@tantainnovative/create-ndpr 0.1.0 → 0.4.0

package/templates/express-lawful-basis-route.ts

@@ -0,0 +1,292 @@
+/**
+ * Express — Lawful Basis Router
+ * Generated by create-ndpr for: {{ORG_NAME}}
+ * DPO: {{DPO_EMAIL}}
+ *
+ * NDPA §25 — data processing must have a lawful basis. This router
+ * manages a register of processing activities and their lawful bases.
+ *
+ * Routes:
+ *   GET    /lawful-basis               — List records (optional ?lawfulBasis= filter)
+ *   GET    /lawful-basis/:id           — Get a single record
+ *   POST   /lawful-basis               — Create a new lawful basis record
+ *   PUT    /lawful-basis/:id           — Update an existing record
+ *   DELETE /lawful-basis/:id           — Delete a record
+ *
+ * Usage:
+ *   import { lawfulBasisRouter } from './routes/lawful-basis';
+ *   app.use('/api/lawful-basis', lawfulBasisRouter);
+ */
+
+import { Router } from 'express';
+// {{#if ORM=prisma}}
+import { PrismaClient } from '@prisma/client';
+
+const prisma = new PrismaClient();
+// {{/if}}
+// {{#if ORM=drizzle}}
+import { db } from '@/drizzle';
+import { lawfulBasisRecords, complianceAuditLog } from '@/drizzle/ndpr-schema';
+import { eq, desc } from 'drizzle-orm';
+// {{/if}}
+// {{#if ORM=none}}
+// TODO ({{ORG_NAME}}): wire this to your persistent store of choice. The
+// in-memory map below is enough to develop against locally but DOES NOT
+// satisfy NDPA Section 44 (record-keeping). Replace `lawfulBasisStore`/
+// `auditLog` with your DB / KV / API.
+interface LawfulBasisRecord {
+  id: string;
+  activityName: string;
+  lawfulBasis: string;
+  justification: string;
+  dataCategories: string[];
+  purposes: string[];
+  assessedBy: string;
+  reviewDate: Date | null;
+  createdAt: Date;
+  updatedAt: Date;
+}
+const lawfulBasisStore = new Map<string, LawfulBasisRecord>();
+const auditLog: Array<{ id: string; module: string; action: string; entityId: string; at: Date }> = [];
+function newId() { return crypto.randomUUID(); }
+// {{/if}}
+
+export const lawfulBasisRouter = Router();
+
+// GET /lawful-basis?lawfulBasis=consent
+lawfulBasisRouter.get('/', async (req, res) => {
+  const { lawfulBasis } = req.query;
+  const basisFilter = typeof lawfulBasis === 'string' ? lawfulBasis : undefined;
+
+  // {{#if ORM=prisma}}
+  const records = await prisma.lawfulBasisRecord.findMany({
+    where: basisFilter ? { lawfulBasis: basisFilter } : undefined,
+    orderBy: { createdAt: 'desc' },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const records = basisFilter
+    ? await db.select().from(lawfulBasisRecords).where(eq(lawfulBasisRecords.lawfulBasis, basisFilter)).orderBy(desc(lawfulBasisRecords.createdAt))
+    : await db.select().from(lawfulBasisRecords).orderBy(desc(lawfulBasisRecords.createdAt));
+  // {{/if}}
+  // {{#if ORM=none}}
+  const records = [...lawfulBasisStore.values()]
+    .filter((r) => (basisFilter ? r.lawfulBasis === basisFilter : true))
+    .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+  // {{/if}}
+
+  return res.json(records);
+});
+
+// GET /lawful-basis/:id
+lawfulBasisRouter.get('/:id', async (req, res) => {
+  // {{#if ORM=prisma}}
+  const record = await prisma.lawfulBasisRecord.findUnique({ where: { id: req.params.id } });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [record] = await db.select().from(lawfulBasisRecords).where(eq(lawfulBasisRecords.id, req.params.id)).limit(1);
+  // {{/if}}
+  // {{#if ORM=none}}
+  const record = lawfulBasisStore.get(req.params.id) ?? null;
+  // {{/if}}
+
+  if (!record) {
+    return res.status(404).json({ error: 'Lawful basis record not found' });
+  }
+
+  return res.json(record);
+});
+
+// POST /lawful-basis
+lawfulBasisRouter.post('/', async (req, res) => {
+  const {
+    activityName,
+    lawfulBasis,
+    justification,
+    dataCategories,
+    purposes,
+    assessedBy,
+    reviewDate,
+  } = req.body;
+
+  if (!activityName || !lawfulBasis || !justification || !dataCategories || !purposes || !assessedBy) {
+    return res.status(400).json({
+      error: 'activityName, lawfulBasis, justification, dataCategories, purposes, and assessedBy are required',
+    });
+  }
+
+  if (!Array.isArray(dataCategories) || !Array.isArray(purposes)) {
+    return res.status(400).json({ error: 'dataCategories and purposes must be arrays' });
+  }
+
+  // {{#if ORM=prisma}}
+  const record = await prisma.lawfulBasisRecord.create({
+    data: {
+      activityName,
+      lawfulBasis,
+      justification,
+      dataCategories,
+      purposes,
+      assessedBy,
+      reviewDate: reviewDate ? new Date(reviewDate) : null,
+    },
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'lawful-basis',
+      action: 'created',
+      entityId: record.id,
+      entityType: 'LawfulBasisRecord',
+      changes: { activityName, lawfulBasis, assessedBy },
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [record] = await db.insert(lawfulBasisRecords).values({
+    activityName,
+    lawfulBasis,
+    justification,
+    dataCategories,
+    purposes,
+    assessedBy,
+    reviewDate: reviewDate ? new Date(reviewDate) : null,
+  }).returning();
+
+  await db.insert(complianceAuditLog).values({
+    module: 'lawful-basis',
+    action: 'created',
+    entityId: record.id,
+    entityType: 'LawfulBasisRecord',
+    changes: { activityName, lawfulBasis, assessedBy },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const now = new Date();
+  const record: LawfulBasisRecord = {
+    id: newId(),
+    activityName,
+    lawfulBasis,
+    justification,
+    dataCategories,
+    purposes,
+    assessedBy,
+    reviewDate: reviewDate ? new Date(reviewDate) : null,
+    createdAt: now,
+    updatedAt: now,
+  };
+  lawfulBasisStore.set(record.id, record);
+  auditLog.push({ id: newId(), module: 'lawful-basis', action: 'created', entityId: record.id, at: new Date() });
+  // {{/if}}
+
+  return res.status(201).json(record);
+});
+
+// PUT /lawful-basis/:id
+lawfulBasisRouter.put('/:id', async (req, res) => {
+  const { id } = req.params;
+
+  const data = { ...req.body };
+  if (data.reviewDate) {
+    data.reviewDate = new Date(data.reviewDate);
+  }
+
+  // {{#if ORM=prisma}}
+  const existing = await prisma.lawfulBasisRecord.findUnique({ where: { id } });
+  if (!existing) {
+    return res.status(404).json({ error: 'Lawful basis record not found' });
+  }
+
+  const record = await prisma.lawfulBasisRecord.update({
+    where: { id },
+    data,
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'lawful-basis',
+      action: 'updated',
+      entityId: record.id,
+      entityType: 'LawfulBasisRecord',
+      changes: data,
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [existing] = await db.select().from(lawfulBasisRecords).where(eq(lawfulBasisRecords.id, id)).limit(1);
+  if (!existing) {
+    return res.status(404).json({ error: 'Lawful basis record not found' });
+  }
+
+  const [record] = await db.update(lawfulBasisRecords).set(data).where(eq(lawfulBasisRecords.id, id)).returning();
+
+  await db.insert(complianceAuditLog).values({
+    module: 'lawful-basis',
+    action: 'updated',
+    entityId: record.id,
+    entityType: 'LawfulBasisRecord',
+    changes: data,
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const existing = lawfulBasisStore.get(id);
+  if (!existing) {
+    return res.status(404).json({ error: 'Lawful basis record not found' });
+  }
+  const record: LawfulBasisRecord = { ...existing, ...data, id, updatedAt: new Date() };
+  lawfulBasisStore.set(id, record);
+  auditLog.push({ id: newId(), module: 'lawful-basis', action: 'updated', entityId: record.id, at: new Date() });
+  // {{/if}}
+
+  return res.json(record);
+});
+
+// DELETE /lawful-basis/:id
+lawfulBasisRouter.delete('/:id', async (req, res) => {
+  const { id } = req.params;
+
+  // {{#if ORM=prisma}}
+  const existing = await prisma.lawfulBasisRecord.findUnique({ where: { id } });
+  if (!existing) {
+    return res.status(404).json({ error: 'Lawful basis record not found' });
+  }
+
+  await prisma.lawfulBasisRecord.delete({ where: { id } });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'lawful-basis',
+      action: 'deleted',
+      entityId: id,
+      entityType: 'LawfulBasisRecord',
+      changes: { activityName: existing.activityName },
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [existing] = await db.select().from(lawfulBasisRecords).where(eq(lawfulBasisRecords.id, id)).limit(1);
+  if (!existing) {
+    return res.status(404).json({ error: 'Lawful basis record not found' });
+  }
+
+  await db.delete(lawfulBasisRecords).where(eq(lawfulBasisRecords.id, id));
+
+  await db.insert(complianceAuditLog).values({
+    module: 'lawful-basis',
+    action: 'deleted',
+    entityId: id,
+    entityType: 'LawfulBasisRecord',
+    changes: { activityName: existing.activityName },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const existing = lawfulBasisStore.get(id);
+  if (!existing) {
+    return res.status(404).json({ error: 'Lawful basis record not found' });
+  }
+  lawfulBasisStore.delete(id);
+  auditLog.push({ id: newId(), module: 'lawful-basis', action: 'deleted', entityId: id, at: new Date() });
+  // {{/if}}
+
+  return res.json({ success: true });
+});

package/templates/express-setup.ts

@@ -15,9 +15,12 @@
  *   app.use('/api/ndpr', createNDPRRouter());
  *
  * Routes exposed:
- *   GET/POST/DELETE  /api/ndpr/consent   — NDPA §25–26
- *   GET/POST         /api/ndpr/dsr       — NDPA §34–38
- *   GET/POST         /api/ndpr/breach    — NDPA §40
+ *   GET/POST/DELETE  /api/ndpr/consent        — NDPA §25–26
+ *   GET/POST         /api/ndpr/dsr            — NDPA §34–38
+ *   GET/POST         /api/ndpr/breach         — NDPA §40
+ *   CRUD             /api/ndpr/dpia           — NDPA §34(3)
+ *   CRUD             /api/ndpr/lawful-basis   — NDPA §25
+ *   CRUD             /api/ndpr/cross-border   — NDPA §41–42
  */
 
 import { Router } from 'express';
@@ -231,6 +234,259 @@ function breachRouter(): Router {
   return router;
 }
 
+// ---------------------------------------------------------------------------
+// DPIA router — NDPA §34(3)
+// ---------------------------------------------------------------------------
+
+function dpiaRouter(): Router {
+  const router = Router();
+
+  // GET /dpia?status=draft
+  router.get('/', async (req, res) => {
+    const { status } = req.query;
+    const records = await prisma.dPIARecord.findMany({
+      where: status && typeof status === 'string' ? { status } : undefined,
+      orderBy: { createdAt: 'desc' },
+    });
+    return res.json(records);
+  });
+
+  // GET /dpia/:id
+  router.get('/:id', async (req, res) => {
+    const record = await prisma.dPIARecord.findUnique({ where: { id: req.params.id } });
+    if (!record) return res.status(404).json({ error: 'DPIA record not found' });
+    return res.json(record);
+  });
+
+  // POST /dpia
+  router.post('/', async (req, res) => {
+    const { projectName, description, dpiaData, overallRisk, score, conductedBy, approvedBy } = req.body;
+    if (!projectName || !description || !dpiaData || !overallRisk || score == null || !conductedBy) {
+      return res.status(400).json({
+        error: 'projectName, description, dpiaData, overallRisk, score, and conductedBy are required',
+      });
+    }
+    const record = await prisma.dPIARecord.create({
+      data: {
+        projectName, description, dpiaData, overallRisk, score,
+        status: 'draft', conductedBy, approvedBy: approvedBy ?? null,
+      },
+    });
+    await prisma.complianceAuditLog.create({
+      data: {
+        module: 'dpia', action: 'created', entityId: record.id,
+        entityType: 'DPIARecord', changes: { projectName, overallRisk, score, status: 'draft' },
+      },
+    });
+    return res.status(201).json(record);
+  });
+
+  // PUT /dpia/:id
+  router.put('/:id', async (req, res) => {
+    const { id } = req.params;
+    const existing = await prisma.dPIARecord.findUnique({ where: { id } });
+    if (!existing) return res.status(404).json({ error: 'DPIA record not found' });
+    const record = await prisma.dPIARecord.update({ where: { id }, data: req.body });
+    await prisma.complianceAuditLog.create({
+      data: { module: 'dpia', action: 'updated', entityId: record.id, entityType: 'DPIARecord', changes: req.body },
+    });
+    return res.json(record);
+  });
+
+  // DELETE /dpia/:id
+  router.delete('/:id', async (req, res) => {
+    const { id } = req.params;
+    const existing = await prisma.dPIARecord.findUnique({ where: { id } });
+    if (!existing) return res.status(404).json({ error: 'DPIA record not found' });
+    await prisma.dPIARecord.delete({ where: { id } });
+    await prisma.complianceAuditLog.create({
+      data: {
+        module: 'dpia', action: 'deleted', entityId: id,
+        entityType: 'DPIARecord', changes: { projectName: existing.projectName },
+      },
+    });
+    return res.json({ success: true });
+  });
+
+  return router;
+}
+
+// ---------------------------------------------------------------------------
+// Lawful Basis router — NDPA §25
+// ---------------------------------------------------------------------------
+
+function lawfulBasisRouter(): Router {
+  const router = Router();
+
+  // GET /lawful-basis?lawfulBasis=consent
+  router.get('/', async (req, res) => {
+    const { lawfulBasis } = req.query;
+    const records = await prisma.lawfulBasisRecord.findMany({
+      where: lawfulBasis && typeof lawfulBasis === 'string' ? { lawfulBasis } : undefined,
+      orderBy: { createdAt: 'desc' },
+    });
+    return res.json(records);
+  });
+
+  // GET /lawful-basis/:id
+  router.get('/:id', async (req, res) => {
+    const record = await prisma.lawfulBasisRecord.findUnique({ where: { id: req.params.id } });
+    if (!record) return res.status(404).json({ error: 'Lawful basis record not found' });
+    return res.json(record);
+  });
+
+  // POST /lawful-basis
+  router.post('/', async (req, res) => {
+    const { activityName, lawfulBasis, justification, dataCategories, purposes, assessedBy, reviewDate } = req.body;
+    if (!activityName || !lawfulBasis || !justification || !dataCategories || !purposes || !assessedBy) {
+      return res.status(400).json({
+        error: 'activityName, lawfulBasis, justification, dataCategories, purposes, and assessedBy are required',
+      });
+    }
+    if (!Array.isArray(dataCategories) || !Array.isArray(purposes)) {
+      return res.status(400).json({ error: 'dataCategories and purposes must be arrays' });
+    }
+    const record = await prisma.lawfulBasisRecord.create({
+      data: {
+        activityName, lawfulBasis, justification, dataCategories, purposes,
+        assessedBy, reviewDate: reviewDate ? new Date(reviewDate) : null,
+      },
+    });
+    await prisma.complianceAuditLog.create({
+      data: {
+        module: 'lawful-basis', action: 'created', entityId: record.id,
+        entityType: 'LawfulBasisRecord', changes: { activityName, lawfulBasis, assessedBy },
+      },
+    });
+    return res.status(201).json(record);
+  });
+
+  // PUT /lawful-basis/:id
+  router.put('/:id', async (req, res) => {
+    const { id } = req.params;
+    const existing = await prisma.lawfulBasisRecord.findUnique({ where: { id } });
+    if (!existing) return res.status(404).json({ error: 'Lawful basis record not found' });
+    const data = { ...req.body };
+    if (data.reviewDate) data.reviewDate = new Date(data.reviewDate);
+    const record = await prisma.lawfulBasisRecord.update({ where: { id }, data });
+    await prisma.complianceAuditLog.create({
+      data: {
+        module: 'lawful-basis', action: 'updated', entityId: record.id,
+        entityType: 'LawfulBasisRecord', changes: data,
+      },
+    });
+    return res.json(record);
+  });
+
+  // DELETE /lawful-basis/:id
+  router.delete('/:id', async (req, res) => {
+    const { id } = req.params;
+    const existing = await prisma.lawfulBasisRecord.findUnique({ where: { id } });
+    if (!existing) return res.status(404).json({ error: 'Lawful basis record not found' });
+    await prisma.lawfulBasisRecord.delete({ where: { id } });
+    await prisma.complianceAuditLog.create({
+      data: {
+        module: 'lawful-basis', action: 'deleted', entityId: id,
+        entityType: 'LawfulBasisRecord', changes: { activityName: existing.activityName },
+      },
+    });
+    return res.json({ success: true });
+  });
+
+  return router;
+}
+
+// ---------------------------------------------------------------------------
+// Cross-Border Transfer router — NDPA §41–42
+// ---------------------------------------------------------------------------
+
+function crossBorderRouter(): Router {
+  const router = Router();
+
+  // GET /cross-border?riskLevel=high&destinationCountry=US
+  router.get('/', async (req, res) => {
+    const { riskLevel, destinationCountry } = req.query;
+    const where: Record<string, string> = {};
+    if (riskLevel && typeof riskLevel === 'string') where.riskLevel = riskLevel;
+    if (destinationCountry && typeof destinationCountry === 'string') where.destinationCountry = destinationCountry;
+    const records = await prisma.crossBorderTransferRecord.findMany({
+      where: Object.keys(where).length > 0 ? where : undefined,
+      orderBy: { createdAt: 'desc' },
+    });
+    return res.json(records);
+  });
+
+  // GET /cross-border/:id
+  router.get('/:id', async (req, res) => {
+    const record = await prisma.crossBorderTransferRecord.findUnique({ where: { id: req.params.id } });
+    if (!record) return res.status(404).json({ error: 'Cross-border transfer record not found' });
+    return res.json(record);
+  });
+
+  // POST /cross-border
+  router.post('/', async (req, res) => {
+    const {
+      destinationCountry, recipientName, transferMechanism, safeguards,
+      dataCategories, adequacyStatus, ndpcApprovalRequired, ndpcApprovalReference, riskLevel,
+    } = req.body;
+    if (!destinationCountry || !recipientName || !transferMechanism || !safeguards || !dataCategories || !adequacyStatus || !riskLevel) {
+      return res.status(400).json({
+        error: 'destinationCountry, recipientName, transferMechanism, safeguards, dataCategories, adequacyStatus, and riskLevel are required',
+      });
+    }
+    if (!Array.isArray(dataCategories)) {
+      return res.status(400).json({ error: 'dataCategories must be an array' });
+    }
+    const record = await prisma.crossBorderTransferRecord.create({
+      data: {
+        destinationCountry, recipientName, transferMechanism, safeguards, dataCategories,
+        adequacyStatus, ndpcApprovalRequired: ndpcApprovalRequired ?? false,
+        ndpcApprovalReference: ndpcApprovalReference ?? null, riskLevel,
+      },
+    });
+    await prisma.complianceAuditLog.create({
+      data: {
+        module: 'cross-border', action: 'created', entityId: record.id,
+        entityType: 'CrossBorderTransferRecord', changes: { destinationCountry, recipientName, riskLevel },
+      },
+    });
+    return res.status(201).json(record);
+  });
+
+  // PUT /cross-border/:id
+  router.put('/:id', async (req, res) => {
+    const { id } = req.params;
+    const existing = await prisma.crossBorderTransferRecord.findUnique({ where: { id } });
+    if (!existing) return res.status(404).json({ error: 'Cross-border transfer record not found' });
+    const record = await prisma.crossBorderTransferRecord.update({ where: { id }, data: req.body });
+    await prisma.complianceAuditLog.create({
+      data: {
+        module: 'cross-border', action: 'updated', entityId: record.id,
+        entityType: 'CrossBorderTransferRecord', changes: req.body,
+      },
+    });
+    return res.json(record);
+  });
+
+  // DELETE /cross-border/:id
+  router.delete('/:id', async (req, res) => {
+    const { id } = req.params;
+    const existing = await prisma.crossBorderTransferRecord.findUnique({ where: { id } });
+    if (!existing) return res.status(404).json({ error: 'Cross-border transfer record not found' });
+    await prisma.crossBorderTransferRecord.delete({ where: { id } });
+    await prisma.complianceAuditLog.create({
+      data: {
+        module: 'cross-border', action: 'deleted', entityId: id,
+        entityType: 'CrossBorderTransferRecord',
+        changes: { destinationCountry: existing.destinationCountry, recipientName: existing.recipientName },
+      },
+    });
+    return res.json({ success: true });
+  });
+
+  return router;
+}
+
 // ---------------------------------------------------------------------------
 // Main factory
 // ---------------------------------------------------------------------------
@@ -246,5 +502,8 @@ export function createNDPRRouter(): Router {
   router.use('/consent', consentRouter());
   router.use('/dsr', dsrRouter());
   router.use('/breach', breachRouter());
+  router.use('/dpia', dpiaRouter());
+  router.use('/lawful-basis', lawfulBasisRouter());
+  router.use('/cross-border', crossBorderRouter());
   return router;
 }

package/templates/github-ndpr-audit.yml

@@ -0,0 +1,31 @@
+# NDPA 2023 / NDPC GAID 2025 compliance gate — generated by create-ndpr for {{ORG_NAME}}.
+#
+# Runs `ndpr audit` on every push and pull request. The audit scores your
+# compliance config (consent, DSR, DPIA, breach, policy, lawful basis,
+# cross-border, RoPA) plus your GAID 2025 DCPMI registration tier, and exits
+# non-zero when the overall score drops below the threshold — so a regression
+# fails CI the same way a broken test would.
+#
+# Edit ndpr.audit.json to reflect your real posture, then raise --min-score
+# over time as you close gaps. Docs: https://ndprtoolkit.com.ng/docs/guides/audit-cli
+name: NDPA compliance audit
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  ndpr-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      # The `ndpr` CLI ships with the toolkit. --no-save keeps it out of your
+      # package.json if you don't already depend on it directly.
+      - name: Install the NDPR toolkit (provides the `ndpr` CLI)
+        run: npm install --no-save @tantainnovative/ndpr-toolkit@^5.5.1
+      - name: Run the NDPA compliance audit
+        run: npx ndpr audit --min-score 70

package/templates/ndpr-audit.json

@@ -0,0 +1,14 @@
+{
+  "minScore": 70,
+  "compliance": {
+    "consent": { "hasConsentMechanism": true, "hasPurposeSpecification": true, "hasWithdrawalMechanism": true, "hasMinorProtection": false, "consentRecordsRetained": true },
+    "dsr": { "hasRequestMechanism": true, "supportsAccess": true, "supportsRectification": true, "supportsErasure": false, "supportsPortability": false, "supportsObjection": false, "responseTimelineDays": 30 },
+    "dpia": { "conductedForHighRisk": true, "documentedRisks": true, "mitigationMeasures": true },
+    "breach": { "hasNotificationProcess": true, "notifiesWithin72Hours": true, "hasRiskAssessment": true, "hasRecordKeeping": true },
+    "policy": { "hasPrivacyPolicy": true, "isPubliclyAccessible": true, "lastUpdated": "2026-01-01", "coversAllSections": true },
+    "lawfulBasis": { "documentedForAllProcessing": true, "hasLegitimateInterestAssessment": false },
+    "crossBorder": { "hasTransferMechanisms": true, "adequacyAssessed": true, "ndpcApprovalObtained": false },
+    "ropa": { "maintained": true, "includesAllProcessing": true, "lastReviewed": "2026-01-01" }
+  },
+  "dcpmi": { "dataSubjectsInSixMonths": 0 }
+}