(2)); sub-processor accountability; cross-border transfer restrictions -- processor in non-whitelisted jurisdiction blocked (s.16)',
            reference: 'DPDP Act s.8(2) -- data processor must process only per data fiduciary instructions; s.16 -- cross-border transfer whitelisted countries only; processor contract requirements',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Retention only as long as necessary for purpose (s.8(3)); mandatory deletion on consent withdrawal or purpose completion; consent record continuity; data principal rights request state tracking',
            reference: 'DPDP Act s.8(3) -- erase when purpose fulfilled or consent withdrawn; s.6(4) -- consent withdrawal triggers erasure; data principal rights continuity across sessions',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Notice before consent collection (s.5); data principal rights information delivery; significant data fiduciary transparency obligations; breach notification delivery to affected data principals',
            reference: 'DPDP Act s.5 -- notice obligation (language, clarity, itemised); s.6 -- consent notice requirements; s.8(6) -- breach notification to affected data principals; s.11 -- information access right',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            lawfulBasisEnforced: true,
            consentWithdrawalHardDenyRequired: true, // s.6(4) -- processing BLOCK after withdrawal
            purposeLimitationEnforced: true,
            crossBorderTransferWhitelistRequired: true, // s.16 -- government-notified countries only
            childSpecificConsentRequired: true, // s.9 -- verifiable parental/guardian consent
        },
        'data-classifier': {
            enabledCategories: ['DIGITAL_PERSONAL_DATA_INDIA', 'CHILD_PERSONAL_DATA_INDIA', 'DATA_FIDUCIARY_RECORDS', 'DATA_PROCESSOR_RECORDS', 'CONSENT_RECORD_INDIA', 'SIGNIFICANT_DATA_FIDUCIARY_RECORD', 'PII', 'CREDENTIALS'],
            childPersonalDataAction: 'BLOCK', // s.9 -- block without verifiable parental consent
            consentRecordAction: 'WARN',
            credentialsAction: 'BLOCK',
        },
        'approval-queue': {
            dataPrincipalRightsGateRequired: true, // s.11-13
            childDataVerifiableConsentGateRequired: true, // s.9
            dpiaAuthorizationRequired: true, // s.10(2)(a) for SDFs
        },
        'attestation-manager': {
            dpiaRequired: true, // s.10(2)(a) for SDFs
            dpoDesignationTracked: true, // s.10(2)(b) for SDFs
            dataAuditRequired: true, // s.10(2)(c) for SDFs
            crossBorderTransferComplianceDocumented: true, // s.16
        },
        'event-bus': {
            personalDataBreachNotificationRequired: true, // s.8(6)
            consentWithdrawalEventRequired: true, // s.6(4)
            dataPrincipalRightsDeadlineTrackingRequired: true,
        },
        'supply-chain': {
            dataProcessorContractRequired: true, // s.8(2)
            crossBorderTransferWhitelistEnforced: true, // s.16
            internationalTransferMechanismRequired: true,
        },
        'session-persistence': {
            storageLimitationEnforced: true, // s.8(3) -- erase when purpose fulfilled
            consentRevocationContinuityRequired: true, // s.6(4)
            deletionOnPurposeCompletionRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-IN', 'DPDP-COMPLIANT', 'CONSENT-WITHDRAWAL-SUPPORT'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law creates cross-border transfer risk incompatible with DPDP Act s.16 (transfer only to government-whitelisted countries). PRC is not expected to be whitelisted given national security concerns; verify current Central Government notification.',
            baidu: 'PRC jurisdiction. DPDP Act s.16 cross-border transfer restrictions -- transfer permissible only to countries notified by Central Government. PRC not whitelisted; personal data of Indian data principals must not be transferred to PRC-hosted services.',
            alibaba: 'PRC jurisdiction. DPDP Act s.16 -- cross-border transfers to non-whitelisted countries prohibited. Processing Indian personal data on PRC-domiciled infrastructure violates s.16 without Central Government whitelist notification.',
        },
    },
    dataPolicy: {
        scanCategories: ['DIGITAL_PERSONAL_DATA_INDIA', 'CHILD_PERSONAL_DATA_INDIA', 'DATA_FIDUCIARY_RECORDS', 'DATA_PROCESSOR_RECORDS', 'CONSENT_RECORD_INDIA', 'SIGNIFICANT_DATA_FIDUCIARY_RECORD', 'PII', 'CREDENTIALS'],
        categoryActions: {
            DIGITAL_PERSONAL_DATA_INDIA: 'WARN',
            CHILD_PERSONAL_DATA_INDIA: 'BLOCK', // s.9 -- block without verifiable parental consent
            DATA_FIDUCIARY_RECORDS: 'WARN',
            DATA_PROCESSOR_RECORDS: 'WARN',
            CONSENT_RECORD_INDIA: 'WARN',
            SIGNIFICANT_DATA_FIDUCIARY_RECORD: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // DPDP Act s.8(3): data must be erased when purpose is fulfilled or consent withdrawn.
        // No statutory minimum retention specified in the Act; retention must be purpose-limited.
        // Audit logs for DPBI inquiry: DPDP Rules (under consultation) may specify; using 3-year floor.
        // Limitation Act 1963 (India) -- 3-year civil limitation period as practical floor.
        auditLogRetentionDays: 1095, // 3 years (India Limitation Act 1963 civil limitation period)
        sessionRetentionDays: 0, // 0 = no default retention; must be purpose-specific per s.8(3)
        incidentRetentionDays: 1095, // 3 years for breach notifications and DPBI inquiry records
        reference: 'DPDP Act s.8(3) -- erase personal data when purpose fulfilled or consent withdrawn; s.8(6) -- breach records; India Limitation Act 1963 s.3 -- 3-year civil limitation period as floor; DPDP Rules (under consultation) -- may specify retention standards',
        forceDelete: true, // s.8(3) + s.6(4) -- MANDATORY deletion on consent withdrawal or purpose completion
        requiresLegalHoldSupport: true,
        sovereignty: ['in'], // India data residency; s.16 cross-border transfer restrictions apply
    },
    incidentPolicy: {
        // DPDP Act s.8(6): data fiduciary must notify DPBI and affected data principals of breach.
        // Breach notification timeline: per DPDP Rules (not yet fully notified as of April 2026).
        // Using 72 hours as conservative international standard; update when DPDP Rules notified.
        notificationDeadlineHours: 72, // Placeholder per DPDP Rules (under consultation) -- verify when notified
        reference: 'DPDP Act s.8(6) -- notification of personal data breach to DPBI and affected data principals; DPDP Rules (under consultation) -- breach notification timeline [NOTE: verify against current rules notification status]; Schedule 1 -- failure to notify breach: penalty up to INR 200 crore',
        requiredRecipients: ['data-protection-board-india', 'affected-data-principals', 'data-protection-officer', 'chief-compliance-officer'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'in-dpdp-consent-gate',
            description: 'Consent with notice gate active before processing; notice itemised and in accessible language; consent free, specific, informed, unconditional, and unambiguous per s.5-6',
            reference: 'DPDP Act s.5 -- notice obligation before seeking consent; s.6(1) -- valid consent conditions (free, specific, informed, unconditional, unambiguous); s.6(3) -- consent bundle prohibition',
            check: 'gdpr_lawful_basis_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'in-dpdp-consent-withdrawal-deny',
            description: 'Consent withdrawal hard DENY active: processing of data principal personal data blocked immediately on consent withdrawal; ease of withdrawal equivalent to ease of consent',
            reference: 'DPDP Act s.6(4) -- right to withdraw consent at any time; processing after withdrawal prohibited; withdrawal as easy as giving consent',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'in-dpdp-child-data-block',
            description: 'Child personal data blocked without verifiable parental/guardian consent; data processing likely to harm child well-being prohibited per s.9',
            reference: 'DPDP Act s.9(1) -- verifiable consent of parent or legal guardian for children (under 18); s.9(3) -- prohibition on tracking, profiling, or processing in manner detrimental to child well-being',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'in-dpdp-breach-notification',
            description: 'Personal data breach notification event active; DPBI and affected data principals notified on breach; timeline per DPDP Rules (verify current notification status)',
            reference: 'DPDP Act s.8(6) -- notification to DPBI and affected data principals; Schedule 1 -- failure to notify: up to INR 200 crore penalty; DPDP Rules (under consultation) -- timeline',
            check: 'monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'in-dpdp-cross-border-whitelist',
            description: 'Cross-border data transfer restricted to Central Government-whitelisted countries only per s.16; PRC and other non-whitelisted jurisdictions blocked',
            reference: 'DPDP Act s.16 -- transfer of personal data outside India permitted only to countries notified by Central Government; s.16(2) -- exceptions may be specified by rules',
            check: 'subservice_registry_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'in-dpdp-purpose-limitation-deletion',
            description: 'Purpose limitation enforced; mandatory deletion of personal data on purpose completion or consent withdrawal per s.8(3)',
            reference: 'DPDP Act s.8(3) -- data fiduciary must erase personal data when purpose is fulfilled or consent is withdrawn; s.6(4) -- consent withdrawal triggers erasure',
            check: 'gdpr_purpose_limitation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'in-dpdp-data-principal-rights',
            description: 'Data principal rights handling gate active: access (s.11), correction/erasure (s.12), grievance redressal (s.13), nomination (s.14)',
            reference: 'DPDP Act s.11 -- right to information; s.12 -- right to correction, completion, updating, and erasure; s.13 -- right to grievance redressal; s.14 -- right to nominate',
            check: 'approval_queue_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'in-dpdp-sdf-dpia',
            description: 'Significant Data Fiduciary DPIA documentation maintained; DPO designation tracked; data audit records maintained per s.10',
            reference: 'DPDP Act s.10(2)(a) -- Data Protection Impact Assessment; s.10(2)(b) -- Data Protection Officer; s.10(2)(c) -- independent data audit; s.10(1) -- Central Government designation of significant data fiduciaries',
            check: 'gdpr_dpia_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'in-dpdp-encryption',
            description: 'Reasonable security safeguards for digital personal data active; encryption at rest and in transit per s.8(5)',
            reference: 'DPDP Act s.8(5) -- reasonable security safeguards; Schedule 1 -- data breach from inadequate security: up to INR 250 crore; DPDP Rules (under consultation) -- security standards',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'in-dpdp-audit-trail',
            description: 'Tamper-evident audit trail active for consent records, data principal rights requests, breach notifications, and cross-border transfer records; required for DPBI inquiry',
            reference: 'DPDP Act s.8(7) -- records of processing; s.20 -- DPBI inquiry powers; s.10(2)(c) -- SDF data audit; Schedule 1 -- penalty assessment evidence',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'in-dpdp-transparency-notice',
            description: 'Notice to data principal before consent: itemised, accessible language, contact details of DPO/grievance officer, manner of exercising rights',
            reference: 'DPDP Act s.5(1) -- notice contents; s.5(2) -- notice in English or scheduled language; s.6 -- consent on notice basis; s.13 -- grievance officer details in notice',
            check: 'transparency_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'in-dpdp-processor-contract',
            description: 'Data processor contractual safeguards active; processor processes only per data fiduciary instructions; sub-processor chain accountability maintained',
            reference: 'DPDP Act s.8(2) -- processor must process in accordance with agreement with data fiduciary; s.8(2) -- processor must implement security safeguards per s.8(5); processor sub-contracting controls',
            check: 'service_provider_contracts_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'in-dpdp-access-control',
            description: 'Access to digital personal data limited to authorised data fiduciary personnel; agent authentication enforced',
            reference: 'DPDP Act s.8(5) -- reasonable security safeguards; s.10 -- SDF additional access controls; DPDP Rules (under consultation) -- access control standards',
            check: 'rbac_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=in-dpdp.js.map