// =============================================================================
// Pseudonymization Controls
// Category: PSEUDONYMIZATION
// =============================================================================

import { ControlLibraryEntry } from '../../types'

export const PSEUDONYMIZATION_CONTROLS: ControlLibraryEntry[] = [
  {
    id: 'TOM-PS-01',
    code: 'TOM-PS-01',
    category: 'PSEUDONYMIZATION',
    type: 'TECHNICAL',
    name: { de: 'Pseudonymisierungsverfahren', en: 'Pseudonymization Procedures' },
    description: {
      de: 'Implementierung von Pseudonymisierungsverfahren zur Reduzierung des Personenbezugs von Daten.',
      en: 'Implementation of pseudonymization procedures to reduce the personal reference of data.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. a' },
      { framework: 'GDPR_ART25', reference: 'Art. 25 Abs. 1' },
    ],
    applicabilityConditions: [
      { field: 'dataProfile.hasSpecialCategories', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 25 },
      { field: 'dataProfile.dataVolume', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'RECOMMENDED', priority: 15 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Pseudonymisierungskonzept', 'Mapping-Tabellen-Sicherheit'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'HIGH',
    tags: ['pseudonymization', 'data-minimization'],
  },
  {
    id: 'TOM-PS-02',
    code: 'TOM-PS-02',
    category: 'PSEUDONYMIZATION',
    type: 'ORGANIZATIONAL',
    name: { de: 'Datenanonymisierung fuer Analysen', en: 'Data Anonymization for Analytics' },
    description: {
      de: 'Verfahren zur Anonymisierung von Daten fuer Analyse- und Statistikzwecke.',
      en: 'Procedures for anonymizing data for analysis and statistical purposes.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. a' },
      { framework: 'GDPR_ART25', reference: 'Art. 25 Abs. 1' },
    ],
    applicabilityConditions: [
      { field: 'dataProfile.dataVolume', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'RECOMMENDED', priority: 15 },
    ],
    defaultApplicability: 'OPTIONAL',
    evidenceRequirements: ['Anonymisierungskonzept', 'Risikoanalyse zur Re-Identifizierung'],
    reviewFrequency: 'ANNUAL',
    priority: 'MEDIUM',
    complexity: 'HIGH',
    tags: ['anonymization', 'analytics'],
  },
  {
    id: 'TOM-PS-03',
    code: 'TOM-PS-03',
    category: 'PSEUDONYMIZATION',
    type: 'TECHNICAL',
    name: { de: 'Anonymisierung fuer Analysezwecke', en: 'Anonymization for Analytics' },
    description: {
      de: 'Technische Verfahren zur irreversiblen Anonymisierung personenbezogener Daten fuer statistische Auswertungen und Analysen.',
      en: 'Technical procedures for irreversible anonymization of personal data for statistical evaluations and analyses.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. a' },
      { framework: 'GDPR_ART25', reference: 'Art. 25 Abs. 1' },
    ],
    applicabilityConditions: [
      { field: 'dataProfile.dataVolume', operator: 'IN', value: ['HIGH', 'VERY_HIGH'], result: 'RECOMMENDED', priority: 15 },
    ],
    defaultApplicability: 'OPTIONAL',
    evidenceRequirements: ['Anonymisierungsverfahren-Dokumentation', 'Re-Identifizierungs-Risikoanalyse'],
    reviewFrequency: 'ANNUAL',
    priority: 'MEDIUM',
    complexity: 'HIGH',
    tags: ['pseudonymization', 'anonymization', 'analytics'],
  },
  {
    id: 'TOM-PS-04',
    code: 'TOM-PS-04',
    category: 'PSEUDONYMIZATION',
    type: 'ORGANIZATIONAL',
    name: { de: 'Pseudonymisierungskonzept', en: 'Pseudonymization Concept' },
    description: {
      de: 'Dokumentiertes Konzept fuer die Pseudonymisierung personenbezogener Daten mit Definition der Verfahren, Zustaendigkeiten und Zuordnungsregeln.',
      en: 'Documented concept for pseudonymization of personal data with definition of procedures, responsibilities and mapping rules.',
    },
    mappings: [
      { framework: 'GDPR_ART32', reference: 'Art. 32 Abs. 1 lit. a' },
      { framework: 'GDPR_ART25', reference: 'Art. 25 Abs. 1' },
      { framework: 'BSI_IT_GRUNDSCHUTZ', reference: 'CON.2' },
    ],
    applicabilityConditions: [
      { field: 'dataProfile.hasSpecialCategories', operator: 'EQUALS', value: true, result: 'REQUIRED', priority: 25 },
    ],
    defaultApplicability: 'RECOMMENDED',
    evidenceRequirements: ['Pseudonymisierungskonzept', 'Verfahrensdokumentation'],
    reviewFrequency: 'ANNUAL',
    priority: 'HIGH',
    complexity: 'MEDIUM',
    tags: ['pseudonymization', 'concept', 'documentation'],
  },
]
