/**
 * GDPR per-framework narrative prompt context.
 *
 * Declares section headings, evidence-linkage requirements, and required
 * control mappings for GDPR compliance narratives.
 *
 * References:
 *   Regulation (EU) 2016/679 -- General Data Protection Regulation
 *   EDPB Guidelines 05/2020 on consent
 *   EDPB Guidelines 01/2022 on data subject rights
 *   CNIL/ICO guidance on AI and automated decision-making
 *
 * Spec: P4-AIR-02 AC 4-6
 *
 * @connexum/ai-governance
 */
export const GDPR_PROMPT_SPEC = {
    frameworkId: 'gdpr',
    frameworkName: 'GDPR',
    version: 'Regulation (EU) 2016/679 (applicable from 2018-05-25)',
    sections: [
        {
            sectionId: 'gdpr-art5-principles',
            heading: 'Article 5 Principles of Processing',
            regulatoryRef: 'GDPR Article 5(1)-(2)',
            requiredEventTypes: ['governance:verdict', 'action:denied'],
            controlMappings: [
                'Art. 5(1)(a) -- Lawfulness, fairness, and transparency',
                'Art. 5(1)(b) -- Purpose limitation',
                'Art. 5(1)(c) -- Data minimisation',
                'Art. 5(1)(d) -- Accuracy',
                'Art. 5(1)(e) -- Storage limitation',
                'Art. 5(1)(f) -- Integrity and confidentiality',
                'Art. 5(2) -- Accountability (controller responsibility to demonstrate compliance)',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Map AI agent governance controls to the Art. 5 processing principles. ' +
                'For Art. 5(1)(c) (data minimisation), cite deny-decision events where agents were ' +
                'refused access to data beyond the declared processing purpose. ' +
                'For Art. 5(1)(f) (integrity/confidentiality), cite governance verdicts enforcing ' +
                'encryption and access controls. For Art. 5(2) (accountability), this audit report ' +
                'itself is evidence of the accountability obligation. Quantify policy enforcement metrics.',
        },
        {
            sectionId: 'gdpr-art22-automated-decisions',
            heading: 'Article 22 Automated Individual Decision-Making',
            regulatoryRef: 'GDPR Article 22 / Recital 71',
            requiredEventTypes: ['approval:decided', 'governance:verdict'],
            controlMappings: [
                'Art. 22(1) -- Right not to be subject to solely automated decisions',
                'Art. 22(2)(b) -- Member State law permitting automated decisions with safeguards',
                'Art. 22(3) -- Suitable measures: right to human intervention, contest, explanation',
                'Art. 22(4) -- Prohibition on Art. 9 special category data in automated decisions',
                'Recital 71 -- Safeguards and right to explanation for automated processing',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Document human oversight controls satisfying Art. 22 for AI-driven decisions. ' +
                'Cite approval-decision events as evidence of human intervention in the AI decision loop. ' +
                'Quantify: automated decisions reviewed by humans, approval/rejection rates, and ' +
                'any cases where human reviewers overrode AI recommendations. ' +
                'Note any special category data processing flags in governance verdicts (Art. 22(4)). ' +
                'Describe the explanation/contest mechanism available to data subjects.',
        },
        {
            sectionId: 'gdpr-art25-privacy-by-design',
            heading: 'Article 25 Data Protection by Design and Default',
            regulatoryRef: 'GDPR Article 25',
            requiredEventTypes: ['agent:registered', 'governance:verdict'],
            controlMappings: [
                'Art. 25(1) -- Technical and organisational measures from design stage',
                'Art. 25(2) -- Default settings to process only necessary data',
                'EDPB Guidelines 4/2019 -- Data Protection by Design and by Default (2020)',
            ],
            citationRequirement: 'optional',
            promptGuidance: 'Describe privacy-by-design implementation in the AI governance platform. ' +
                'Explain how the compliance pack framework embeds data minimisation constraints at the ' +
                'agent registration stage (Art. 25(1)). Note default-deny posture as evidence of ' +
                'Art. 25(2) default settings. Reference governance verdicts as operational evidence ' +
                'that by-design controls fire in production, not just in documentation.',
        },
        {
            sectionId: 'gdpr-art32-security',
            heading: 'Article 32 Security of Processing',
            regulatoryRef: 'GDPR Article 32',
            requiredEventTypes: ['governance:verdict', 'action:denied'],
            controlMappings: [
                'Art. 32(1)(a) -- Pseudonymisation and encryption of personal data',
                'Art. 32(1)(b) -- Ongoing confidentiality, integrity, availability',
                'Art. 32(1)(c) -- Ability to restore availability after incident',
                'Art. 32(1)(d) -- Regular testing of technical and organisational measures',
                'Art. 32(2) -- Appropriate level of security given the nature of the risk',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Document technical security measures for Art. 32. ' +
                'For encryption (Art. 32(1)(a)), note SHA-256 chain integrity and TLS transport. ' +
                'For confidentiality (Art. 32(1)(b)), cite deny-decision events as access control evidence. ' +
                'For testing (Art. 32(1)(d)), reference pen-test gate results if available in audit chain. ' +
                'Quantify: security enforcement events, access denials, and any integrity check failures. ' +
                'Note the risk-proportionate nature of controls relative to the data categories processed.',
        },
        {
            sectionId: 'gdpr-art33-breach-notification',
            heading: 'Article 33-34 Personal Data Breach Notification',
            regulatoryRef: 'GDPR Article 33-34',
            requiredEventTypes: ['incident:created'],
            controlMappings: [
                'Art. 33(1) -- Notify supervisory authority within 72 hours of breach awareness',
                'Art. 33(3) -- Required notification content (nature, DPO, consequences, measures)',
                'Art. 33(4) -- Documentation of breaches by controller',
                'Art. 34(1) -- Notification to data subjects when high risk',
                'Art. 34(3) -- Exemptions to data subject notification',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Summarise breach notification posture for the review period. ' +
                'For any incident events, determine if a personal data breach occurred under Art. 4(12). ' +
                'Document the 72-hour supervisory authority notification timeline for qualifying breaches. ' +
                'Document the high-risk assessment and any data subject notifications under Art. 34(1). ' +
                'If no breaches occurred, document this with chain evidence and note Art. 33(4) ' +
                'internal breach register maintenance as ongoing compliance evidence.',
        },
    ],
};
//# sourceMappingURL=gdpr.js.map