@greenarmor/ges-policy-engine 1.2.7 → 1.3.0

package/dist/packs/privacy-countries.js

@@ -0,0 +1,805 @@
+// ============================================================
+// EUROPE
+// ============================================================
+export function createUKGDPRPolicyPack() {
+    const controls = [
+        {
+            id: "UK-GDPR-01",
+            name: "UK Data Protection Act 2018 Compliance",
+            description: "Ensure compliance with the UK Data Protection Act 2018 and UK GDPR.",
+            category: "privacy-governance",
+            framework: "UK-GDPR",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Implement UK GDPR requirements including: registering with the ICO if required, maintaining ROPA aligned with UK requirements, conducting DPIAs for high-risk processing, appointing a UK representative if processing UK data from outside the UK, and complying with ICO guidance and codes of practice.",
+            checks: [
+                { id: "UK-GDPR-01-C1", description: "ICO registration completed if required", status: "not-implemented" },
+                { id: "UK-GDPR-01-C2", description: "UK-specific ROPA maintained", status: "not-implemented" },
+                { id: "UK-GDPR-01-C3", description: "UK representative appointed if applicable", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "UK-GDPR-02",
+            name: "UK International Transfers",
+            description: "Implement UK-specific international data transfer mechanisms.",
+            category: "cross-border-transfers",
+            framework: "UK-GDPR",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to EU SCCs for transfers to non-adequate countries. Conduct Transfer Risk Assessments (TRAs) following ICO guidance. Monitor UK adequacy regulations for updates.",
+            checks: [
+                { id: "UK-GDPR-02-C1", description: "IDTA or UK Addendum executed for non-adequate transfers", status: "not-implemented" },
+                { id: "UK-GDPR-02-C2", description: "Transfer Risk Assessments conducted", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "UK-GDPR-03",
+            name: "ICO Breach Notification",
+            description: "Notify the ICO of personal data breaches within 72 hours.",
+            category: "incident-management",
+            framework: "UK-GDPR",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Implement procedures to notify the ICO of eligible personal data breaches within 72 hours of becoming aware. Use the ICO breach reporting service. Notify affected individuals without undue delay if high risk. Document all breach notifications.",
+            checks: [
+                { id: "UK-GDPR-03-C1", description: "ICO breach notification within 72 hours", status: "not-implemented" },
+                { id: "UK-GDPR-03-C2", description: "Individual notification for high-risk breaches", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "uk-gdpr",
+        name: "UK GDPR & Data Protection Act 2018 Pack",
+        description: "UK-specific privacy controls: ICO registration, UK international transfer mechanisms (IDTA/UK Addendum), and ICO breach notification procedures.",
+        version: "1.0.0",
+        project_types: ["saas", "generic-web-application", "api-backend", "mobile-application"],
+        controls,
+        frameworks: ["UK-GDPR"],
+    };
+}
+export function createSwissFADPPolicyPack() {
+    const controls = [
+        {
+            id: "FADP-01",
+            name: "FADP Compliance",
+            description: "Ensure compliance with the Swiss Federal Act on Data Protection (FADP, revFSDG).",
+            category: "privacy-governance",
+            framework: "FADP",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Implement the revised Swiss FADP (in effect since September 2023): maintain a data processing register, appoint a data protection advisor if processing high-risk data on a large scale, provide transparent privacy notices, and comply with FDPIC requirements.",
+            checks: [
+                { id: "FADP-01-C1", description: "Data processing register maintained", status: "not-implemented" },
+                { id: "FADP-01-C2", description: "FADP privacy notices published", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "FADP-02",
+            name: "Swiss Cross-Border Transfers",
+            description: "Ensure lawful international data transfers under Swiss FADP.",
+            category: "cross-border-transfers",
+            framework: "FADP",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Ensure transfers to countries without adequate protection are covered by adequate safeguards (SCCs, BCRs, or FDPIC-approved mechanisms). Maintain the list of countries recognized as adequate by the FDPIC. Document transfer assessments.",
+            checks: [
+                { id: "FADP-02-C1", description: "Adequate safeguards for non-adequate transfers", status: "not-implemented" },
+                { id: "FADP-02-C2", description: "FDPIC adequacy list maintained", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "ch-fadp",
+        name: "Switzerland FADP Pack",
+        description: "Swiss Federal Act on Data Protection (revFSDG) compliance controls including FDPIC requirements and Swiss cross-border transfer rules.",
+        version: "1.0.0",
+        project_types: ["saas", "generic-web-application", "api-backend"],
+        controls,
+        frameworks: ["FADP"],
+    };
+}
+// ============================================================
+// ASIA-PACIFIC
+// ============================================================
+export function createSingaporePDPAPolicyPack() {
+    const controls = [
+        {
+            id: "PDPA-SG-01",
+            name: "Accountability Obligation",
+            description: "Appoint a Data Protection Officer (DPO) and make their contact information publicly available.",
+            category: "privacy-governance",
+            framework: "PDPA-SG",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Appoint a DPO and deputy DPO. Publish DPO contact information on the organization's website and in the PDPC's registry. Ensure the DPO has adequate knowledge of PDPA requirements. Develop and implement a data protection policy aligned with PDPC guidelines.",
+            checks: [
+                { id: "PDPA-SG-01-C1", description: "DPO appointed and publicly identified", status: "not-implemented" },
+                { id: "PDPA-SG-01-C2", description: "Data protection policy developed", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "PDPA-SG-02",
+            name: "Data Breach Notification",
+            description: "Notify PDPC and affected individuals of qualifying data breaches within 3 calendar days.",
+            category: "incident-management",
+            framework: "PDPA-SG",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Implement breach assessment procedures to determine if a breach is notifiable (significant scale or significant harm). Notify the PDPC within 3 calendar days of assessing a breach as notifiable. Notify affected individuals if the breach is likely to result in significant harm. Document all breach notifications.",
+            checks: [
+                { id: "PDPA-SG-02-C1", description: "Breach notification to PDPC within 3 days", status: "not-implemented" },
+                { id: "PDPA-SG-02-C2", description: "Individual notification for significant harm breaches", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "PDPA-SG-03",
+            name: "Do Not Call Registry",
+            description: "Comply with Singapore's Do Not Call (DNC) registry requirements for telemarketing.",
+            category: "consent-management",
+            framework: "PDPA-SG",
+            status: "not-implemented",
+            severity: "medium",
+            implementation_guidance: "Check the DNC registry before sending marketing messages to Singapore phone numbers. Maintain clear consent records for telemarketing. Honor DNC registry and individual opt-out requests. Implement processes to verify DNC status before each campaign.",
+            checks: [
+                { id: "PDPA-SG-03-C1", description: "DNC registry checked before telemarketing", status: "not-implemented" },
+                { id: "PDPA-SG-03-C2", description: "Opt-out requests honored promptly", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "PDPA-SG-04",
+            name: "Data Portability (PDPA Amendment)",
+            description: "Implement data portability requirements under the PDPA amendments.",
+            category: "data-subject-rights",
+            framework: "PDPA-SG",
+            status: "not-implemented",
+            severity: "medium",
+            implementation_guidance: "Implement mechanisms allowing individuals to request their personal data in a structured, commonly used, and machine-readable format. Enable transmission to another organization where applicable. Develop portability request handling procedures.",
+            checks: [
+                { id: "PDPA-SG-04-C1", description: "Data portability mechanism implemented", status: "not-implemented" },
+                { id: "PDPA-SG-04-C2", description: "Request handling procedures documented", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "sg-pdpa",
+        name: "Singapore PDPA Pack",
+        description: "Singapore Personal Data Protection Act (PDPA) controls: DPO appointment, PDPC breach notification (3 days), Do Not Call registry compliance, and data portability.",
+        version: "1.0.0",
+        project_types: ["saas", "generic-web-application", "api-backend", "mobile-application"],
+        controls,
+        frameworks: ["PDPA-SG"],
+    };
+}
+export function createPhilippinesDPAPolicyPack() {
+    const controls = [
+        {
+            id: "DPA-PH-01",
+            name: "PIC/PIP Responsibilities",
+            description: "Designate Personal Information Controller (PIC) and Personal Information Processor (PIP) roles.",
+            category: "privacy-governance",
+            framework: "DPA-PH",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Designate and document PIC (controller) and PIP (processor) roles. Define their respective responsibilities under the Philippine Data Privacy Act. Ensure contracts between PICs and PIPs clearly define obligations. Implement the principle of accountability throughout the data lifecycle.",
+            checks: [
+                { id: "DPA-PH-01-C1", description: "PIC and PIP roles designated and documented", status: "not-implemented" },
+                { id: "DPA-PH-01-C2", description: "PIC-PIP contracts define obligations", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "DPA-PH-02",
+            name: "NPC Registration",
+            description: "Register with the National Privacy Commission (NPC) as required.",
+            category: "privacy-governance",
+            framework: "DPA-PH",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Register with the NPC if processing personal data of 1,000+ individuals. Appoint a Data Protection Officer and register them with the NPC. Submit the required registration forms and documentation. Renew registration as required by NPC circulars.",
+            checks: [
+                { id: "DPA-PH-02-C1", description: "NPC registration completed if applicable", status: "not-implemented" },
+                { id: "DPA-PH-02-C2", description: "DPO registered with NPC", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "DPA-PH-03",
+            name: "NPC Circular Compliance",
+            description: "Comply with NPC Circular 16-03 (Security of Personal Data) and NPC Circular 17-01 (Registration).",
+            category: "security-controls",
+            framework: "DPA-PH",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Implement NPC Circular 16-03 requirements: physical security, organizational security, and technical security measures. Document data processing systems per Circular 17-01. Conduct privacy impact assessments. Maintain breach management procedures aligned with NPC requirements.",
+            checks: [
+                { id: "DPA-PH-03-C1", description: "NPC Circular 16-03 security measures implemented", status: "not-implemented" },
+                { id: "DPA-PH-03-C2", description: "Data processing systems documented per Circular 17-01", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "DPA-PH-04",
+            name: "Breach Reporting to NPC",
+            description: "Report personal data breaches to the NPC within 72 hours.",
+            category: "incident-management",
+            framework: "DPA-PH",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Implement procedures to report breaches involving sensitive personal data or affecting 100+ individuals to the NPC within 72 hours. Notify affected individuals. Document all breach reports and follow-up communications with the NPC.",
+            checks: [
+                { id: "DPA-PH-04-C1", description: "NPC breach notification within 72 hours", status: "not-implemented" },
+                { id: "DPA-PH-04-C2", description: "Affected individuals notified", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "ph-dpa",
+        name: "Philippines Data Privacy Act Pack",
+        description: "Philippine Data Privacy Act (DPA) controls: PIC/PIP responsibilities, NPC registration, NPC Circular compliance (16-03, 17-01), and NPC breach reporting (72 hours).",
+        version: "1.0.0",
+        project_types: ["saas", "generic-web-application", "api-backend", "mobile-application", "government-system"],
+        controls,
+        frameworks: ["DPA-PH"],
+    };
+}
+export function createJapanAPPIPolicyPack() {
+    const controls = [
+        {
+            id: "APPI-01",
+            name: "Personal Information Handling Business Operator Compliance",
+            description: "Comply with Japan's Act on the Protection of Personal Information (APPI) as a Personal Information Handling Business Operator.",
+            category: "privacy-governance",
+            framework: "APPI",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Specify the purpose of use for personal data and publish it. Obtain consent for using data beyond the specified purpose. Maintain proper handling of sensitive personal information (race, creed, medical history, criminal records). Respond to disclosure requests from data subjects.",
+            checks: [
+                { id: "APPI-01-C1", description: "Purpose of use specified and published", status: "not-implemented" },
+                { id: "APPI-01-C2", description: "Sensitive information handling procedures defined", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "APPI-02",
+            name: "Cross-Border Transfer Requirements",
+            description: "Implement APPI requirements for transferring personal data to third parties in foreign countries.",
+            category: "cross-border-transfers",
+            framework: "APPI",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Obtain prior consent for cross-border transfers to countries without equivalent data protection. Inform data subjects of the destination country and its data protection regime. Document the equivalent protection status of destination countries per PPC guidelines.",
+            checks: [
+                { id: "APPI-02-C1", description: "Prior consent obtained for cross-border transfers", status: "not-implemented" },
+                { id: "APPI-02-C2", description: "Destination country protection status documented", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "APPI-03",
+            name: "PPC Breach Reporting",
+            description: "Report personal data breaches to the Personal Information Protection Commission (PPC).",
+            category: "incident-management",
+            framework: "APPI",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Report breaches involving sensitive or high-risk personal data to the PPC without delay (within 3-5 days). Notify affected individuals. Document breach details, remediation actions, and preventive measures. Maintain breach records for PPC inspection.",
+            checks: [
+                { id: "APPI-03-C1", description: "PPC breach reporting procedures implemented", status: "not-implemented" },
+                { id: "APPI-03-C2", description: "Individual notification for high-risk breaches", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "jp-appi",
+        name: "Japan APPI Pack",
+        description: "Japan Act on the Protection of Personal Information (APPI) controls: purpose specification, cross-border transfer consent, sensitive data handling, and PPC breach reporting.",
+        version: "1.0.0",
+        project_types: ["saas", "generic-web-application", "api-backend", "mobile-application"],
+        controls,
+        frameworks: ["APPI"],
+    };
+}
+export function createSouthKoreaPIPAPolicyPack() {
+    const controls = [
+        {
+            id: "PIPA-01",
+            name: "Consent Requirements",
+            description: "Implement South Korea's strong consent requirements for personal data processing.",
+            category: "consent-management",
+            framework: "PIPA",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Obtain separate consent for each processing purpose. Provide clear information about: collection items, purpose, retention period, and third-party sharing. Obtain explicit opt-in consent (not pre-checked boxes). Implement consent withdrawal mechanisms. Maintain detailed consent records.",
+            checks: [
+                { id: "PIPA-01-C1", description: "Separate consent per processing purpose", status: "not-implemented" },
+                { id: "PIPA-01-C2", description: "Explicit opt-in (no pre-checked boxes)", status: "not-implemented" },
+                { id: "PIPA-01-C3", description: "Consent withdrawal mechanism available", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "PIPA-02",
+            name: "Processing Restrictions",
+            description: "Comply with PIPA restrictions on processing sensitive information and unique identifiers.",
+            category: "consent-management",
+            framework: "PIPA",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Obtain separate consent for sensitive information (ideology, health, criminal records). Obtain separate consent for resident registration numbers (RRN). Implement strict security controls for sensitive data. Minimize collection of unique identifiers.",
+            checks: [
+                { id: "PIPA-02-C1", description: "Separate consent for sensitive information", status: "not-implemented" },
+                { id: "PIPA-02-C2", description: "Strict security for unique identifiers", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "PIPA-03",
+            name: "KISA Breach Notification",
+            description: "Report personal data breaches to KISA and affected individuals without delay.",
+            category: "incident-management",
+            framework: "PIPA",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Report breaches to KISA (Korea Internet & Security Agency) without delay upon becoming aware. Notify affected individuals without delay. Document breach details including: cause, scope, data types, mitigation measures, and recurrence prevention plans.",
+            checks: [
+                { id: "PIPA-03-C1", description: "KISA breach notification without delay", status: "not-implemented" },
+                { id: "PIPA-03-C2", description: "Individual notification without delay", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "kr-pipa",
+        name: "South Korea PIPA Pack",
+        description: "South Korea Personal Information Protection Act (PIPA) controls: strong consent requirements, sensitive data restrictions, and KISA breach notification.",
+        version: "1.0.0",
+        project_types: ["saas", "generic-web-application", "api-backend", "mobile-application"],
+        controls,
+        frameworks: ["PIPA"],
+    };
+}
+export function createChinaPIPLPolicyPack() {
+    const controls = [
+        {
+            id: "PIPL-01",
+            name: "Data Localization",
+            description: "Implement data localization requirements for personal information collected in China.",
+            category: "cross-border-transfers",
+            framework: "PIPL",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Store personal information of Chinese residents within mainland China for critical information infrastructure operators (CIIO) and processors exceeding thresholds. Implement technical controls ensuring affected data remains within China. Do not transfer abroad without completing required assessments.",
+            checks: [
+                { id: "PIPL-01-C1", description: "Data localization requirements assessed and implemented", status: "not-implemented" },
+                { id: "PIPL-01-C2", description: "Technical controls enforce China data residency", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "PIPL-02",
+            name: "CAC Security Assessment",
+            description: "Complete Cyberspace Administration of China (CAC) security assessment for cross-border transfers.",
+            category: "cross-border-transfers",
+            framework: "PIPL",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Complete CAC security assessment before transferring personal information abroad if required (CIIOs, large-scale processors, or sensitive data). Submit to CAC standard contract requirements. Maintain records of CAC assessments and approvals. Monitor CAC threshold updates.",
+            checks: [
+                { id: "PIPL-02-C1", description: "CAC security assessment completed for applicable transfers", status: "not-implemented" },
+                { id: "PIPL-02-C2", description: "CAC standard contracts executed", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "PIPL-03",
+            name: "Separate Consent for Sensitive Information",
+            description: "Obtain separate consent for processing sensitive personal information under PIPL.",
+            category: "consent-management",
+            framework: "PIPL",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Obtain separate, explicit consent for processing sensitive personal information (biometrics, religion, health, financial data, children under 14). Provide detailed information about necessity and impact. Implement stricter security measures for sensitive data. Document all sensitive data consent records.",
+            checks: [
+                { id: "PIPL-03-C1", description: "Separate consent for sensitive personal information", status: "not-implemented" },
+                { id: "PIPL-03-C2", description: "Stricter security for sensitive data", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "PIPL-04",
+            name: "PIPL Individual Rights",
+            description: "Implement PIPL-specific data subject rights including the right to explanation for automated decisions.",
+            category: "data-subject-rights",
+            framework: "PIPL",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Implement rights: access, copy, correction, deletion, restriction, portability, and explanation of automated decisions. Provide mechanisms for individuals to refuse profiling. Respond to requests within 15 working days. Document all requests and responses.",
+            checks: [
+                { id: "PIPL-04-C1", description: "All PIPL rights implemented with request mechanisms", status: "not-implemented" },
+                { id: "PIPL-04-C2", description: "Automated decision explanation provided", status: "not-implemented" },
+                { id: "PIPL-04-C3", description: "Responses within 15 working days", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "cn-pipl",
+        name: "China PIPL Pack",
+        description: "China Personal Information Protection Law (PIPL) controls: data localization, CAC security assessment, separate consent for sensitive data, and PIPL individual rights.",
+        version: "1.0.0",
+        project_types: ["saas", "generic-web-application", "api-backend", "mobile-application"],
+        controls,
+        frameworks: ["PIPL"],
+    };
+}
+export function createIndiaDPDPAPolicyPack() {
+    const controls = [
+        {
+            id: "DPDPA-01",
+            name: "Consent Manager Framework",
+            description: "Implement interoperable consent management per India's DPDPA Consent Manager requirements.",
+            category: "consent-management",
+            framework: "DPDPA",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Integrate with DPDP-approved Consent Manager platforms. Ensure consent is free, specific, informed, unconditional, and unambiguous with clear affirmative action. Provide the ability to withdraw consent through the Consent Manager. Maintain verifiable consent records.",
+            checks: [
+                { id: "DPDPA-01-C1", description: "Consent Manager integration implemented", status: "not-implemented" },
+                { id: "DPDPA-01-C2", description: "Consent withdrawal via Consent Manager available", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "DPDPA-02",
+            name: "Significant Data Fiduciary Obligations",
+            description: "Comply with enhanced obligations if designated as a Significant Data Fiduciary.",
+            category: "privacy-governance",
+            framework: "DPDPA",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "If designated as a Significant Data Fiduciary by the Central Government: appoint a DPO based in India, conduct Data Protection Impact Assessments, conduct independent data audits, and comply with any additional measures prescribed by the Data Protection Board.",
+            checks: [
+                { id: "DPDPA-02-C1", description: "SDF status assessed and documented", status: "not-implemented" },
+                { id: "DPDPA-02-C2", description: "DPO based in India appointed if SDF", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "DPDPA-03",
+            name: "Breach Notification to Data Protection Board",
+            description: "Report personal data breaches to the Data Protection Board of India.",
+            category: "incident-management",
+            framework: "DPDPA",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Notify affected individuals and the Data Protection Board of any personal data breach. Provide detailed description of the breach, its likely impact, mitigation measures, and actions taken. Implement procedures for timely notification as prescribed by Board regulations.",
+            checks: [
+                { id: "DPDPA-03-C1", description: "Board notification procedures implemented", status: "not-implemented" },
+                { id: "DPDPA-03-C2", description: "Affected individuals notified", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "in-dpdpa",
+        name: "India DPDPA Pack",
+        description: "India Digital Personal Data Protection Act (DPDPA) controls: Consent Manager framework, Significant Data Fiduciary obligations, and Data Protection Board breach reporting.",
+        version: "1.0.0",
+        project_types: ["saas", "generic-web-application", "api-backend", "mobile-application"],
+        controls,
+        frameworks: ["DPDPA"],
+    };
+}
+// ============================================================
+// AMERICAS
+// ============================================================
+export function createBrazilLGPDPolicyPack() {
+    const controls = [
+        {
+            id: "LGPD-01",
+            name: "Data Protection Officer (Encarregado)",
+            description: "Appoint a Data Protection Officer (DPO/Encarregado) and communicate with ANPD.",
+            category: "privacy-governance",
+            framework: "LGPD",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Appoint an Encarregado (DPO) who will: communicate with ANPD, handle data subject requests, guide data protection activities, and provide annual reports. Publish DPO contact information on the organization's website. Ensure the DPO has adequate authority and independence.",
+            checks: [
+                { id: "LGPD-01-C1", description: "Encarregado appointed and contact info published", status: "not-implemented" },
+                { id: "LGPD-01-C2", description: "Annual ANPD report prepared", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "LGPD-02",
+            name: "Legal Bases for Processing",
+            description: "Identify and document the appropriate legal basis for each processing activity under LGPD.",
+            category: "consent-management",
+            framework: "LGPD",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Document the legal basis for each processing activity: consent, contract performance, legal obligation, public policy, research, legitimate interests, credit protection, or health protection. Maintain records alongside the ROPA. Conduct legitimate interest assessments where applicable.",
+            checks: [
+                { id: "LGPD-02-C1", description: "Legal basis documented per processing activity", status: "not-implemented" },
+                { id: "LGPD-02-C2", description: "Legitimate interest assessments conducted", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "LGPD-03",
+            name: "ANPD Breach Notification",
+            description: "Notify ANPD and affected individuals of data security incidents that may cause risk or damage.",
+            category: "incident-management",
+            framework: "LGPD",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Notify ANPD within a reasonable timeframe of becoming aware of a security incident that may cause risk or relevant damage to data subjects. Include: nature of the incident, affected data, technical security measures, risk assessment, and mitigation steps. Notify affected individuals about risks and mitigation measures.",
+            checks: [
+                { id: "LGPD-03-C1", description: "ANPD notification procedures implemented", status: "not-implemented" },
+                { id: "LGPD-03-C2", description: "Individual notification for risk/damage incidents", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "LGPD-04",
+            name: "LGPD Data Subject Rights",
+            description: "Implement LGPD-specific rights including confirmation of processing and data quality.",
+            category: "data-subject-rights",
+            framework: "LGPD",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Implement LGPD rights: confirmation of processing, access, correction, anonymization/blocking/deletion, portability, deletion of consented data, information about sharing, information about refusal to consent, and revocation of consent. Respond within 15 days.",
+            checks: [
+                { id: "LGPD-04-C1", description: "All LGPD rights implemented", status: "not-implemented" },
+                { id: "LGPD-04-C2", description: "Responses within 15 days", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "br-lgpd",
+        name: "Brazil LGPD Pack",
+        description: "Brazilian General Data Protection Law (LGPD) controls: Encarregado appointment, ANPD communication, legal bases documentation, LGPD rights, and ANPD breach notification.",
+        version: "1.0.0",
+        project_types: ["saas", "generic-web-application", "api-backend", "mobile-application"],
+        controls,
+        frameworks: ["LGPD"],
+    };
+}
+export function createCanadaPIPEDAPolicyPack() {
+    const controls = [
+        {
+            id: "PIPEDA-01",
+            name: "Accountability Principle",
+            description: "Designate an individual accountable for compliance with PIPEDA's 10 fair information principles.",
+            category: "privacy-governance",
+            framework: "PIPEDA",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Designate a Privacy Officer accountable for PIPEDA compliance. Develop and implement a privacy management program aligned with PIPEDA's 10 fair information principles. Ensure accountability is documented and communicated throughout the organization. Conduct annual PIPEDA compliance assessments.",
+            checks: [
+                { id: "PIPEDA-01-C1", description: "Privacy Officer designated and documented", status: "not-implemented" },
+                { id: "PIPEDA-01-C2", description: "PIPEDA privacy management program implemented", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "PIPEDA-02",
+            name: "OPC Breach Notification",
+            description: "Notify the Office of the Privacy Commissioner (OPC) and affected individuals of breaches posing real risk of significant harm.",
+            category: "incident-management",
+            framework: "PIPEDA",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Assess breaches for real risk of significant harm (RROSH). Notify affected individuals and the OPC of breaches meeting the RROSH threshold as soon as feasible. Maintain records of all breaches for 24 months. Include breach details, risk assessment, and mitigation measures in notifications.",
+            checks: [
+                { id: "PIPEDA-02-C1", description: "RROSH assessment process implemented", status: "not-implemented" },
+                { id: "PIPEDA-02-C2", description: "OPC and individual notification for RROSH breaches", status: "not-implemented" },
+                { id: "PIPEDA-02-C3", description: "Breach records maintained for 24 months", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "PIPEDA-03",
+            name: "Cross-Border Transfer Requirements",
+            description: "Ensure cross-border transfers of personal information maintain PIPEDA-level protection.",
+            category: "cross-border-transfers",
+            framework: "PIPEDA",
+            status: "not-implemented",
+            severity: "medium",
+            implementation_guidance: "Ensure third-party recipients in other countries provide a level of protection comparable to PIPEDA. Implement contractual safeguards. Conduct due diligence on foreign recipients. Inform individuals of cross-border transfers in privacy notices.",
+            checks: [
+                { id: "PIPEDA-03-C1", description: "Comparable protection ensured for cross-border transfers", status: "not-implemented" },
+                { id: "PIPEDA-03-C2", description: "Individuals informed of cross-border transfers", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "ca-pipeda",
+        name: "Canada PIPEDA Pack",
+        description: "Canada Personal Information Protection and Electronic Documents Act (PIPEDA) controls: accountability principle, OPC breach notification (RROSH), and cross-border transfer safeguards.",
+        version: "1.0.0",
+        project_types: ["saas", "generic-web-application", "api-backend", "mobile-application"],
+        controls,
+        frameworks: ["PIPEDA"],
+    };
+}
+export function createCaliforniaCRPAPolicyPack() {
+    const controls = [
+        {
+            id: "CPRA-01",
+            name: "Consumer Rights",
+            description: "Implement California Consumer Privacy Act (CPRA) consumer rights including the right to opt-out of sale/sharing.",
+            category: "data-subject-rights",
+            framework: "CPRA",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Implement CPRA rights: know, delete, correct, opt-out of sale/sharing, limit use of sensitive PI, and non-discrimination. Provide a 'Do Not Sell or Share My Personal Information' link. Implement a 'Limit the Use of My Sensitive Personal Information' link. Honor Global Privacy Control (GPC) signals. Respond to requests within 45 days.",
+            checks: [
+                { id: "CPRA-01-C1", description: "All CPRA rights implemented with request mechanisms", status: "not-implemented" },
+                { id: "CPRA-01-C2", description: "'Do Not Sell or Share' link provided", status: "not-implemented" },
+                { id: "CPRA-01-C3", description: "GPC signals honored", status: "not-implemented" },
+                { id: "CPRA-01-C4", description: "Responses within 45 days", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "CPRA-02",
+            name: "Sensitive Personal Information Controls",
+            description: "Implement specific controls for sensitive personal information under CPRA.",
+            category: "consent-management",
+            framework: "CPRA",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Identify and classify sensitive personal information (SSN, driver's license, financial accounts, health data, precise geolocation, biometrics, email/passwords). Provide the right to limit use of sensitive PI. Implement additional security controls for sensitive PI categories. Disclose sensitive PI categories in privacy notices.",
+            checks: [
+                { id: "CPRA-02-C1", description: "Sensitive PI classified and documented", status: "not-implemented" },
+                { id: "CPRA-02-C2", description: "Limit use mechanism for sensitive PI available", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "CPRA-03",
+            name: "Privacy Notice Requirements",
+            description: "Provide CPRA-compliant privacy notices at collection and in general privacy policy.",
+            category: "privacy-governance",
+            framework: "CPRA",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Provide notice at collection listing: categories of PI collected, purposes, retention periods, and whether sold/shared. Update privacy policy with: PI categories, sources, business purposes, third-party categories, sale/sharing opt-out, sensitive PI categories, retention periods, and financial incentive details. Review and update annually.",
+            checks: [
+                { id: "CPRA-03-C1", description: "Notice at collection provided", status: "not-implemented" },
+                { id: "CPRA-03-C2", description: "Privacy policy includes all CPRA-required sections", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "us-cpra",
+        name: "California CPRA Pack",
+        description: "California Consumer Privacy Rights Act (CPRA) controls: consumer rights, opt-out of sale/sharing, sensitive PI controls, GPC support, and privacy notice requirements.",
+        version: "1.0.0",
+        project_types: ["saas", "generic-web-application", "api-backend", "mobile-application"],
+        controls,
+        frameworks: ["CPRA"],
+    };
+}
+// ============================================================
+// AFRICA
+// ============================================================
+export function createSouthAfricaPOPIAPolicyPack() {
+    const controls = [
+        {
+            id: "POPIA-01",
+            name: "Information Officer",
+            description: "Designate an Information Officer and register with the Information Regulator.",
+            category: "privacy-governance",
+            framework: "POPIA",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Designate an Information Officer (IO) and deputy IO. Register the IO with the Information Regulator. Ensure the IO's contact details are publicly available. The IO is responsible for: encouraging compliance, handling information requests, cooperating with the Regulator, and internal awareness training.",
+            checks: [
+                { id: "POPIA-01-C1", description: "Information Officer designated and registered", status: "not-implemented" },
+                { id: "POPIA-01-C2", description: "IO contact details publicly available", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "POPIA-02",
+            name: "Processing Conditions",
+            description: "Implement POPIA's 8 conditions for lawful processing of personal information.",
+            category: "consent-management",
+            framework: "POPIA",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Implement the 8 conditions: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. Document compliance for each condition. Conduct annual POPIA compliance assessments.",
+            checks: [
+                { id: "POPIA-02-C1", description: "All 8 processing conditions documented and implemented", status: "not-implemented" },
+                { id: "POPIA-02-C2", description: "Annual compliance assessments conducted", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "POPIA-03",
+            name: "Information Regulator Breach Notification",
+            description: "Notify the Information Regulator of security compromises as soon as reasonably possible.",
+            category: "incident-management",
+            framework: "POPIA",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Notify the Information Regulator of security compromises where there are reasonable grounds to believe personal information has been accessed or acquired by unauthorized persons. Notify affected data subjects. Document all notifications and the Regulator's responses.",
+            checks: [
+                { id: "POPIA-03-C1", description: "Regulator notification procedures implemented", status: "not-implemented" },
+                { id: "POPIA-03-C2", description: "Affected individuals notified", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "za-popia",
+        name: "South Africa POPIA Pack",
+        description: "South Africa Protection of Personal Information Act (POPIA) controls: Information Officer designation, 8 processing conditions, and Information Regulator breach notification.",
+        version: "1.0.0",
+        project_types: ["saas", "generic-web-application", "api-backend", "mobile-application"],
+        controls,
+        frameworks: ["POPIA"],
+    };
+}
+// ============================================================
+// MIDDLE EAST
+// ============================================================
+export function createUAEPDPLPolicyPack() {
+    const controls = [
+        {
+            id: "PDPL-UAE-01",
+            name: "Privacy Impact Assessment",
+            description: "Conduct privacy impact assessments for processing activities that may affect individual privacy.",
+            category: "privacy-governance",
+            framework: "PDPL-UAE",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Conduct PIAs for new processing activities involving sensitive data, large-scale processing, or innovative technologies. Document: processing purposes, data categories, necessity assessment, risk evaluation, and mitigation measures. Submit PIAs to the UAE Data Office if required.",
+            checks: [
+                { id: "PDPL-UAE-01-C1", description: "PIA procedures documented and implemented", status: "not-implemented" },
+                { id: "PDPL-UAE-01-C2", description: "PIAs conducted for high-risk processing", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "PDPL-UAE-02",
+            name: "Cross-Border Transfer Requirements",
+            description: "Implement UAE PDPL requirements for cross-border data transfers.",
+            category: "cross-border-transfers",
+            framework: "PDPL-UAE",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Ensure cross-border transfers meet UAE PDPL requirements: adequate protection in destination country, appropriate safeguards, or specific authorization. Document transfer assessments. Monitor UAE Data Office guidance on recognized adequate jurisdictions.",
+            checks: [
+                { id: "PDPL-UAE-02-C1", description: "Transfer adequacy assessments documented", status: "not-implemented" },
+                { id: "PDPL-UAE-02-C2", description: "Appropriate safeguards implemented", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "ae-pdpl",
+        name: "UAE PDPL Pack",
+        description: "UAE Personal Data Protection Law (PDPL) controls: privacy impact assessments and cross-border transfer requirements.",
+        version: "1.0.0",
+        project_types: ["saas", "generic-web-application", "api-backend"],
+        controls,
+        frameworks: ["PDPL-UAE"],
+    };
+}
+export function createSaudiArabiaPDPLPolicyPack() {
+    const controls = [
+        {
+            id: "PDPL-SA-01",
+            name: "Data Localization",
+            description: "Implement Saudi Arabia PDPL data localization requirements for personal data.",
+            category: "cross-border-transfers",
+            framework: "PDPL-SA",
+            status: "not-implemented",
+            severity: "critical",
+            implementation_guidance: "Ensure personal data is processed and stored within Saudi Arabia unless the transfer meets PDPL requirements. Obtain National Data Management Office (NDMO) approval for cross-border transfers. Implement technical controls enforcing data residency. Document localization compliance.",
+            checks: [
+                { id: "PDPL-SA-01-C1", description: "Data localization requirements assessed", status: "not-implemented" },
+                { id: "PDPL-SA-01-C2", description: "NDMO approval for applicable transfers", status: "not-implemented" },
+            ],
+        },
+        {
+            id: "PDPL-SA-02",
+            name: "Consent Management",
+            description: "Implement Saudi PDPL consent requirements including explicit consent for sensitive data.",
+            category: "consent-management",
+            framework: "PDPL-SA",
+            status: "not-implemented",
+            severity: "high",
+            implementation_guidance: "Obtain clear and explicit consent for processing personal data. Obtain separate explicit consent for sensitive personal data (health, genetic, biometric, racial/ethnic, religious, credit/financial). Provide withdrawal mechanisms. Document consent records in Arabic and English.",
+            checks: [
+                { id: "PDPL-SA-02-C1", description: "Explicit consent for processing implemented", status: "not-implemented" },
+                { id: "PDPL-SA-02-C2", description: "Separate consent for sensitive data", status: "not-implemented" },
+            ],
+        },
+    ];
+    return {
+        id: "sa-pdpl",
+        name: "Saudi Arabia PDPL Pack",
+        description: "Saudi Arabia Personal Data Protection Law (PDPL) controls: data localization, NDMO approval for transfers, and explicit consent requirements.",
+        version: "1.0.0",
+        project_types: ["saas", "generic-web-application", "api-backend"],
+        controls,
+        frameworks: ["PDPL-SA"],
+    };
+}