/**
 * South Korea PIPA (Personal Information Protection Act) Compliance Pack
 *
 * Regulation: Personal Information Protection Act (개인정보 보호법)
 *             Act No. 10465 of 2011; comprehensively amended 2023 (Act No. 19234)
 *             2023 amendments effective 15 September 2023
 *
 * Jurisdiction: KR (South Korea / Republic of Korea)
 * Regulator: Personal Information Protection Commission (PIPC, 개인정보보호위원회)
 *             Established as independent authority 2020; strengthened powers under 2023 amendment
 *
 * Scope:
 *   Applies to any personal information processor (개인정보처리자) that handles
 *   personal information of data subjects in Korea, including overseas entities
 *   (extra-territorial scope applied in practice by PIPC).
 *
 * Key data categories:
 *   1. Personal information (개인정보): any information relating to an identified or
 *      identifiable living individual including name, RRN, image.
 *   2. Sensitive information (민감정보): ideology, belief, union membership, political
 *      views, health/medical data, sexual life, genetic info, criminal records,
 *      unique identifiers (biometric data creating unique templates).
 *      Requires separate, explicit opt-in consent.
 *   3. Unique identifier information (고유식별정보): Resident Registration Number (RRN,
 *      주민등록번호), passport number, driver's license number, foreigner registration
 *      number. SEVERELY RESTRICTED -- RRN processing requires specific legal basis
 *      AND additional security measures. Cannot be processed solely on consent.
 *   4. Pseudonymized data (가명정보): de-identified but re-linkable; 2020 amendment
 *      permits statistical, research, and public interest use without consent.
 *   5. Anonymized data (익명정보): irreversibly de-identified; outside PIPA scope.
 *
 * Key obligations:
 *   1. Separate opt-in consent for sensitive information (cannot be bundled with
 *      general consent).
 *   2. Additional protections for unique identifiers (RRN cannot be processed based
 *      on consent alone -- requires statutory exception).
 *   3. Purpose limitation: strict; processing beyond original purpose requires
 *      new consent or specific compatibility analysis.
 *   4. Third-party provision consent: required before providing personal information
 *      to third parties.
 *   5. Cross-border transfer: consent or PIPC-approved adequacy/safeguards required.
 *   6. Data subject rights (2023 amendment expanded):
 *      - Access, correction, deletion, processing-stop
 *      - Portability (신설, added by 2023 amendment)
 *      - Explanation and objection to automated decisions (2023 amendment)
 *   7. CPO (Chief Privacy Officer, 개인정보 보호책임자) designation: mandatory.
 *   8. Automated decision explanation and objection: 2023 amendment requires
 *      entities making automated decisions that significantly affect data subjects
 *      to explain the basis and allow objection.
 *   9. Breach notification to PIPC and affected individuals within 72 hours for
 *      serious incidents (verify current PIPC rules as timeline requirements evolve).
 *      RRN breach has expedited rules.
 *
 * Critical RRN rule:
 *   Processing of Resident Registration Number (주민등록번호) is SEVERELY RESTRICTED.
 *   RRN cannot be collected/processed based solely on consent -- requires:
 *   (a) a specific statutory provision permitting RRN processing, or
 *   (b) PIPC determination that RRN processing is necessary.
 *   Any RRN handling must be flagged for additional consent + legal basis review.
 *   Pack should BLOCK RRN processing without verified statutory basis.
 *
 * Retention:
 *   Per purpose; mandatory deletion when purpose achieved.
 *   PIPC can mandate deletion even before consent expiry if purpose is completed.
 *
 * @connexum/ai-governance
 */
export const KR_PIPA_CATEGORY_CLASSIFIERS = {
    PERSONAL_INFORMATION_KOREA: {
        references: ['PIPA Art. 2(1) -- personal information (개인정보) defined; name, RRN, image, and any identifying information'],
        classifier: (input) => {
            if (/\b(?:개인정보|gaeinjungbo|korea\s+personal\s+information|south\s+korea\s+personal\s+data|korean\s+pii|pipa\s+personal\s+data)\b/i.test(input))
                return true;
            if (/\b(?:kr\s+personal\s+data|pipa\s+data|korea\s+data\s+subject|korean\s+resident\s+data|한국\s+개인정보)\b/i.test(input))
                return true;
            if (/\b(?:korea\s+customer\s+data\s+pipa|south\s+korea\s+pii|republic\s+of\s+korea\s+personal\s+data)\b/i.test(input))
                return true;
            return false;
        },
    },
    SENSITIVE_INFORMATION_KOREA: {
        references: ['PIPA Art. 23 -- sensitive information (민감정보): ideology, belief, union membership, political views, health, sexual life, genetic info, criminal records, biometric templates'],
        classifier: (input) => {
            if (/\b(?:민감정보|mingam\s+jeongbo|sensitive\s+information\s+korea|pipa\s+sensitive\s+data|korean\s+sensitive\s+info)\b/i.test(input))
                return true;
            if (/\b(?:ideology\s+korea|belief\s+korea\s+pipa|union\s+membership\s+korea|health\s+data\s+korea\s+pipa|genetic\s+info\s+korea)\b/i.test(input))
                return true;
            if (/\b(?:sexual\s+life\s+korea\s+pipa|criminal\s+record\s+korea\s+pipa|biometric\s+template\s+korea|pipa\s+art\s*\.?\s*23)\b/i.test(input))
                return true;
            return false;
        },
    },
    UNIQUE_IDENTIFIER_INFORMATION: {
        references: ['PIPA Art. 24 -- unique identifier information (고유식별정보): RRN (주민등록번호), passport, driver\'s license, foreigner registration; Art. 24-2 -- RRN special restrictions'],
        classifier: (input) => {
            if (/\b(?:고유식별정보|resident\s+registration\s+number|주민등록번호|rrn\s+korea|korean\s+rrn|south\s+korea\s+rrn)\b/i.test(input))
                return true;
            if (/\b(?:unique\s+identifier\s+korea|pipa\s+art\s*\.?\s*24|korean\s+passport\s+number|korean\s+driver.s\s+license|foreigner\s+registration\s+korea)\b/i.test(input))
                return true;
            if (/\b(?:주민번호|korean\s+id\s+number\s+pipa|korean\s+national\s+id\s+restricted|rrn\s+pipa\s+restriction)\b/i.test(input))
                return true;
            // RRN pattern: 13 digits (YYMMDD-NNNNNNN)
            if (/\b\d{6}-\d{7}\b/.test(input))
                return true;
            return false;
        },
    },
    PSEUDONYMIZED_DATA_KOREA: {
        references: ['PIPA Art. 28-2 -- pseudonymized data (가명정보): de-identified but re-linkable; may be used for statistics, research, public interest without consent under 2020 amendment'],
        classifier: (input) => {
            if (/\b(?:가명정보|pseudonymized\s+data\s+korea|pipa\s+gamingjungbo|korean\s+pseudonymized|pipa\s+art\s*\.?\s*28.2)\b/i.test(input))
                return true;
            if (/\b(?:korea\s+pseudonymization|pipa\s+pseudonymous\s+data|korean\s+de.identified\s+re.linkable)\b/i.test(input))
                return true;
            return false;
        },
    },
    CROSS_BORDER_TRANSFER_KOREA: {
        references: ['PIPA Art. 28-8 (2023 amendment) -- cross-border transfer (국외이전): consent or PIPC-approved adequacy/safeguards'],
        classifier: (input) => {
            if (/\b(?:국외이전|cross.border\s+transfer\s+korea|pipa\s+cross.border|korea\s+data\s+transfer\s+overseas|south\s+korea\s+cross.border\s+data)\b/i.test(input))
                return true;
            if (/\b(?:pipa\s+art\s*\.?\s*28.8|korea\s+data\s+export|pipc\s+adequacy|korean\s+overseas\s+transfer\s+safeguards)\b/i.test(input))
                return true;
            return false;
        },
    },
    AUTOMATED_DECISION_KOREA: {
        references: ['PIPA Art. 37-2 (2023 amendment) -- automated decision-making: right to explanation and objection for decisions significantly affecting data subjects'],
        classifier: (input) => {
            if (/\b(?:automated\s+decision\s+korea|pipa\s+automated\s+decision|pipa\s+art\s*\.?\s*37.2|korea\s+automated\s+processing\s+rights)\b/i.test(input))
                return true;
            if (/\b(?:korean\s+automated\s+decision\s+objection|pipa\s+2023\s+automated|south\s+korea\s+ai\s+decision\s+explanation|pipa\s+profiling\s+rights)\b/i.test(input))
                return true;
            return false;
        },
    },
    THIRD_PARTY_PROVISION_KOREA: {
        references: ['PIPA Art. 17 -- third-party provision of personal information requires consent; Art. 18 -- restrictions on purpose-beyond use and third-party provision'],
        classifier: (input) => {
            if (/\b(?:third.party\s+provision\s+korea|pipa\s+daisam\s+jeja|korea\s+personal\s+data\s+transfer\s+third.party|pipa\s+art\s*\.?\s*17)\b/i.test(input))
                return true;
            if (/\b(?:korean\s+third\s+party\s+consent|pipa\s+third.party\s+transfer\s+consent|korea\s+data\s+provision\s+consent)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['PIPA Art. 2(1) -- personal information; Art. 24-2 -- RRN restricted processing'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            // RRN pattern
            if (/\b\d{6}-\d{7}\b/.test(input))
                return true;
            if (/\b(?:주민등록번호|resident\s+registration\s+number|korean\s+national\s+id|korean\s+ssn)\b/i.test(input))
                return true;
            if (/\b(?:이름|성명|주소|전화번호|생년월일)\s*[:：]/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['PIPA Art. 29 -- security measures; PIPC guidelines on technical and administrative security safeguards'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const KR_PIPA_PACK = {
    categoryClassifiers: KR_PIPA_CATEGORY_CLASSIFIERS,
    id: 'kr-pipa',
    aliases: [],
    name: 'South Korea PIPA (Personal Information Protection Act)',
    version: '1.0.0',
    contentHash: 'fa1781828a9ea68bd88650243fe420384dfc46b0b99c634a5196b8ebbaaf1bec',
    description: 'South Korea Personal Information Protection Act (개인정보 보호법, Act No. 10465, comprehensively amended 2023). Governed by PIPC (개인정보보호위원회). Key obligations: (1) separate opt-in consent for sensitive information (ideology, belief, union membership, political views, health, sexual life, genetic info, criminal records); (2) severely restricted unique identifier processing -- Resident Registration Number (RRN, 주민등록번호) requires specific statutory basis, cannot be collected on consent alone; (3) strict purpose limitation; (4) third-party provision consent; (5) cross-border transfer consent or PIPC-approved adequacy/safeguards; (6) expanded data subject rights under 2023 amendment including portability and automated decision objection; (7) mandatory CPO (Chief Privacy Officer) designation; (8) breach notification to PIPC and individuals within 72 hours for serious incidents. RRN processing BLOCKED without verified statutory basis.',
    authority: 'Personal Information Protection Commission (PIPC, 개인정보보호위원회) -- South Korea',
    industries: ['all', 'technology', 'financial-services', 'healthcare', 'retail', 'telecommunications', 'public-sector', 'manufacturing'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Hard gates: (1) sensitive information separate opt-in consent verification before processing; (2) RRN processing blocked without verified statutory legal basis (consent alone is insufficient); (3) purpose limitation strict enforcement; (4) automated decision objection workflow for significant decisions affecting Korean data subjects.',
            reference: 'PIPA Art. 23 -- sensitive information separate consent; Art. 24-2 -- RRN statutory basis requirement (consent insufficient); Art. 18 -- purpose limitation; Art. 37-2 (2023) -- automated decision objection',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human review gate before: (1) sensitive information processing -- verify separate consent; (2) RRN processing -- verify statutory legal basis + additional security measures; (3) third-party provision -- verify consent; (4) cross-border transfer -- verify consent or PIPC adequacy/safeguards; (5) significant automated decisions -- ensure explanation and objection pathway.',
            reference: 'PIPA Art. 23 -- sensitive info pre-processing review; Art. 24-2 -- RRN statutory basis review; Art. 17 -- third-party provision consent; Art. 28-8 -- cross-border transfer gate; Art. 37-2 -- automated decision prior review',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify: personal information (개인정보), sensitive information (민감정보), unique identifier information (고유식별정보 including RRN), pseudonymized data (가명정보), cross-border transfer records, automated decision records, third-party provision records. Distinct BLOCK/WARN actions per category.',
            reference: 'PIPA Art. 2 -- personal information; Art. 23 -- sensitive information categories; Art. 24 -- unique identifier categories; Art. 24-2 -- RRN restrictions; Art. 28-2 -- pseudonymized data classification',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail for: consent records, RRN statutory basis records, third-party provision logs, cross-border transfer records, automated decision records (explanation and objection), breach notification records. Required for PIPC inspection.',
            reference: 'PIPA Art. 32 -- record-keeping obligations; Art. 37 -- data subject request records; PIPC inspection powers; Art. 37-2 (2023) -- automated decision audit trail; breach notification audit',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'CPO (Chief Privacy Officer, 개인정보 보호책임자) designation documentation; privacy policy publication; RRN statutory basis documentation; third-party provision record lifecycle; cross-border transfer contractual safeguards; automated decision basis documentation.',
            reference: 'PIPA Art. 31 -- CPO mandatory designation; Art. 30 -- privacy policy publication obligation; Art. 24-2 -- RRN processing basis; Art. 17 -- third-party provision records; Art. 28-8 -- cross-border safeguards documentation; Art. 37-2 -- automated decision basis records',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Sensitive information, unique identifier information (especially RRN), and personal information encrypted at rest and in transit per PIPA Art. 29 security obligation and PIPC technical security guidelines. RRN requires encrypted storage with restricted access.',
            reference: 'PIPA Art. 29 -- technical and administrative security measures; PIPC Technical Guidelines -- encryption mandatory for unique identifiers and sensitive information; RRN encrypted storage requirement',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Breach notification workflow: serious incidents trigger PIPC notification (72-hour window) and affected individual notification. RRN breach has expedited reporting requirements. Automated decision objection event workflow. Cross-border transfer incident escalation.',
            reference: 'PIPA Art. 34 -- breach notification obligation; PIPC guidelines on 72-hour serious incident notification; Art. 24-2 -- RRN breach expedited rules; Art. 37-2 (2023) -- automated decision objection event handling',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Personal information processing consignment (처리위탁): PIPA requires written contracts with consigned processors including purpose limitation, security obligations, and re-entrustment restrictions. Cross-border transfer recipients must maintain equivalent PIPA protections.',
            reference: 'PIPA Art. 26 -- consignment of personal information processing; written contract requirements; security and purpose limitation obligations on consignee; Art. 28-8 -- cross-border transfer recipient safeguards',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-purpose retention with mandatory deletion when purpose achieved. PIPC can mandate early deletion. Pseudonymized data (가명정보) retention and separation controls. Third-party provision records and automated decision records retained per PIPC guidelines.',
            reference: 'PIPA Art. 21 -- mandatory deletion when purpose achieved; PIPC deletion guidelines; Art. 28-2 -- pseudonymized data retention separation; Art. 37 -- data subject request response retention; Art. 37-2 -- automated decision record retention',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Privacy policy publication (mandatory). Notice at collection including purpose, categories, retention period. Cross-border transfer destination and safeguards disclosure. Automated decision explanation to data subjects on request. Opt-out procedure disclosure.',
            reference: 'PIPA Art. 30 -- mandatory privacy policy publication; Art. 22 -- consent notice requirements; Art. 28-8 -- cross-border transfer disclosure; Art. 37-2 (2023) -- automated decision explanation obligation; Art. 22-2 -- consent withdrawal and opt-out',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: '2023 amendment automated decision rules: automated decisions significantly affecting data subjects must not produce discriminatory outcomes. Monitor AI outputs for bias against individuals based on sensitive information categories (ideology, health, disability, criminal record).',
            reference: 'PIPA Art. 37-2 (2023 amendment) -- automated decision non-discrimination obligation; Art. 23 -- sensitive information categories must not be used for discriminatory automated decisions; PIPC AI guidance on fairness',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            sensitiveInformationSeparateConsentGateRequired: true,
            rrnStatutoryBasisGateRequired: true,
            rrnConsentAloneInsufficientEnforced: true,
            purposeLimitationStrictRequired: true,
            automatedDecisionObjectionWorkflowRequired: true,
            uniqueIdentifierAdditionalSecurityRequired: true,
        },
        'approval-queue': {
            sensitiveInformationPreProcessingReviewRequired: true,
            rrnStatutoryBasisVerificationRequired: true,
            thirdPartyProvisionConsentVerificationRequired: true,
            crossBorderTransferGateRequired: true,
            automatedDecisionPriorReviewRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['PERSONAL_INFORMATION_KOREA', 'SENSITIVE_INFORMATION_KOREA', 'UNIQUE_IDENTIFIER_INFORMATION', 'PSEUDONYMIZED_DATA_KOREA', 'CROSS_BORDER_TRANSFER_KOREA', 'AUTOMATED_DECISION_KOREA', 'THIRD_PARTY_PROVISION_KOREA', 'PII', 'CREDENTIALS'],
            personalInformationKoreaAction: 'WARN',
            sensitiveInformationKoreaAction: 'BLOCK',
            uniqueIdentifierAction: 'BLOCK',
            pseudonymizedDataAction: 'WARN',
            crossBorderTransferAction: 'WARN',
            automatedDecisionAction: 'WARN',
            credentialsAction: 'BLOCK',
        },
        'transparency-injector': {
            privacyPolicyPublicationRequired: true,
            collectionNoticeRequired: true,
            crossBorderTransferDisclosureRequired: true,
            automatedDecisionExplanationRequired: true,
            consentWithdrawalOptOutRequired: true,
            aiUseDisclosureRequired: true,
        },
        'attestation-manager': {
            cpoDesignationRequired: true,
            privacyPolicyRecordRequired: true,
            rrnStatutoryBasisDocumentationRequired: true,
            thirdPartyProvisionRecordLifecycleRequired: true,
            crossBorderSafeguardsDocumentationRequired: true,
            automatedDecisionBasisDocumentationRequired: true,
        },
        'event-bus': {
            breachNotificationPipcDeadlineHours: 72,
            affectedIndividualBreachNotificationRequired: true,
            rrnBreachExpeditedRulesRequired: true,
            automatedDecisionObjectionEventRequired: true,
        },
        'session-persistence': {
            mandatoryDeletionWhenPurposeAchievedRequired: true,
            pseudonymizedDataRetentionSeparationRequired: true,
            thirdPartyProvisionRecordRetentionDays: 1095, // 3 years standard
            automatedDecisionRecordRetentionRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-KR', 'PROCESSOR-CONTRACT-PIPA', 'CROSS-BORDER-TRANSFER-SAFEGUARDS'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law. PIPC has not granted adequacy to PRC. Transfer of Korean personal information, sensitive information, and RRN data to PRC violates PIPA Art. 28-8 cross-border transfer rules. PRC government access obligations are incompatible with PIPA-required equivalent protections.',
            baidu: 'PRC jurisdiction. No PIPC adequacy determination for PRC. Transfer of Korean personal information including unique identifiers (RRN) and sensitive information to PRC creates severe PIPA compliance violations and PIPC enforcement risk.',
            alibaba: 'PRC jurisdiction. No PIPC adequacy determination for PRC. Transfer of Korean personal information and sensitive categories to PRC is incompatible with PIPA Art. 28-8 requirements for equivalent safeguards.',
        },
    },
    dataPolicy: {
        scanCategories: ['PERSONAL_INFORMATION_KOREA', 'SENSITIVE_INFORMATION_KOREA', 'UNIQUE_IDENTIFIER_INFORMATION', 'PSEUDONYMIZED_DATA_KOREA', 'CROSS_BORDER_TRANSFER_KOREA', 'AUTOMATED_DECISION_KOREA', 'THIRD_PARTY_PROVISION_KOREA', 'PII', 'CREDENTIALS'],
        categoryActions: {
            PERSONAL_INFORMATION_KOREA: 'WARN',
            SENSITIVE_INFORMATION_KOREA: 'BLOCK',
            UNIQUE_IDENTIFIER_INFORMATION: 'BLOCK',
            PSEUDONYMIZED_DATA_KOREA: 'WARN',
            CROSS_BORDER_TRANSFER_KOREA: 'WARN',
            AUTOMATED_DECISION_KOREA: 'WARN',
            THIRD_PARTY_PROVISION_KOREA: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // Per purpose; mandatory deletion when purpose achieved.
        // No fixed statutory minimum for general data.
        // Using 3 years as operational baseline; RRN records 5 years for compliance evidence.
        auditLogRetentionDays: 1825, // 5 years
        sessionRetentionDays: 1095, // 3 years general
        incidentRetentionDays: 1825, // 5 years for breach records
        reference: 'PIPA Art. 21 -- mandatory deletion when purpose achieved; PIPC deletion mandate authority; third-party provision records per PIPC guidelines; breach notification records 5 years; automated decision records per Art. 37-2',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['kr'],
    },
    incidentPolicy: {
        // PIPA Art. 34 + PIPC guidelines: 72-hour notification for serious incidents.
        // RRN breach has expedited requirements.
        // Verify current PIPC rules for exact deadlines as requirements evolve.
        notificationDeadlineHours: 72,
        reference: 'PIPA Art. 34 -- breach notification obligation; PIPC guidelines on 72-hour serious incident notification to PIPC and affected individuals; Art. 24-2 -- RRN breach expedited reporting; PIPC enforcement actions for delayed notification',
        requiredRecipients: ['pipc-korea', 'affected-individuals', 'chief-privacy-officer', 'chief-compliance-officer'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'kr-pipa-sensitive-info-separate-consent',
            description: 'Sensitive information separate opt-in consent gate ACTIVE: ideology, belief, union membership, political views, health, sexual life, genetic info, and criminal records BLOCKED without separate explicit consent. Bundled consent is rejected.',
            reference: 'PIPA Art. 23 -- sensitive information (민감정보) requires separate explicit consent; cannot be bundled with general personal information consent; PIPC guidance on separate consent requirement',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'kr-pipa-rrn-statutory-basis-gate',
            description: 'RRN (Resident Registration Number, 주민등록번호) hard gate ACTIVE: RRN processing BLOCKED unless verified statutory legal basis on file. Consent alone is insufficient for RRN processing. Additional security measures required for any permitted RRN handling.',
            reference: 'PIPA Art. 24-2 -- RRN processing requires specific statutory provision; consent alone insufficient; §24-2(1) -- only legal basis exceptions permitted; severe penalties for unauthorized RRN processing',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'kr-pipa-purpose-limitation',
            description: 'Strict purpose limitation gate ACTIVE: personal information processed only for declared purposes. Processing beyond original purpose requires new consent or specific compatibility analysis. Purpose gate enforced before AI inference.',
            reference: 'PIPA Art. 18 -- purpose limitation and restrictions on beyond-purpose use; Art. 15 -- collection purpose specification; Art. 16 -- minimum collection principle',
            check: 'approval_queue_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'kr-pipa-automated-decision-objection',
            description: '2023 amendment automated decision rights ACTIVE: automated decisions significantly affecting Korean data subjects include explanation pathway and objection workflow. AI decisions subject to this provision require prior review before deployment.',
            reference: 'PIPA Art. 37-2 (2023 amendment) -- right to explanation and objection for significant automated decisions; PIPC guidance on automated decision-making and AI; effective 15 September 2023',
            check: 'monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'kr-pipa-cross-border-transfer-gate',
            description: 'Cross-border transfer gate ACTIVE: data transfer to third countries requires consent or PIPC-approved adequacy/contractual safeguards. Non-adequate countries require written consent with disclosure of recipient country and safeguards.',
            reference: 'PIPA Art. 28-8 (2023 amendment) -- cross-border transfer consent or PIPC adequacy/safeguards; disclosure of recipient country required; equivalent protection standard for safeguards',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'kr-pipa-breach-notification-pipc',
            description: 'PIPC breach notification workflow ACTIVE: serious incidents trigger 72-hour PIPC notification and affected individual notification. RRN breaches subject to expedited rules. Breach detection and escalation monitoring active.',
            reference: 'PIPA Art. 34 -- breach notification obligation; PIPC guidelines on 72-hour serious incident notification; Art. 24-2 -- RRN breach expedited reporting; PIPC enforcement penalties for delayed notification',
            check: 'event_bus_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'kr-pipa-cpo-designation',
            description: 'CPO (Chief Privacy Officer, 개인정보 보호책임자) designation documented; privacy policy publicly published; RRN statutory basis documentation on file; third-party provision and consignment records maintained.',
            reference: 'PIPA Art. 31 -- mandatory CPO designation (개인정보 보호책임자); Art. 30 -- privacy policy publication; Art. 24-2 -- RRN basis documentation; Art. 26 -- consignment records',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'kr-pipa-transparency-disclosures',
            description: 'Mandatory disclosures ACTIVE: privacy policy published; collection notice including purpose, categories, retention; cross-border transfer destination and safeguards disclosed; automated decision explanation provided on request.',
            reference: 'PIPA Art. 30 -- privacy policy; Art. 22 -- consent notice; Art. 28-8 -- cross-border transfer disclosure; Art. 37-2 -- automated decision explanation; Art. 22-2 -- consent withdrawal disclosure',
            check: 'transparency_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'kr-pipa-unique-identifier-encryption',
            description: 'Unique identifier information (RRN, passport, driver\'s license) encrypted with restricted access. Sensitive information encrypted at rest and in transit per PIPA Art. 29 and PIPC Technical Guidelines.',
            reference: 'PIPA Art. 29 -- technical and administrative security measures; PIPC Technical Guidelines -- encryption mandatory for unique identifiers and sensitive information; RRN encrypted storage with access controls',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'kr-pipa-consignment-contracts',
            description: 'Processing consignment (처리위탁) contracts ACTIVE: written agreements with consigned processors include purpose limitation, security, re-entrustment restrictions; cross-border recipients maintain equivalent PIPA protections.',
            reference: 'PIPA Art. 26 -- consignment of personal information processing; written contract mandatory; security and purpose limitation on consignee; Art. 28-8 -- cross-border recipient equivalent protections',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'kr-pipa-portability-rights',
            description: 'Data portability rights (2023 amendment) workflow ACTIVE: data subjects can request portability of personal information to themselves or third parties; portability request handling within statutory response period.',
            reference: 'PIPA Art. 35-2 (2023 amendment) -- data portability right newly added; PIPC guidelines on portability implementation; response within statutory period',
            // F-NEW-VERA-PACK-C3-01 (2026-05-03): renamed from borrowed bias_monitor_active check.
            // Portability rights require session-persistence (to track portability request state across
            // the statutory response window) and approval-queue (human confirmation before exporting
            // personal information to a third party on behalf of the data subject). bias-monitor is
            // semantically unrelated to portability and was borrowed incorrectly.
            check: 'kr_pipa_portability_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=kr-pipa.js.map