monora-ai 2.1.0 → 2.1.4

package/dist/templates/controls/gdpr_control_catalog.json

@@ -0,0 +1,261 @@
+{
+  "catalog_id": "gdpr_gap_catalog_monora",
+  "standard": "GDPR",
+  "version": "0.1.0",
+  "generated_at": "2026-02-16T00:00:00+00:00",
+  "notes": "Default GDPR article coverage catalog for workflow gap analysis.",
+  "controls": [
+    {
+      "control_id": "art5",
+      "clause": "Art.5",
+      "title": "Principles Relating to Processing",
+      "requirement": "Apply lawfulness, fairness, transparency, minimization, and integrity principles.",
+      "guidance": "Maintain data handling policies and minimization controls.",
+      "evidence_types": ["data_handling_policy", "data_minimization_review"],
+      "frequency": "quarterly",
+      "owner": "Privacy Officer",
+      "system": "privacy_governance",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "art6",
+      "clause": "Art.6",
+      "title": "Lawfulness of Processing",
+      "requirement": "Document lawful basis for processing.",
+      "guidance": "Track legal basis per data processing purpose.",
+      "evidence_types": ["lawful_basis_register"],
+      "frequency": "quarterly",
+      "owner": "Privacy Officer",
+      "system": "privacy_governance",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "art7",
+      "clause": "Art.7",
+      "title": "Conditions for Consent",
+      "requirement": "Collect and manage valid consent where required.",
+      "guidance": "Track consent status and revocation.",
+      "evidence_types": ["consent_log", "consent_revocation_log"],
+      "frequency": "monthly",
+      "owner": "Privacy Officer",
+      "system": "consent_management",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "art12",
+      "clause": "Art.12",
+      "title": "Transparent Information and Communication",
+      "requirement": "Provide transparent communications to data subjects.",
+      "guidance": "Maintain clear rights and request channels.",
+      "evidence_types": ["privacy_notice", "communication_record"],
+      "frequency": "quarterly",
+      "owner": "Privacy Officer",
+      "system": "transparency",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "medium"
+    },
+    {
+      "control_id": "art13",
+      "clause": "Art.13",
+      "title": "Information to Be Provided (Direct Collection)",
+      "requirement": "Provide required information when collecting data directly.",
+      "guidance": "Maintain direct collection notices and acknowledgments.",
+      "evidence_types": ["privacy_notice", "notice_acknowledgement"],
+      "frequency": "quarterly",
+      "owner": "Privacy Officer",
+      "system": "transparency",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "medium"
+    },
+    {
+      "control_id": "art14",
+      "clause": "Art.14",
+      "title": "Information to Be Provided (Indirect Collection)",
+      "requirement": "Provide required information when data is not collected directly.",
+      "guidance": "Maintain indirect collection notice process.",
+      "evidence_types": ["privacy_notice", "indirect_collection_log"],
+      "frequency": "quarterly",
+      "owner": "Privacy Officer",
+      "system": "transparency",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "medium"
+    },
+    {
+      "control_id": "art15",
+      "clause": "Art.15",
+      "title": "Right of Access",
+      "requirement": "Respond to access requests within legal timelines.",
+      "guidance": "Track request intake and fulfillment.",
+      "evidence_types": ["data_subject_request_log"],
+      "frequency": "monthly",
+      "owner": "Privacy Officer",
+      "system": "rights_management",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "art16",
+      "clause": "Art.16",
+      "title": "Right to Rectification",
+      "requirement": "Correct inaccurate personal data.",
+      "guidance": "Track rectification workflow and completion.",
+      "evidence_types": ["rectification_log"],
+      "frequency": "monthly",
+      "owner": "Privacy Officer",
+      "system": "rights_management",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "medium"
+    },
+    {
+      "control_id": "art17",
+      "clause": "Art.17",
+      "title": "Right to Erasure",
+      "requirement": "Erase data when erasure conditions are met.",
+      "guidance": "Track erasure requests and outcomes.",
+      "evidence_types": ["erasure_log"],
+      "frequency": "monthly",
+      "owner": "Privacy Officer",
+      "system": "rights_management",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "art18",
+      "clause": "Art.18",
+      "title": "Right to Restriction",
+      "requirement": "Restrict processing when requested and applicable.",
+      "guidance": "Track restriction states and enforcement.",
+      "evidence_types": ["restriction_log"],
+      "frequency": "monthly",
+      "owner": "Privacy Officer",
+      "system": "rights_management",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "medium"
+    },
+    {
+      "control_id": "art20",
+      "clause": "Art.20",
+      "title": "Right to Data Portability",
+      "requirement": "Provide portable personal data where applicable.",
+      "guidance": "Track portability requests and delivery.",
+      "evidence_types": ["portability_log"],
+      "frequency": "monthly",
+      "owner": "Privacy Officer",
+      "system": "rights_management",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "medium"
+    },
+    {
+      "control_id": "art21",
+      "clause": "Art.21",
+      "title": "Right to Object",
+      "requirement": "Honor objections to processing.",
+      "guidance": "Track objections and resulting actions.",
+      "evidence_types": ["objection_log"],
+      "frequency": "monthly",
+      "owner": "Privacy Officer",
+      "system": "rights_management",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "medium"
+    },
+    {
+      "control_id": "art22",
+      "clause": "Art.22",
+      "title": "Automated Decision-Making and Profiling",
+      "requirement": "Provide safeguards for automated decisions.",
+      "guidance": "Maintain human oversight and challenge workflow.",
+      "evidence_types": ["human_oversight_record", "automated_decision_review"],
+      "frequency": "monthly",
+      "owner": "Responsible AI Lead",
+      "system": "automated_decisioning",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "art25",
+      "clause": "Art.25",
+      "title": "Data Protection by Design and by Default",
+      "requirement": "Implement privacy by design/default safeguards.",
+      "guidance": "Document privacy design reviews.",
+      "evidence_types": ["privacy_design_review", "data_minimization_review"],
+      "frequency": "quarterly",
+      "owner": "Privacy Officer",
+      "system": "privacy_engineering",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "art30",
+      "clause": "Art.30",
+      "title": "Records of Processing Activities",
+      "requirement": "Maintain records of processing activities.",
+      "guidance": "Track purposes, categories, recipients, and safeguards.",
+      "evidence_types": ["processing_activity_register"],
+      "frequency": "quarterly",
+      "owner": "Privacy Officer",
+      "system": "records_management",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "high"
+    },
+    {
+      "control_id": "art32",
+      "clause": "Art.32",
+      "title": "Security of Processing",
+      "requirement": "Implement appropriate technical and organizational security.",
+      "guidance": "Demonstrate confidentiality, integrity, and resilience controls.",
+      "evidence_types": ["security_control_report", "incident_response_record"],
+      "frequency": "monthly",
+      "owner": "Security Lead",
+      "system": "security",
+      "collection_method": "hybrid",
+      "status": "gap",
+      "priority": "critical"
+    },
+    {
+      "control_id": "art33",
+      "clause": "Art.33",
+      "title": "Breach Notification to Supervisory Authority",
+      "requirement": "Notify authority within required timeframe for qualifying breaches.",
+      "guidance": "Track breach timeline and authority notifications.",
+      "evidence_types": ["breach_notification_log"],
+      "frequency": "on_incident",
+      "owner": "Security Lead",
+      "system": "incident_management",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "critical"
+    },
+    {
+      "control_id": "art35",
+      "clause": "Art.35",
+      "title": "Data Protection Impact Assessment",
+      "requirement": "Perform DPIA for high-risk processing.",
+      "guidance": "Maintain DPIA methodology, outcomes, and approvals.",
+      "evidence_types": ["dpia_report", "risk_register"],
+      "frequency": "per_release",
+      "owner": "Responsible AI Lead",
+      "system": "risk_management",
+      "collection_method": "manual",
+      "status": "gap",
+      "priority": "high"
+    }
+  ]
+}