/**
 * GDPR Controls
 *
 * General Data Protection Regulation (EU 2016/679)
 * Articles relevant to software security and data protection.
 *
 * @module compliance/gdpr
 */
/**
 * GDPR article categories relevant to software security
 */
export const GDPR_CATEGORIES = [
    "Principles",
    "Data Subject Rights",
    "Controller Obligations",
    "Security",
    "Breach Notification",
    "Data Protection by Design",
];
/**
 * GDPR controls relevant to code security and data protection
 */
export const GDPR_CONTROLS = [
    // Chapter II - Principles (Articles 5-11)
    {
        id: "GDPR-5.1.a",
        framework: "GDPR",
        category: "Principles",
        title: "Lawfulness, Fairness, Transparency",
        description: "Personal data shall be processed lawfully, fairly, and in a transparent manner.",
        keywords: ["lawfulness", "transparency", "consent", "legal-basis"],
        findingCategories: ["privacy", "consent"],
    },
    {
        id: "GDPR-5.1.b",
        framework: "GDPR",
        category: "Principles",
        title: "Purpose Limitation",
        description: "Collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible.",
        keywords: ["purpose-limitation", "data-collection", "processing"],
        findingCategories: ["data-handling", "privacy"],
    },
    {
        id: "GDPR-5.1.c",
        framework: "GDPR",
        category: "Principles",
        title: "Data Minimization",
        description: "Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.",
        keywords: ["data-minimization", "necessity", "relevance"],
        findingCategories: ["data-handling", "data-exposure"],
    },
    {
        id: "GDPR-5.1.d",
        framework: "GDPR",
        category: "Principles",
        title: "Accuracy",
        description: "Accurate and, where necessary, kept up to date; inaccurate data erased or rectified without delay.",
        keywords: ["accuracy", "data-quality", "rectification"],
        findingCategories: ["data-handling", "integrity"],
    },
    {
        id: "GDPR-5.1.e",
        framework: "GDPR",
        category: "Principles",
        title: "Storage Limitation",
        description: "Kept in a form which permits identification of data subjects for no longer than necessary.",
        keywords: ["retention", "storage-limitation", "deletion"],
        findingCategories: ["data-handling", "data-retention"],
    },
    {
        id: "GDPR-5.1.f",
        framework: "GDPR",
        category: "Principles",
        title: "Integrity and Confidentiality",
        description: "Processed in a manner that ensures appropriate security, including protection against unauthorized processing, loss, destruction, or damage.",
        keywords: ["integrity", "confidentiality", "security", "protection"],
        findingCategories: ["security", "encryption", "access-control"],
        cweIds: ["CWE-311", "CWE-312", "CWE-284"],
    },
    // Chapter III - Rights of Data Subject (Articles 12-23)
    {
        id: "GDPR-15",
        framework: "GDPR",
        category: "Data Subject Rights",
        title: "Right of Access",
        description: "Data subject shall have the right to obtain confirmation whether personal data is being processed and access to the data.",
        keywords: ["access-right", "data-subject", "transparency"],
        findingCategories: ["privacy", "data-handling"],
    },
    {
        id: "GDPR-17",
        framework: "GDPR",
        category: "Data Subject Rights",
        title: "Right to Erasure (Right to be Forgotten)",
        description: "Data subject shall have the right to obtain erasure of personal data without undue delay.",
        keywords: ["erasure", "deletion", "right-to-be-forgotten"],
        findingCategories: ["data-handling", "data-retention"],
    },
    {
        id: "GDPR-20",
        framework: "GDPR",
        category: "Data Subject Rights",
        title: "Right to Data Portability",
        description: "Data subject shall have the right to receive personal data in a structured, commonly used, machine-readable format.",
        keywords: ["portability", "data-export", "interoperability"],
        findingCategories: ["data-handling"],
    },
    // Chapter IV - Controller and Processor (Articles 24-43)
    {
        id: "GDPR-24",
        framework: "GDPR",
        category: "Controller Obligations",
        title: "Responsibility of the Controller",
        description: "Controller shall implement appropriate technical and organizational measures to ensure processing is performed in accordance with GDPR.",
        keywords: ["controller", "responsibility", "measures"],
        findingCategories: ["security", "compliance"],
    },
    {
        id: "GDPR-25.1",
        framework: "GDPR",
        category: "Data Protection by Design",
        title: "Data Protection by Design",
        description: "Implement appropriate technical and organizational measures designed to implement data-protection principles effectively.",
        keywords: ["privacy-by-design", "data-protection", "design"],
        findingCategories: ["security", "privacy", "architecture"],
        cweIds: ["CWE-284"],
    },
    {
        id: "GDPR-25.2",
        framework: "GDPR",
        category: "Data Protection by Design",
        title: "Data Protection by Default",
        description: "Implement appropriate technical and organizational measures for ensuring that, by default, only personal data necessary for each specific purpose is processed.",
        keywords: ["privacy-by-default", "data-minimization", "default-settings"],
        findingCategories: ["privacy", "data-handling", "configuration"],
    },
    {
        id: "GDPR-28",
        framework: "GDPR",
        category: "Controller Obligations",
        title: "Processor Requirements",
        description: "Processing by a processor shall be governed by a contract requiring sufficient guarantees for appropriate technical and organizational measures.",
        keywords: ["processor", "contract", "third-party"],
        findingCategories: ["third-party", "compliance"],
    },
    {
        id: "GDPR-30",
        framework: "GDPR",
        category: "Controller Obligations",
        title: "Records of Processing Activities",
        description: "Maintain a record of processing activities under its responsibility.",
        keywords: ["records", "documentation", "processing-activities"],
        findingCategories: ["logging", "documentation"],
    },
    // Security of Processing (Article 32)
    {
        id: "GDPR-32.1.a",
        framework: "GDPR",
        category: "Security",
        title: "Pseudonymisation and Encryption",
        description: "Implement pseudonymisation and encryption of personal data.",
        keywords: ["pseudonymisation", "encryption", "cryptography"],
        findingCategories: ["encryption", "data-protection"],
        cweIds: ["CWE-311", "CWE-312", "CWE-327"],
    },
    {
        id: "GDPR-32.1.b",
        framework: "GDPR",
        category: "Security",
        title: "Confidentiality, Integrity, Availability, Resilience",
        description: "Ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.",
        keywords: ["confidentiality", "integrity", "availability", "resilience", "CIA"],
        findingCategories: ["security", "availability", "integrity"],
        cweIds: ["CWE-284", "CWE-354"],
    },
    {
        id: "GDPR-32.1.c",
        framework: "GDPR",
        category: "Security",
        title: "Restore Availability and Access",
        description: "Ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.",
        keywords: ["disaster-recovery", "backup", "business-continuity"],
        findingCategories: ["availability", "backup", "disaster-recovery"],
    },
    {
        id: "GDPR-32.1.d",
        framework: "GDPR",
        category: "Security",
        title: "Testing, Assessing, Evaluating Effectiveness",
        description: "Process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures.",
        keywords: ["testing", "assessment", "security-testing"],
        findingCategories: ["security", "testing"],
    },
    {
        id: "GDPR-32.2",
        framework: "GDPR",
        category: "Security",
        title: "Risk Assessment for Security",
        description: "In assessing the appropriate level of security, account shall be taken of risks of accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.",
        keywords: ["risk-assessment", "security-assessment", "threat-modeling"],
        findingCategories: ["security", "risk"],
        cweIds: ["CWE-200", "CWE-284"],
    },
    // Breach Notification (Articles 33-34)
    {
        id: "GDPR-33",
        framework: "GDPR",
        category: "Breach Notification",
        title: "Notification of Breach to Authority",
        description: "In case of a personal data breach, notify the supervisory authority within 72 hours.",
        keywords: ["breach-notification", "incident-response", "reporting"],
        findingCategories: ["incident-response", "logging"],
    },
    {
        id: "GDPR-34",
        framework: "GDPR",
        category: "Breach Notification",
        title: "Communication of Breach to Data Subject",
        description: "When the personal data breach is likely to result in a high risk, communicate the breach to the data subject without undue delay.",
        keywords: ["breach-notification", "data-subject", "communication"],
        findingCategories: ["incident-response"],
    },
    // Data Protection Impact Assessment (Article 35)
    {
        id: "GDPR-35",
        framework: "GDPR",
        category: "Data Protection by Design",
        title: "Data Protection Impact Assessment",
        description: "Where processing is likely to result in a high risk to rights and freedoms, carry out a data protection impact assessment (DPIA).",
        keywords: ["DPIA", "impact-assessment", "risk-assessment", "privacy"],
        findingCategories: ["privacy", "risk"],
    },
    // Additional Security-Related Controls
    {
        id: "GDPR-Auth",
        framework: "GDPR",
        category: "Security",
        title: "Authentication Controls",
        description: "Implement proper authentication mechanisms to verify identity before granting access to personal data.",
        keywords: ["authentication", "login", "identity", "password"],
        findingCategories: ["authentication"],
        cweIds: ["CWE-287", "CWE-306", "CWE-521"],
    },
    {
        id: "GDPR-AuthZ",
        framework: "GDPR",
        category: "Security",
        title: "Authorization Controls",
        description: "Implement proper authorization to ensure users can only access personal data they are entitled to.",
        keywords: ["authorization", "access-control", "permissions", "RBAC"],
        findingCategories: ["authorization", "access-control"],
        cweIds: ["CWE-284", "CWE-285", "CWE-862", "CWE-863"],
    },
    {
        id: "GDPR-Input",
        framework: "GDPR",
        category: "Security",
        title: "Input Validation",
        description: "Validate and sanitize all input to prevent injection attacks that could expose personal data.",
        keywords: ["input-validation", "injection", "sanitization"],
        findingCategories: ["sql-injection", "xss", "injection"],
        cweIds: ["CWE-89", "CWE-79", "CWE-78"],
    },
    {
        id: "GDPR-Secrets",
        framework: "GDPR",
        category: "Security",
        title: "Secrets Management",
        description: "Properly manage and protect cryptographic keys, credentials, and other secrets used to protect personal data.",
        keywords: ["secrets", "credentials", "keys", "passwords"],
        findingCategories: ["secrets", "credentials"],
        cweIds: ["CWE-798", "CWE-522"],
    },
    {
        id: "GDPR-Logging",
        framework: "GDPR",
        category: "Security",
        title: "Audit Logging",
        description: "Implement comprehensive logging of access to and processing of personal data for audit purposes.",
        keywords: ["logging", "audit", "monitoring", "trail"],
        findingCategories: ["logging", "audit"],
        cweIds: ["CWE-778"],
    },
    {
        id: "GDPR-Transport",
        framework: "GDPR",
        category: "Security",
        title: "Transport Security",
        description: "Encrypt personal data in transit using TLS/HTTPS to prevent interception.",
        keywords: ["TLS", "HTTPS", "transport-security", "encryption"],
        findingCategories: ["transport-security", "encryption"],
        cweIds: ["CWE-319", "CWE-523"],
    },
];
/**
 * Get all GDPR controls
 */
export function getGDPRControls() {
    return GDPR_CONTROLS;
}
/**
 * Get GDPR controls by category
 */
export function getGDPRControlsByCategory(category) {
    return GDPR_CONTROLS.filter((c) => c.category === category);
}
/**
 * Get GDPR controls by article
 */
export function getGDPRControlsByArticle(article) {
    return GDPR_CONTROLS.filter((c) => c.id.startsWith(`GDPR-${article}`));
}
/**
 * Get GDPR categories
 */
export function getGDPRCategories() {
    return GDPR_CATEGORIES;
}
//# sourceMappingURL=gdpr.js.map