Initial commit: breakpilot-compliance - Compliance SDK Platform
Services: Admin-Compliance, Backend-Compliance, AI-Compliance-SDK, Consent-SDK, Developer-Portal, PCA-Platform, DSMS Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Benjamin Boenisch
@@ -0,0 +1,9 @@
|
||||
/**
|
||||
* Catalog exports
|
||||
*
|
||||
* Pre-defined templates, categories, and reference data
|
||||
*/
|
||||
|
||||
export * from './processing-activities'
|
||||
export * from './vendor-templates'
|
||||
export * from './legal-basis'
|
||||
@@ -0,0 +1,562 @@
|
||||
/**
|
||||
* Legal Basis Catalog
|
||||
*
|
||||
* Comprehensive information about GDPR legal bases (Art. 6, 9, 10)
|
||||
*/
|
||||
|
||||
import { LegalBasisType, LocalizedText, PersonalDataCategory } from '../types'
|
||||
|
||||
export interface LegalBasisInfo {
|
||||
type: LegalBasisType
|
||||
article: string
|
||||
name: LocalizedText
|
||||
shortName: LocalizedText
|
||||
description: LocalizedText
|
||||
requirements: LocalizedText[]
|
||||
suitableFor: string[]
|
||||
notSuitableFor: string[]
|
||||
documentationNeeded: LocalizedText[]
|
||||
isSpecialCategory: boolean
|
||||
notes?: LocalizedText
|
||||
}
|
||||
|
||||
export interface RetentionPeriodInfo {
|
||||
id: string
|
||||
name: LocalizedText
|
||||
legalBasis: string
|
||||
duration: {
|
||||
value: number
|
||||
unit: 'DAYS' | 'MONTHS' | 'YEARS'
|
||||
}
|
||||
description: LocalizedText
|
||||
applicableTo: string[]
|
||||
}
|
||||
|
||||
// ==========================================
|
||||
// LEGAL BASIS INFORMATION (Art. 6 DSGVO)
|
||||
// ==========================================
|
||||
|
||||
export const LEGAL_BASIS_INFO: LegalBasisInfo[] = [
|
||||
// Art. 6 Abs. 1 DSGVO - Standard legal bases
|
||||
{
|
||||
type: 'CONSENT',
|
||||
article: 'Art. 6 Abs. 1 lit. a DSGVO',
|
||||
name: { de: 'Einwilligung', en: 'Consent' },
|
||||
shortName: { de: 'Einwilligung', en: 'Consent' },
|
||||
description: {
|
||||
de: 'Die betroffene Person hat ihre Einwilligung zu der Verarbeitung der sie betreffenden personenbezogenen Daten für einen oder mehrere bestimmte Zwecke gegeben.',
|
||||
en: 'The data subject has given consent to the processing of his or her personal data for one or more specific purposes.',
|
||||
},
|
||||
requirements: [
|
||||
{ de: 'Freiwillig erteilt', en: 'Freely given' },
|
||||
{ de: 'Für bestimmten Zweck', en: 'For a specific purpose' },
|
||||
{ de: 'Informiert', en: 'Informed' },
|
||||
{ de: 'Unmissverständlich', en: 'Unambiguous' },
|
||||
{ de: 'Jederzeit widerrufbar', en: 'Revocable at any time' },
|
||||
{ de: 'Nachweis muss möglich sein', en: 'Must be demonstrable' },
|
||||
],
|
||||
suitableFor: ['Newsletter', 'Marketing', 'Cookies', 'Tracking', 'Fotos/Videos'],
|
||||
notSuitableFor: ['Vertragsdurchführung', 'Gesetzliche Pflichten', 'Arbeitsverhältnis'],
|
||||
documentationNeeded: [
|
||||
{ de: 'Einwilligungstext', en: 'Consent text' },
|
||||
{ de: 'Zeitpunkt der Einwilligung', en: 'Time of consent' },
|
||||
{ de: 'Art der Erteilung (Opt-in)', en: 'Method of consent (opt-in)' },
|
||||
{ de: 'Widerrufsbelehrung', en: 'Information about withdrawal' },
|
||||
],
|
||||
isSpecialCategory: false,
|
||||
},
|
||||
{
|
||||
type: 'CONTRACT',
|
||||
article: 'Art. 6 Abs. 1 lit. b DSGVO',
|
||||
name: { de: 'Vertragserfüllung', en: 'Contract Performance' },
|
||||
shortName: { de: 'Vertrag', en: 'Contract' },
|
||||
description: {
|
||||
de: 'Die Verarbeitung ist für die Erfüllung eines Vertrags, dessen Vertragspartei die betroffene Person ist, oder zur Durchführung vorvertraglicher Maßnahmen erforderlich.',
|
||||
en: 'Processing is necessary for the performance of a contract to which the data subject is party or for pre-contractual measures.',
|
||||
},
|
||||
requirements: [
|
||||
{ de: 'Vertrag besteht oder wird angebahnt', en: 'Contract exists or is being initiated' },
|
||||
{ de: 'Verarbeitung ist für Erfüllung erforderlich', en: 'Processing is necessary for performance' },
|
||||
{ de: 'Betroffene Person ist Vertragspartei', en: 'Data subject is a party to the contract' },
|
||||
],
|
||||
suitableFor: ['Kundendaten', 'Bestellabwicklung', 'Lieferung', 'Rechnungsstellung', 'Kundenservice'],
|
||||
notSuitableFor: ['Marketing', 'Profiling', 'Weitergabe an Dritte ohne Vertragsbezug'],
|
||||
documentationNeeded: [
|
||||
{ de: 'Vertrag oder AGB', en: 'Contract or T&C' },
|
||||
{ de: 'Zusammenhang zur Verarbeitung', en: 'Connection to processing' },
|
||||
],
|
||||
isSpecialCategory: false,
|
||||
},
|
||||
{
|
||||
type: 'LEGAL_OBLIGATION',
|
||||
article: 'Art. 6 Abs. 1 lit. c DSGVO',
|
||||
name: { de: 'Rechtliche Verpflichtung', en: 'Legal Obligation' },
|
||||
shortName: { de: 'Gesetz', en: 'Legal' },
|
||||
description: {
|
||||
de: 'Die Verarbeitung ist zur Erfüllung einer rechtlichen Verpflichtung erforderlich, der der Verantwortliche unterliegt.',
|
||||
en: 'Processing is necessary for compliance with a legal obligation to which the controller is subject.',
|
||||
},
|
||||
requirements: [
|
||||
{ de: 'Rechtliche Verpflichtung im EU/nationalen Recht', en: 'Legal obligation in EU/national law' },
|
||||
{ de: 'Verarbeitung ist zur Erfüllung erforderlich', en: 'Processing is necessary for compliance' },
|
||||
{ de: 'Konkrete Rechtsgrundlage benennen', en: 'Cite specific legal basis' },
|
||||
],
|
||||
suitableFor: ['Steuerliche Aufbewahrung', 'Sozialversicherung', 'AML/KYC', 'Meldepflichten'],
|
||||
notSuitableFor: ['Freiwillige Maßnahmen', 'Marketing'],
|
||||
documentationNeeded: [
|
||||
{ de: 'Konkrete Rechtsvorschrift', en: 'Specific legal provision' },
|
||||
{ de: 'HGB, AO, SGB, etc.', en: 'Commercial code, tax code, etc.' },
|
||||
],
|
||||
isSpecialCategory: false,
|
||||
},
|
||||
{
|
||||
type: 'VITAL_INTEREST',
|
||||
article: 'Art. 6 Abs. 1 lit. d DSGVO',
|
||||
name: { de: 'Lebenswichtige Interessen', en: 'Vital Interests' },
|
||||
shortName: { de: 'Vital', en: 'Vital' },
|
||||
description: {
|
||||
de: 'Die Verarbeitung ist erforderlich, um lebenswichtige Interessen der betroffenen Person oder einer anderen natürlichen Person zu schützen.',
|
||||
en: 'Processing is necessary to protect the vital interests of the data subject or of another natural person.',
|
||||
},
|
||||
requirements: [
|
||||
{ de: 'Gefahr für Leben oder Gesundheit', en: 'Danger to life or health' },
|
||||
{ de: 'Keine andere Rechtsgrundlage möglich', en: 'No other legal basis possible' },
|
||||
{ de: 'Subsidiär zu anderen Rechtsgrundlagen', en: 'Subsidiary to other legal bases' },
|
||||
],
|
||||
suitableFor: ['Notfall', 'Medizinische Notversorgung', 'Katastrophenschutz'],
|
||||
notSuitableFor: ['Regelmäßige Verarbeitung', 'Vorsorgemaßnahmen'],
|
||||
documentationNeeded: [
|
||||
{ de: 'Dokumentation des Notfalls', en: 'Documentation of emergency' },
|
||||
{ de: 'Begründung der Erforderlichkeit', en: 'Justification of necessity' },
|
||||
],
|
||||
isSpecialCategory: false,
|
||||
notes: {
|
||||
de: 'Sollte nur in Ausnahmefällen verwendet werden, wenn keine andere Rechtsgrundlage greift.',
|
||||
en: 'Should only be used in exceptional cases when no other legal basis applies.',
|
||||
},
|
||||
},
|
||||
{
|
||||
type: 'PUBLIC_TASK',
|
||||
article: 'Art. 6 Abs. 1 lit. e DSGVO',
|
||||
name: { de: 'Öffentliche Aufgabe', en: 'Public Task' },
|
||||
shortName: { de: 'Öffentlich', en: 'Public' },
|
||||
description: {
|
||||
de: 'Die Verarbeitung ist für die Wahrnehmung einer Aufgabe erforderlich, die im öffentlichen Interesse liegt oder in Ausübung öffentlicher Gewalt erfolgt.',
|
||||
en: 'Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.',
|
||||
},
|
||||
requirements: [
|
||||
{ de: 'Öffentliches Interesse oder hoheitliche Aufgabe', en: 'Public interest or official authority' },
|
||||
{ de: 'Rechtsgrundlage im EU/nationalen Recht', en: 'Legal basis in EU/national law' },
|
||||
],
|
||||
suitableFor: ['Behörden', 'Öffentlich-rechtliche Einrichtungen', 'Bildungseinrichtungen'],
|
||||
notSuitableFor: ['Private Unternehmen (in der Regel)'],
|
||||
documentationNeeded: [
|
||||
{ de: 'Rechtsgrundlage für öffentliche Aufgabe', en: 'Legal basis for public task' },
|
||||
{ de: 'Zusammenhang zur Aufgabe', en: 'Connection to task' },
|
||||
],
|
||||
isSpecialCategory: false,
|
||||
},
|
||||
{
|
||||
type: 'LEGITIMATE_INTEREST',
|
||||
article: 'Art. 6 Abs. 1 lit. f DSGVO',
|
||||
name: { de: 'Berechtigtes Interesse', en: 'Legitimate Interest' },
|
||||
shortName: { de: 'Ber. Interesse', en: 'Leg. Interest' },
|
||||
description: {
|
||||
de: 'Die Verarbeitung ist zur Wahrung der berechtigten Interessen des Verantwortlichen oder eines Dritten erforderlich, sofern nicht die Interessen oder Grundrechte der betroffenen Person überwiegen.',
|
||||
en: 'Processing is necessary for the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or rights of the data subject.',
|
||||
},
|
||||
requirements: [
|
||||
{ de: 'Berechtigtes Interesse identifizieren', en: 'Identify legitimate interest' },
|
||||
{ de: 'Erforderlichkeit prüfen', en: 'Check necessity' },
|
||||
{ de: 'Interessenabwägung durchführen', en: 'Conduct balancing test' },
|
||||
{ de: 'Dokumentieren', en: 'Document' },
|
||||
],
|
||||
suitableFor: ['B2B-Marketing', 'IT-Sicherheit', 'Betrugsprävention', 'Konzerninterner Datenaustausch'],
|
||||
notSuitableFor: ['Behörden', 'Verarbeitung sensibler Daten', 'Wenn Einwilligung verweigert wurde'],
|
||||
documentationNeeded: [
|
||||
{ de: 'Interessenabwägung (LIA)', en: 'Legitimate Interest Assessment (LIA)' },
|
||||
{ de: 'Konkrete Interessen', en: 'Specific interests' },
|
||||
{ de: 'Abwägung der Betroffenenrechte', en: 'Balancing of data subject rights' },
|
||||
],
|
||||
isSpecialCategory: false,
|
||||
notes: {
|
||||
de: 'Nicht anwendbar für Behörden bei Aufgabenerfüllung. Interessenabwägung (LIA) erforderlich.',
|
||||
en: 'Not applicable for public authorities performing their tasks. Legitimate Interest Assessment (LIA) required.',
|
||||
},
|
||||
},
|
||||
|
||||
// Art. 9 Abs. 2 DSGVO - Special categories
|
||||
{
|
||||
type: 'ART9_CONSENT',
|
||||
article: 'Art. 9 Abs. 2 lit. a DSGVO',
|
||||
name: { de: 'Ausdrückliche Einwilligung', en: 'Explicit Consent' },
|
||||
shortName: { de: 'Ausd. Einwilligung', en: 'Explicit Consent' },
|
||||
description: {
|
||||
de: 'Die betroffene Person hat in die Verarbeitung der besonderen Kategorien personenbezogener Daten ausdrücklich eingewilligt.',
|
||||
en: 'The data subject has given explicit consent to the processing of special categories of personal data.',
|
||||
},
|
||||
requirements: [
|
||||
{ de: 'Alle Anforderungen der normalen Einwilligung', en: 'All requirements of normal consent' },
|
||||
{ de: 'Zusätzlich: Ausdrücklich', en: 'Additionally: Explicit' },
|
||||
{ de: 'Besonderer Hinweis auf sensible Daten', en: 'Special notice about sensitive data' },
|
||||
],
|
||||
suitableFor: ['Gesundheitsdaten mit Einwilligung', 'Religiöse Daten mit Einwilligung'],
|
||||
notSuitableFor: ['Arbeitsverhältnis (in der Regel)', 'Wenn nationales Recht es verbietet'],
|
||||
documentationNeeded: [
|
||||
{ de: 'Einwilligungstext mit Hinweis auf sensible Daten', en: 'Consent text with reference to sensitive data' },
|
||||
{ de: 'Nachweis der ausdrücklichen Erteilung', en: 'Proof of explicit consent' },
|
||||
],
|
||||
isSpecialCategory: true,
|
||||
},
|
||||
{
|
||||
type: 'ART9_EMPLOYMENT',
|
||||
article: 'Art. 9 Abs. 2 lit. b DSGVO',
|
||||
name: { de: 'Arbeitsrecht', en: 'Employment Law' },
|
||||
shortName: { de: 'Arbeitsrecht', en: 'Employment' },
|
||||
description: {
|
||||
de: 'Die Verarbeitung ist erforderlich für arbeitsrechtliche Zwecke auf Grundlage von nationalen Rechtsvorschriften.',
|
||||
en: 'Processing is necessary for employment law purposes based on national law provisions.',
|
||||
},
|
||||
requirements: [
|
||||
{ de: 'Arbeitsrechtliche Grundlage (z.B. § 26 BDSG)', en: 'Employment law basis (e.g., § 26 BDSG)' },
|
||||
{ de: 'Erforderlichkeit für Beschäftigung', en: 'Necessity for employment' },
|
||||
{ de: 'Angemessene Garantien', en: 'Appropriate safeguards' },
|
||||
],
|
||||
suitableFor: ['Gesundheitsdaten im Arbeitsverhältnis', 'Schwerbehinderung', 'Gewerkschaftszugehörigkeit'],
|
||||
notSuitableFor: ['Verarbeitung über das Erforderliche hinaus'],
|
||||
documentationNeeded: [
|
||||
{ de: 'Rechtsgrundlage (§ 26 BDSG)', en: 'Legal basis (§ 26 BDSG)' },
|
||||
{ de: 'Erforderlichkeit dokumentieren', en: 'Document necessity' },
|
||||
],
|
||||
isSpecialCategory: true,
|
||||
},
|
||||
{
|
||||
type: 'ART9_VITAL_INTEREST',
|
||||
article: 'Art. 9 Abs. 2 lit. c DSGVO',
|
||||
name: { de: 'Lebenswichtige Interessen (Art. 9)', en: 'Vital Interests (Art. 9)' },
|
||||
shortName: { de: 'Vital (Art. 9)', en: 'Vital (Art. 9)' },
|
||||
description: {
|
||||
de: 'Die Verarbeitung ist zum Schutz lebenswichtiger Interessen erforderlich und die betroffene Person ist nicht einwilligungsfähig.',
|
||||
en: 'Processing is necessary to protect vital interests and the data subject is incapable of giving consent.',
|
||||
},
|
||||
requirements: [
|
||||
{ de: 'Schutz lebenswichtiger Interessen', en: 'Protection of vital interests' },
|
||||
{ de: 'Betroffene Person nicht einwilligungsfähig', en: 'Data subject incapable of consent' },
|
||||
],
|
||||
suitableFor: ['Medizinische Notfälle', 'Bewusstlose Personen'],
|
||||
notSuitableFor: ['Regelmäßige Verarbeitung'],
|
||||
documentationNeeded: [
|
||||
{ de: 'Dokumentation des Notfalls', en: 'Documentation of emergency' },
|
||||
{ de: 'Nachweis der fehlenden Einwilligungsfähigkeit', en: 'Proof of incapacity to consent' },
|
||||
],
|
||||
isSpecialCategory: true,
|
||||
},
|
||||
{
|
||||
type: 'ART9_HEALTH',
|
||||
article: 'Art. 9 Abs. 2 lit. h DSGVO',
|
||||
name: { de: 'Gesundheitsversorgung', en: 'Health Care' },
|
||||
shortName: { de: 'Gesundheit', en: 'Health' },
|
||||
description: {
|
||||
de: 'Die Verarbeitung ist für Zwecke der Gesundheitsvorsorge oder Arbeitsmedizin erforderlich, auf Grundlage von EU- oder nationalem Recht.',
|
||||
en: 'Processing is necessary for health care purposes or occupational medicine based on EU or national law.',
|
||||
},
|
||||
requirements: [
|
||||
{ de: 'Gesundheitsvorsorge, Arbeitsmedizin', en: 'Health care, occupational medicine' },
|
||||
{ de: 'Rechtsgrundlage im EU/nationalen Recht', en: 'Legal basis in EU/national law' },
|
||||
{ de: 'Verarbeitung durch Fachpersonal', en: 'Processing by health professionals' },
|
||||
{ de: 'Berufsgeheimnis beachten', en: 'Professional secrecy' },
|
||||
],
|
||||
suitableFor: ['Medizinische Behandlung', 'Betriebsärztliche Untersuchungen', 'Gesundheitsmanagement'],
|
||||
notSuitableFor: ['Verarbeitung ohne medizinischen Kontext'],
|
||||
documentationNeeded: [
|
||||
{ de: 'Rechtsgrundlage', en: 'Legal basis' },
|
||||
{ de: 'Fachliche Zuständigkeit', en: 'Professional competence' },
|
||||
],
|
||||
isSpecialCategory: true,
|
||||
},
|
||||
{
|
||||
type: 'ART9_PUBLIC_HEALTH',
|
||||
article: 'Art. 9 Abs. 2 lit. i DSGVO',
|
||||
name: { de: 'Öffentliche Gesundheit', en: 'Public Health' },
|
||||
shortName: { de: 'Öff. Gesundheit', en: 'Public Health' },
|
||||
description: {
|
||||
de: 'Die Verarbeitung ist aus Gründen des öffentlichen Interesses im Bereich der öffentlichen Gesundheit erforderlich.',
|
||||
en: 'Processing is necessary for reasons of public interest in the area of public health.',
|
||||
},
|
||||
requirements: [
|
||||
{ de: 'Öffentliches Interesse an öffentlicher Gesundheit', en: 'Public interest in public health' },
|
||||
{ de: 'Rechtsgrundlage im EU/nationalen Recht', en: 'Legal basis in EU/national law' },
|
||||
{ de: 'Angemessene Garantien', en: 'Appropriate safeguards' },
|
||||
],
|
||||
suitableFor: ['Pandemiebekämpfung', 'Seuchenprävention', 'Qualitätssicherung im Gesundheitswesen'],
|
||||
notSuitableFor: ['Private Interessen'],
|
||||
documentationNeeded: [
|
||||
{ de: 'Rechtsgrundlage', en: 'Legal basis' },
|
||||
{ de: 'Nachweis öffentliches Interesse', en: 'Proof of public interest' },
|
||||
],
|
||||
isSpecialCategory: true,
|
||||
},
|
||||
{
|
||||
type: 'ART9_LEGAL_CLAIMS',
|
||||
article: 'Art. 9 Abs. 2 lit. f DSGVO',
|
||||
name: { de: 'Rechtsansprüche', en: 'Legal Claims' },
|
||||
shortName: { de: 'Rechtsansprüche', en: 'Legal Claims' },
|
||||
description: {
|
||||
de: 'Die Verarbeitung ist zur Geltendmachung, Ausübung oder Verteidigung von Rechtsansprüchen erforderlich.',
|
||||
en: 'Processing is necessary for the establishment, exercise or defence of legal claims.',
|
||||
},
|
||||
requirements: [
|
||||
{ de: 'Rechtsansprüche bestehen oder drohen', en: 'Legal claims exist or are anticipated' },
|
||||
{ de: 'Verarbeitung ist erforderlich', en: 'Processing is necessary' },
|
||||
],
|
||||
suitableFor: ['Rechtsstreitigkeiten', 'Compliance-Untersuchungen', 'Interne Ermittlungen'],
|
||||
notSuitableFor: ['Präventive Maßnahmen ohne konkreten Anlass'],
|
||||
documentationNeeded: [
|
||||
{ de: 'Dokumentation des Rechtsstreits/Anspruchs', en: 'Documentation of legal dispute/claim' },
|
||||
{ de: 'Erforderlichkeit der Verarbeitung', en: 'Necessity of processing' },
|
||||
],
|
||||
isSpecialCategory: true,
|
||||
},
|
||||
]
|
||||
|
||||
// ==========================================
|
||||
// RETENTION PERIODS
|
||||
// ==========================================
|
||||
|
||||
export const STANDARD_RETENTION_PERIODS: RetentionPeriodInfo[] = [
|
||||
// Handelsrechtliche Aufbewahrung
|
||||
{
|
||||
id: 'hgb-257',
|
||||
name: { de: 'Handelsbücher und Buchungsbelege', en: 'Commercial Books and Vouchers' },
|
||||
legalBasis: '§ 257 HGB',
|
||||
duration: { value: 10, unit: 'YEARS' },
|
||||
description: {
|
||||
de: 'Handelsbücher, Inventare, Eröffnungsbilanzen, Jahresabschlüsse, Lageberichte, Konzernabschlüsse, Buchungsbelege',
|
||||
en: 'Commercial books, inventories, opening balance sheets, annual financial statements, management reports, consolidated financial statements, accounting vouchers',
|
||||
},
|
||||
applicableTo: ['Buchhaltung', 'Jahresabschlüsse', 'Rechnungen', 'Verträge'],
|
||||
},
|
||||
{
|
||||
id: 'hgb-257-6',
|
||||
name: { de: 'Handels- und Geschäftsbriefe', en: 'Commercial and Business Correspondence' },
|
||||
legalBasis: '§ 257 Abs. 1 Nr. 2, 3 HGB',
|
||||
duration: { value: 6, unit: 'YEARS' },
|
||||
description: {
|
||||
de: 'Empfangene Handels- und Geschäftsbriefe, Wiedergaben der abgesandten Handels- und Geschäftsbriefe',
|
||||
en: 'Received commercial and business correspondence, copies of sent correspondence',
|
||||
},
|
||||
applicableTo: ['Geschäftskorrespondenz', 'Angebote', 'Auftragsbestätigungen'],
|
||||
},
|
||||
// Steuerrechtliche Aufbewahrung
|
||||
{
|
||||
id: 'ao-147',
|
||||
name: { de: 'Steuerrechtliche Unterlagen', en: 'Tax Documents' },
|
||||
legalBasis: '§ 147 AO',
|
||||
duration: { value: 10, unit: 'YEARS' },
|
||||
description: {
|
||||
de: 'Bücher und Aufzeichnungen, Inventare, Jahresabschlüsse, Buchungsbelege, steuerrelevante Unterlagen',
|
||||
en: 'Books and records, inventories, annual financial statements, accounting vouchers, tax-relevant documents',
|
||||
},
|
||||
applicableTo: ['Steuererklärungen', 'Buchhaltung', 'Belege'],
|
||||
},
|
||||
// Arbeitsrechtliche Aufbewahrung
|
||||
{
|
||||
id: 'arbeitsrecht-personal',
|
||||
name: { de: 'Personalunterlagen', en: 'Personnel Records' },
|
||||
legalBasis: 'Verschiedene (AGG, ArbZG, etc.)',
|
||||
duration: { value: 3, unit: 'YEARS' },
|
||||
description: {
|
||||
de: 'Personalakte nach Beendigung des Arbeitsverhältnisses (Regelverjährung)',
|
||||
en: 'Personnel file after termination of employment (standard limitation period)',
|
||||
},
|
||||
applicableTo: ['Personalakten', 'Arbeitsverträge', 'Zeugnisse'],
|
||||
},
|
||||
{
|
||||
id: 'arbzg',
|
||||
name: { de: 'Arbeitszeitaufzeichnungen', en: 'Working Time Records' },
|
||||
legalBasis: '§ 16 Abs. 2 ArbZG',
|
||||
duration: { value: 2, unit: 'YEARS' },
|
||||
description: {
|
||||
de: 'Aufzeichnungen über Arbeitszeiten, die über 8 Stunden hinausgehen',
|
||||
en: 'Records of working hours exceeding 8 hours',
|
||||
},
|
||||
applicableTo: ['Zeiterfassung', 'Überstunden'],
|
||||
},
|
||||
{
|
||||
id: 'lohnsteuer',
|
||||
name: { de: 'Lohnunterlagen', en: 'Payroll Documents' },
|
||||
legalBasis: '§ 41 EStG, § 28f SGB IV',
|
||||
duration: { value: 6, unit: 'YEARS' },
|
||||
description: {
|
||||
de: 'Lohnkonten und Unterlagen für den Lohnsteuerabzug',
|
||||
en: 'Payroll accounts and documents for wage tax deduction',
|
||||
},
|
||||
applicableTo: ['Lohnabrechnungen', 'Lohnsteuerbescheinigungen'],
|
||||
},
|
||||
{
|
||||
id: 'sozialversicherung',
|
||||
name: { de: 'Sozialversicherungsunterlagen', en: 'Social Security Documents' },
|
||||
legalBasis: '§ 28f SGB IV',
|
||||
duration: { value: 5, unit: 'YEARS' },
|
||||
description: {
|
||||
de: 'Unterlagen zum Gesamtsozialversicherungsbeitrag',
|
||||
en: 'Documents for total social security contributions',
|
||||
},
|
||||
applicableTo: ['Sozialversicherungsmeldungen', 'Beitragsnachweise'],
|
||||
},
|
||||
// Bewerberdaten
|
||||
{
|
||||
id: 'bewerbung',
|
||||
name: { de: 'Bewerbungsunterlagen', en: 'Application Documents' },
|
||||
legalBasis: '§ 15 Abs. 4 AGG',
|
||||
duration: { value: 6, unit: 'MONTHS' },
|
||||
description: {
|
||||
de: 'Bewerbungsunterlagen nach Absage (AGG-Frist)',
|
||||
en: 'Application documents after rejection (AGG deadline)',
|
||||
},
|
||||
applicableTo: ['Bewerbungen', 'Lebensläufe', 'Zeugnisse von Bewerbern'],
|
||||
},
|
||||
// Datenschutzrechtliche Fristen
|
||||
{
|
||||
id: 'einwilligung',
|
||||
name: { de: 'Einwilligungen', en: 'Consents' },
|
||||
legalBasis: 'Art. 7 Abs. 1 DSGVO',
|
||||
duration: { value: 3, unit: 'YEARS' },
|
||||
description: {
|
||||
de: 'Dokumentation der Einwilligung (Regelverjährung)',
|
||||
en: 'Documentation of consent (standard limitation period)',
|
||||
},
|
||||
applicableTo: ['Einwilligungsnachweise', 'Opt-in-Dokumentation'],
|
||||
},
|
||||
{
|
||||
id: 'videoüberwachung',
|
||||
name: { de: 'Videoüberwachung', en: 'Video Surveillance' },
|
||||
legalBasis: 'Verhältnismäßigkeit',
|
||||
duration: { value: 72, unit: 'DAYS' },
|
||||
description: {
|
||||
de: 'Videoaufnahmen (max. 72 Stunden, sofern kein Vorfall)',
|
||||
en: 'Video recordings (max. 72 hours, unless incident occurred)',
|
||||
},
|
||||
applicableTo: ['CCTV-Aufnahmen', 'Überwachungsvideos'],
|
||||
},
|
||||
// Löschung nach Vertrag
|
||||
{
|
||||
id: 'avv-loeschung',
|
||||
name: { de: 'AVV-Daten nach Vertragsende', en: 'DPA Data after Contract End' },
|
||||
legalBasis: 'Art. 28 Abs. 3 lit. g DSGVO',
|
||||
duration: { value: 30, unit: 'DAYS' },
|
||||
description: {
|
||||
de: 'Löschung oder Rückgabe aller personenbezogenen Daten nach Vertragsende',
|
||||
en: 'Deletion or return of all personal data after contract end',
|
||||
},
|
||||
applicableTo: ['Auftragsverarbeitung', 'Dienstleister-Daten'],
|
||||
},
|
||||
]
|
||||
|
||||
// ==========================================
|
||||
// HELPER FUNCTIONS
|
||||
// ==========================================
|
||||
|
||||
/**
|
||||
* Get legal basis info by type
|
||||
*/
|
||||
export function getLegalBasisInfo(type: LegalBasisType): LegalBasisInfo | undefined {
|
||||
return LEGAL_BASIS_INFO.find((lb) => lb.type === type)
|
||||
}
|
||||
|
||||
/**
|
||||
* Get legal bases for standard data (non-special categories)
|
||||
*/
|
||||
export function getStandardLegalBases(): LegalBasisInfo[] {
|
||||
return LEGAL_BASIS_INFO.filter((lb) => !lb.isSpecialCategory)
|
||||
}
|
||||
|
||||
/**
|
||||
* Get legal bases for special category data (Art. 9)
|
||||
*/
|
||||
export function getSpecialCategoryLegalBases(): LegalBasisInfo[] {
|
||||
return LEGAL_BASIS_INFO.filter((lb) => lb.isSpecialCategory)
|
||||
}
|
||||
|
||||
/**
|
||||
* Get appropriate legal bases for data categories
|
||||
*/
|
||||
export function getAppropriateLegalBases(
|
||||
dataCategories: PersonalDataCategory[]
|
||||
): LegalBasisInfo[] {
|
||||
const hasSpecialCategory = dataCategories.some((cat) =>
|
||||
[
|
||||
'HEALTH_DATA', 'GENETIC_DATA', 'BIOMETRIC_DATA', 'RACIAL_ETHNIC',
|
||||
'POLITICAL_OPINIONS', 'RELIGIOUS_BELIEFS', 'TRADE_UNION', 'SEX_LIFE',
|
||||
].includes(cat)
|
||||
)
|
||||
|
||||
if (hasSpecialCategory) {
|
||||
// Return Art. 9 bases plus compatible Art. 6 bases
|
||||
return [
|
||||
...getSpecialCategoryLegalBases(),
|
||||
...getStandardLegalBases().filter((lb) =>
|
||||
['LEGAL_OBLIGATION', 'VITAL_INTEREST', 'PUBLIC_TASK'].includes(lb.type)
|
||||
),
|
||||
]
|
||||
}
|
||||
|
||||
return getStandardLegalBases()
|
||||
}
|
||||
|
||||
/**
|
||||
* Get retention period by ID
|
||||
*/
|
||||
export function getRetentionPeriod(id: string): RetentionPeriodInfo | undefined {
|
||||
return STANDARD_RETENTION_PERIODS.find((rp) => rp.id === id)
|
||||
}
|
||||
|
||||
/**
|
||||
* Get retention periods applicable to a category
|
||||
*/
|
||||
export function getRetentionPeriodsForCategory(category: string): RetentionPeriodInfo[] {
|
||||
return STANDARD_RETENTION_PERIODS.filter((rp) =>
|
||||
rp.applicableTo.some((a) => a.toLowerCase().includes(category.toLowerCase()))
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Get longest applicable retention period
|
||||
*/
|
||||
export function getLongestRetentionPeriod(categories: string[]): RetentionPeriodInfo | undefined {
|
||||
const applicable = categories.flatMap((cat) => getRetentionPeriodsForCategory(cat))
|
||||
|
||||
if (applicable.length === 0) return undefined
|
||||
|
||||
return applicable.reduce((longest, current) => {
|
||||
const longestMonths = toMonths(longest.duration)
|
||||
const currentMonths = toMonths(current.duration)
|
||||
return currentMonths > longestMonths ? current : longest
|
||||
})
|
||||
}
|
||||
|
||||
function toMonths(duration: { value: number; unit: 'DAYS' | 'MONTHS' | 'YEARS' }): number {
|
||||
switch (duration.unit) {
|
||||
case 'DAYS':
|
||||
return duration.value / 30
|
||||
case 'MONTHS':
|
||||
return duration.value
|
||||
case 'YEARS':
|
||||
return duration.value * 12
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Format retention period for display
|
||||
*/
|
||||
export function formatRetentionPeriod(
|
||||
duration: { value: number; unit: 'DAYS' | 'MONTHS' | 'YEARS' },
|
||||
locale: 'de' | 'en' = 'de'
|
||||
): string {
|
||||
const units = {
|
||||
de: { DAYS: 'Tage', MONTHS: 'Monate', YEARS: 'Jahre' },
|
||||
en: { DAYS: 'days', MONTHS: 'months', YEARS: 'years' },
|
||||
}
|
||||
|
||||
return `${duration.value} ${units[locale][duration.unit]}`
|
||||
}
|
||||
@@ -0,0 +1,813 @@
|
||||
/**
|
||||
* Standard Processing Activities Catalog
|
||||
*
|
||||
* 28 predefined processing activities templates following Art. 30 DSGVO
|
||||
*/
|
||||
|
||||
import {
|
||||
ProcessingActivityFormData,
|
||||
DataSubjectCategory,
|
||||
PersonalDataCategory,
|
||||
LegalBasisType,
|
||||
ProtectionLevel,
|
||||
LocalizedText,
|
||||
} from '../types'
|
||||
|
||||
export interface ProcessingActivityTemplate {
|
||||
id: string
|
||||
category: ProcessingActivityCategory
|
||||
name: LocalizedText
|
||||
description: LocalizedText
|
||||
purposes: LocalizedText[]
|
||||
dataSubjectCategories: DataSubjectCategory[]
|
||||
personalDataCategories: PersonalDataCategory[]
|
||||
suggestedLegalBasis: LegalBasisType[]
|
||||
suggestedRetentionYears: number
|
||||
suggestedProtectionLevel: ProtectionLevel
|
||||
dpiaLikely: boolean
|
||||
commonSystems: string[]
|
||||
commonVendorCategories: string[]
|
||||
}
|
||||
|
||||
export type ProcessingActivityCategory =
|
||||
| 'HR' // Human Resources
|
||||
| 'SALES' // Vertrieb
|
||||
| 'MARKETING' // Marketing
|
||||
| 'FINANCE' // Finanzen
|
||||
| 'IT' // IT & Sicherheit
|
||||
| 'CUSTOMER_SERVICE' // Kundenservice
|
||||
| 'WEBSITE' // Website & Apps
|
||||
| 'GENERAL' // Allgemein
|
||||
|
||||
export const PROCESSING_ACTIVITY_CATEGORY_META: Record<ProcessingActivityCategory, LocalizedText> = {
|
||||
HR: { de: 'Personal', en: 'Human Resources' },
|
||||
SALES: { de: 'Vertrieb', en: 'Sales' },
|
||||
MARKETING: { de: 'Marketing', en: 'Marketing' },
|
||||
FINANCE: { de: 'Finanzen', en: 'Finance' },
|
||||
IT: { de: 'IT & Sicherheit', en: 'IT & Security' },
|
||||
CUSTOMER_SERVICE: { de: 'Kundenservice', en: 'Customer Service' },
|
||||
WEBSITE: { de: 'Website & Apps', en: 'Website & Apps' },
|
||||
GENERAL: { de: 'Allgemein', en: 'General' },
|
||||
}
|
||||
|
||||
export const PROCESSING_ACTIVITY_TEMPLATES: ProcessingActivityTemplate[] = [
|
||||
// ==========================================
|
||||
// HR - Human Resources
|
||||
// ==========================================
|
||||
{
|
||||
id: 'tpl-hr-recruitment',
|
||||
category: 'HR',
|
||||
name: {
|
||||
de: 'Bewerbermanagement',
|
||||
en: 'Recruitment Management',
|
||||
},
|
||||
description: {
|
||||
de: 'Verarbeitung von Bewerberdaten im Rahmen des Recruiting-Prozesses',
|
||||
en: 'Processing of applicant data as part of the recruitment process',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Durchführung des Bewerbungsverfahrens', en: 'Conducting the application process' },
|
||||
{ de: 'Prüfung der Eignung', en: 'Assessing suitability' },
|
||||
{ de: 'Aufbau eines Talentpools (bei Einwilligung)', en: 'Building a talent pool (with consent)' },
|
||||
],
|
||||
dataSubjectCategories: ['APPLICANTS'],
|
||||
personalDataCategories: [
|
||||
'NAME', 'CONTACT', 'ADDRESS', 'DOB', 'EDUCATION_DATA',
|
||||
'EMPLOYMENT_DATA', 'PHOTO_VIDEO',
|
||||
],
|
||||
suggestedLegalBasis: ['CONTRACT', 'CONSENT'],
|
||||
suggestedRetentionYears: 0.5, // 6 Monate nach Absage
|
||||
suggestedProtectionLevel: 'MEDIUM',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['E-Recruiting', 'Personio', 'Workday'],
|
||||
commonVendorCategories: ['HR_SOFTWARE', 'CLOUD_INFRASTRUCTURE'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-hr-personnel',
|
||||
category: 'HR',
|
||||
name: {
|
||||
de: 'Personalverwaltung',
|
||||
en: 'Personnel Administration',
|
||||
},
|
||||
description: {
|
||||
de: 'Führung der Personalakte und Verwaltung des Beschäftigungsverhältnisses',
|
||||
en: 'Maintaining personnel files and managing employment relationships',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Führung der Personalakte', en: 'Maintaining personnel files' },
|
||||
{ de: 'Durchführung des Arbeitsverhältnisses', en: 'Executing the employment relationship' },
|
||||
{ de: 'Erfüllung gesetzlicher Pflichten', en: 'Fulfilling legal obligations' },
|
||||
],
|
||||
dataSubjectCategories: ['EMPLOYEES'],
|
||||
personalDataCategories: [
|
||||
'NAME', 'CONTACT', 'ADDRESS', 'DOB', 'ID_NUMBER',
|
||||
'SOCIAL_SECURITY', 'TAX_ID', 'BANK_ACCOUNT', 'EMPLOYMENT_DATA',
|
||||
'SALARY_DATA', 'EDUCATION_DATA', 'PHOTO_VIDEO',
|
||||
],
|
||||
suggestedLegalBasis: ['CONTRACT', 'LEGAL_OBLIGATION'],
|
||||
suggestedRetentionYears: 10, // Nach Beendigung
|
||||
suggestedProtectionLevel: 'HIGH',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['SAP HCM', 'Personio', 'DATEV'],
|
||||
commonVendorCategories: ['HR_SOFTWARE', 'ERP'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-hr-payroll',
|
||||
category: 'HR',
|
||||
name: {
|
||||
de: 'Lohn- und Gehaltsabrechnung',
|
||||
en: 'Payroll Processing',
|
||||
},
|
||||
description: {
|
||||
de: 'Berechnung und Auszahlung von Gehältern, Abführung von Steuern und Sozialabgaben',
|
||||
en: 'Calculation and payment of salaries, tax and social security contributions',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Gehaltsberechnung und -auszahlung', en: 'Salary calculation and payment' },
|
||||
{ de: 'Abführung von Lohnsteuer und Sozialabgaben', en: 'Payment of payroll taxes and social contributions' },
|
||||
{ de: 'Erstellung von Lohnabrechnungen', en: 'Creating payslips' },
|
||||
],
|
||||
dataSubjectCategories: ['EMPLOYEES'],
|
||||
personalDataCategories: [
|
||||
'NAME', 'ADDRESS', 'DOB', 'SOCIAL_SECURITY', 'TAX_ID',
|
||||
'BANK_ACCOUNT', 'SALARY_DATA', 'EMPLOYMENT_DATA',
|
||||
],
|
||||
suggestedLegalBasis: ['CONTRACT', 'LEGAL_OBLIGATION'],
|
||||
suggestedRetentionYears: 10, // Handels- und Steuerrecht
|
||||
suggestedProtectionLevel: 'HIGH',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['DATEV', 'SAP', 'Lexware'],
|
||||
commonVendorCategories: ['ACCOUNTING', 'HR_SOFTWARE'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-hr-time-tracking',
|
||||
category: 'HR',
|
||||
name: {
|
||||
de: 'Arbeitszeiterfassung',
|
||||
en: 'Time Tracking',
|
||||
},
|
||||
description: {
|
||||
de: 'Erfassung der Arbeitszeiten zur Einhaltung des Arbeitszeitgesetzes',
|
||||
en: 'Recording working hours for compliance with working time regulations',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Erfassung der Arbeitszeiten', en: 'Recording working hours' },
|
||||
{ de: 'Einhaltung des Arbeitszeitgesetzes', en: 'Compliance with working time regulations' },
|
||||
{ de: 'Grundlage für Gehaltsabrechnung', en: 'Basis for payroll' },
|
||||
],
|
||||
dataSubjectCategories: ['EMPLOYEES'],
|
||||
personalDataCategories: ['NAME', 'EMPLOYMENT_DATA', 'USAGE_DATA'],
|
||||
suggestedLegalBasis: ['LEGAL_OBLIGATION', 'CONTRACT'],
|
||||
suggestedRetentionYears: 2,
|
||||
suggestedProtectionLevel: 'LOW',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['ATOSS', 'Clockodo', 'Toggl'],
|
||||
commonVendorCategories: ['HR_SOFTWARE'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-hr-health-management',
|
||||
category: 'HR',
|
||||
name: {
|
||||
de: 'Betriebliches Gesundheitsmanagement',
|
||||
en: 'Occupational Health Management',
|
||||
},
|
||||
description: {
|
||||
de: 'Verwaltung von Arbeitsunfähigkeitsbescheinigungen und betriebsärztlichen Untersuchungen',
|
||||
en: 'Management of sick notes and occupational health examinations',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Verwaltung von Krankmeldungen', en: 'Managing sick leave' },
|
||||
{ de: 'Organisation betriebsärztlicher Untersuchungen', en: 'Organizing occupational health examinations' },
|
||||
{ de: 'Betriebliches Eingliederungsmanagement', en: 'Occupational reintegration management' },
|
||||
],
|
||||
dataSubjectCategories: ['EMPLOYEES'],
|
||||
personalDataCategories: ['NAME', 'EMPLOYMENT_DATA', 'HEALTH_DATA'],
|
||||
suggestedLegalBasis: ['ART9_EMPLOYMENT', 'LEGAL_OBLIGATION'],
|
||||
suggestedRetentionYears: 3,
|
||||
suggestedProtectionLevel: 'HIGH',
|
||||
dpiaLikely: true,
|
||||
commonSystems: ['HR-Software', 'BEM-System'],
|
||||
commonVendorCategories: ['HR_SOFTWARE', 'CONSULTING'],
|
||||
},
|
||||
|
||||
// ==========================================
|
||||
// SALES - Vertrieb
|
||||
// ==========================================
|
||||
{
|
||||
id: 'tpl-sales-crm',
|
||||
category: 'SALES',
|
||||
name: {
|
||||
de: 'Kundenbeziehungsmanagement (CRM)',
|
||||
en: 'Customer Relationship Management (CRM)',
|
||||
},
|
||||
description: {
|
||||
de: 'Verwaltung von Kundenbeziehungen, Kontakthistorie und Verkaufschancen',
|
||||
en: 'Managing customer relationships, contact history, and sales opportunities',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Pflege von Kundenbeziehungen', en: 'Maintaining customer relationships' },
|
||||
{ de: 'Dokumentation von Kundenkontakten', en: 'Documenting customer contacts' },
|
||||
{ de: 'Vertriebssteuerung', en: 'Sales management' },
|
||||
],
|
||||
dataSubjectCategories: ['CUSTOMERS', 'PROSPECTIVE_CUSTOMERS', 'BUSINESS_PARTNERS'],
|
||||
personalDataCategories: [
|
||||
'NAME', 'CONTACT', 'ADDRESS', 'CONTRACT_DATA', 'COMMUNICATION_DATA',
|
||||
],
|
||||
suggestedLegalBasis: ['CONTRACT', 'LEGITIMATE_INTEREST'],
|
||||
suggestedRetentionYears: 3, // Nach letztem Kontakt
|
||||
suggestedProtectionLevel: 'MEDIUM',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['Salesforce', 'HubSpot', 'Pipedrive', 'Microsoft Dynamics'],
|
||||
commonVendorCategories: ['CRM'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-sales-contract-management',
|
||||
category: 'SALES',
|
||||
name: {
|
||||
de: 'Vertragsmanagement',
|
||||
en: 'Contract Management',
|
||||
},
|
||||
description: {
|
||||
de: 'Verwaltung von Kundenverträgen, Angeboten und Aufträgen',
|
||||
en: 'Managing customer contracts, quotes, and orders',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Erstellung und Verwaltung von Verträgen', en: 'Creating and managing contracts' },
|
||||
{ de: 'Angebotsverfolgung', en: 'Quote tracking' },
|
||||
{ de: 'Auftragsabwicklung', en: 'Order processing' },
|
||||
],
|
||||
dataSubjectCategories: ['CUSTOMERS', 'BUSINESS_PARTNERS'],
|
||||
personalDataCategories: [
|
||||
'NAME', 'CONTACT', 'ADDRESS', 'CONTRACT_DATA', 'PAYMENT_DATA',
|
||||
],
|
||||
suggestedLegalBasis: ['CONTRACT', 'LEGAL_OBLIGATION'],
|
||||
suggestedRetentionYears: 10, // Handelsrechtlich
|
||||
suggestedProtectionLevel: 'MEDIUM',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['ERP', 'CRM', 'Vertragsverwaltung'],
|
||||
commonVendorCategories: ['ERP', 'CRM'],
|
||||
},
|
||||
|
||||
// ==========================================
|
||||
// MARKETING
|
||||
// ==========================================
|
||||
{
|
||||
id: 'tpl-marketing-newsletter',
|
||||
category: 'MARKETING',
|
||||
name: {
|
||||
de: 'Newsletter-Versand',
|
||||
en: 'Newsletter Distribution',
|
||||
},
|
||||
description: {
|
||||
de: 'Versand von E-Mail-Newslettern und Marketing-Kommunikation',
|
||||
en: 'Sending email newsletters and marketing communications',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Versand von Newsletter und Marketing-E-Mails', en: 'Sending newsletters and marketing emails' },
|
||||
{ de: 'Messung von Öffnungs- und Klickraten', en: 'Measuring open and click rates' },
|
||||
],
|
||||
dataSubjectCategories: ['NEWSLETTER_SUBSCRIBERS', 'CUSTOMERS'],
|
||||
personalDataCategories: ['NAME', 'CONTACT', 'USAGE_DATA'],
|
||||
suggestedLegalBasis: ['CONSENT'],
|
||||
suggestedRetentionYears: 0, // Bis Widerruf
|
||||
suggestedProtectionLevel: 'LOW',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['Mailchimp', 'CleverReach', 'Sendinblue'],
|
||||
commonVendorCategories: ['EMAIL', 'MARKETING'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-marketing-advertising',
|
||||
category: 'MARKETING',
|
||||
name: {
|
||||
de: 'Online-Werbung',
|
||||
en: 'Online Advertising',
|
||||
},
|
||||
description: {
|
||||
de: 'Schaltung und Auswertung von Online-Werbeanzeigen',
|
||||
en: 'Running and analyzing online advertisements',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Schaltung von Online-Werbung', en: 'Running online advertisements' },
|
||||
{ de: 'Conversion-Tracking', en: 'Conversion tracking' },
|
||||
{ de: 'Retargeting', en: 'Retargeting' },
|
||||
],
|
||||
dataSubjectCategories: ['WEBSITE_USERS'],
|
||||
personalDataCategories: ['IP_ADDRESS', 'DEVICE_ID', 'USAGE_DATA'],
|
||||
suggestedLegalBasis: ['CONSENT'],
|
||||
suggestedRetentionYears: 1,
|
||||
suggestedProtectionLevel: 'MEDIUM',
|
||||
dpiaLikely: true,
|
||||
commonSystems: ['Google Ads', 'Meta Ads', 'LinkedIn Ads'],
|
||||
commonVendorCategories: ['MARKETING', 'ANALYTICS'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-marketing-events',
|
||||
category: 'MARKETING',
|
||||
name: {
|
||||
de: 'Veranstaltungsmanagement',
|
||||
en: 'Event Management',
|
||||
},
|
||||
description: {
|
||||
de: 'Organisation und Durchführung von Veranstaltungen, Messen und Webinaren',
|
||||
en: 'Organizing and conducting events, trade shows, and webinars',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Teilnehmerregistrierung', en: 'Participant registration' },
|
||||
{ de: 'Veranstaltungsdurchführung', en: 'Event execution' },
|
||||
{ de: 'Nachbereitung und Follow-up', en: 'Follow-up activities' },
|
||||
],
|
||||
dataSubjectCategories: ['CUSTOMERS', 'PROSPECTIVE_CUSTOMERS', 'BUSINESS_PARTNERS'],
|
||||
personalDataCategories: ['NAME', 'CONTACT', 'ADDRESS', 'PHOTO_VIDEO'],
|
||||
suggestedLegalBasis: ['CONTRACT', 'CONSENT'],
|
||||
suggestedRetentionYears: 2,
|
||||
suggestedProtectionLevel: 'LOW',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['Eventbrite', 'GoToWebinar', 'Zoom'],
|
||||
commonVendorCategories: ['MARKETING', 'COMMUNICATION'],
|
||||
},
|
||||
|
||||
// ==========================================
|
||||
// FINANCE
|
||||
// ==========================================
|
||||
{
|
||||
id: 'tpl-finance-accounting',
|
||||
category: 'FINANCE',
|
||||
name: {
|
||||
de: 'Finanzbuchhaltung',
|
||||
en: 'Financial Accounting',
|
||||
},
|
||||
description: {
|
||||
de: 'Führung der Finanzbuchhaltung, Rechnungsstellung und Zahlungsabwicklung',
|
||||
en: 'Financial accounting, invoicing, and payment processing',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Buchführung und Rechnungswesen', en: 'Bookkeeping and accounting' },
|
||||
{ de: 'Rechnungsstellung', en: 'Invoicing' },
|
||||
{ de: 'Zahlungsabwicklung', en: 'Payment processing' },
|
||||
],
|
||||
dataSubjectCategories: ['CUSTOMERS', 'SUPPLIERS', 'BUSINESS_PARTNERS'],
|
||||
personalDataCategories: [
|
||||
'NAME', 'ADDRESS', 'BANK_ACCOUNT', 'PAYMENT_DATA', 'CONTRACT_DATA', 'TAX_ID',
|
||||
],
|
||||
suggestedLegalBasis: ['CONTRACT', 'LEGAL_OBLIGATION'],
|
||||
suggestedRetentionYears: 10, // HGB/AO
|
||||
suggestedProtectionLevel: 'HIGH',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['DATEV', 'SAP', 'Lexware', 'Xero'],
|
||||
commonVendorCategories: ['ACCOUNTING', 'ERP'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-finance-debt-collection',
|
||||
category: 'FINANCE',
|
||||
name: {
|
||||
de: 'Forderungsmanagement',
|
||||
en: 'Debt Collection',
|
||||
},
|
||||
description: {
|
||||
de: 'Verwaltung offener Forderungen und Mahnwesen',
|
||||
en: 'Managing outstanding receivables and dunning',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Überwachung offener Forderungen', en: 'Monitoring outstanding receivables' },
|
||||
{ de: 'Mahnwesen', en: 'Dunning process' },
|
||||
{ de: 'Inkasso bei Bedarf', en: 'Debt collection if necessary' },
|
||||
],
|
||||
dataSubjectCategories: ['CUSTOMERS'],
|
||||
personalDataCategories: ['NAME', 'ADDRESS', 'CONTACT', 'PAYMENT_DATA', 'CONTRACT_DATA'],
|
||||
suggestedLegalBasis: ['CONTRACT', 'LEGITIMATE_INTEREST'],
|
||||
suggestedRetentionYears: 10,
|
||||
suggestedProtectionLevel: 'MEDIUM',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['ERP', 'Inkasso-Software'],
|
||||
commonVendorCategories: ['ACCOUNTING', 'LEGAL'],
|
||||
},
|
||||
|
||||
// ==========================================
|
||||
// IT & SICHERHEIT
|
||||
// ==========================================
|
||||
{
|
||||
id: 'tpl-it-user-management',
|
||||
category: 'IT',
|
||||
name: {
|
||||
de: 'IT-Benutzerverwaltung',
|
||||
en: 'IT User Management',
|
||||
},
|
||||
description: {
|
||||
de: 'Verwaltung von Benutzerkonten, Zugriffsrechten und Authentifizierung',
|
||||
en: 'Managing user accounts, access rights, and authentication',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Verwaltung von Benutzerkonten', en: 'Managing user accounts' },
|
||||
{ de: 'Zugriffssteuerung', en: 'Access control' },
|
||||
{ de: 'Single Sign-On', en: 'Single Sign-On' },
|
||||
],
|
||||
dataSubjectCategories: ['EMPLOYEES'],
|
||||
personalDataCategories: ['NAME', 'CONTACT', 'LOGIN_DATA', 'USAGE_DATA'],
|
||||
suggestedLegalBasis: ['CONTRACT', 'LEGITIMATE_INTEREST'],
|
||||
suggestedRetentionYears: 1, // Nach Kontoschließung
|
||||
suggestedProtectionLevel: 'HIGH',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['Active Directory', 'Okta', 'Azure AD'],
|
||||
commonVendorCategories: ['SECURITY', 'CLOUD_INFRASTRUCTURE'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-it-logging',
|
||||
category: 'IT',
|
||||
name: {
|
||||
de: 'IT-Protokollierung',
|
||||
en: 'IT Logging',
|
||||
},
|
||||
description: {
|
||||
de: 'Protokollierung von IT-Aktivitäten zur Sicherheit und Fehleranalyse',
|
||||
en: 'Logging IT activities for security and error analysis',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Sicherheitsüberwachung', en: 'Security monitoring' },
|
||||
{ de: 'Fehleranalyse', en: 'Error analysis' },
|
||||
{ de: 'Nachvollziehbarkeit', en: 'Traceability' },
|
||||
],
|
||||
dataSubjectCategories: ['EMPLOYEES', 'CUSTOMERS', 'WEBSITE_USERS'],
|
||||
personalDataCategories: ['IP_ADDRESS', 'DEVICE_ID', 'USAGE_DATA', 'LOGIN_DATA'],
|
||||
suggestedLegalBasis: ['LEGITIMATE_INTEREST'],
|
||||
suggestedRetentionYears: 1,
|
||||
suggestedProtectionLevel: 'MEDIUM',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['Splunk', 'ELK Stack', 'Datadog'],
|
||||
commonVendorCategories: ['SECURITY', 'ANALYTICS'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-it-video-surveillance',
|
||||
category: 'IT',
|
||||
name: {
|
||||
de: 'Videoüberwachung',
|
||||
en: 'Video Surveillance',
|
||||
},
|
||||
description: {
|
||||
de: 'Videoüberwachung von Geschäftsräumen zum Schutz vor Diebstahl und Vandalismus',
|
||||
en: 'Video surveillance of business premises for theft and vandalism prevention',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Schutz vor Diebstahl und Vandalismus', en: 'Protection against theft and vandalism' },
|
||||
{ de: 'Zugangskontrolle', en: 'Access control' },
|
||||
{ de: 'Beweissicherung', en: 'Evidence preservation' },
|
||||
],
|
||||
dataSubjectCategories: ['EMPLOYEES', 'VISITORS', 'CUSTOMERS'],
|
||||
personalDataCategories: ['PHOTO_VIDEO', 'BIOMETRIC_DATA'],
|
||||
suggestedLegalBasis: ['LEGITIMATE_INTEREST'],
|
||||
suggestedRetentionYears: 0.1, // 72 Stunden
|
||||
suggestedProtectionLevel: 'HIGH',
|
||||
dpiaLikely: true,
|
||||
commonSystems: ['CCTV-System'],
|
||||
commonVendorCategories: ['SECURITY'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-it-backup',
|
||||
category: 'IT',
|
||||
name: {
|
||||
de: 'Datensicherung (Backup)',
|
||||
en: 'Data Backup',
|
||||
},
|
||||
description: {
|
||||
de: 'Regelmäßige Sicherung von Unternehmensdaten',
|
||||
en: 'Regular backup of company data',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Datensicherung', en: 'Data backup' },
|
||||
{ de: 'Disaster Recovery', en: 'Disaster Recovery' },
|
||||
{ de: 'Geschäftskontinuität', en: 'Business continuity' },
|
||||
],
|
||||
dataSubjectCategories: ['EMPLOYEES', 'CUSTOMERS', 'SUPPLIERS'],
|
||||
personalDataCategories: ['NAME', 'CONTACT', 'CONTRACT_DATA', 'COMMUNICATION_DATA'],
|
||||
suggestedLegalBasis: ['LEGITIMATE_INTEREST', 'LEGAL_OBLIGATION'],
|
||||
suggestedRetentionYears: 1, // Je nach Backup-Konzept
|
||||
suggestedProtectionLevel: 'HIGH',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['Veeam', 'AWS Backup', 'Azure Backup'],
|
||||
commonVendorCategories: ['BACKUP', 'CLOUD_INFRASTRUCTURE'],
|
||||
},
|
||||
|
||||
// ==========================================
|
||||
// CUSTOMER SERVICE
|
||||
// ==========================================
|
||||
{
|
||||
id: 'tpl-cs-support',
|
||||
category: 'CUSTOMER_SERVICE',
|
||||
name: {
|
||||
de: 'Kundenbetreuung und Support',
|
||||
en: 'Customer Support',
|
||||
},
|
||||
description: {
|
||||
de: 'Bearbeitung von Kundenanfragen, Beschwerden und Support-Tickets',
|
||||
en: 'Handling customer inquiries, complaints, and support tickets',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Bearbeitung von Kundenanfragen', en: 'Handling customer inquiries' },
|
||||
{ de: 'Beschwerdemanagement', en: 'Complaint management' },
|
||||
{ de: 'Technischer Support', en: 'Technical support' },
|
||||
],
|
||||
dataSubjectCategories: ['CUSTOMERS'],
|
||||
personalDataCategories: ['NAME', 'CONTACT', 'CONTRACT_DATA', 'COMMUNICATION_DATA'],
|
||||
suggestedLegalBasis: ['CONTRACT', 'LEGITIMATE_INTEREST'],
|
||||
suggestedRetentionYears: 3,
|
||||
suggestedProtectionLevel: 'MEDIUM',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['Zendesk', 'Freshdesk', 'Intercom'],
|
||||
commonVendorCategories: ['SUPPORT', 'CRM'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-cs-satisfaction',
|
||||
category: 'CUSTOMER_SERVICE',
|
||||
name: {
|
||||
de: 'Kundenzufriedenheitsbefragungen',
|
||||
en: 'Customer Satisfaction Surveys',
|
||||
},
|
||||
description: {
|
||||
de: 'Durchführung von Umfragen zur Messung der Kundenzufriedenheit',
|
||||
en: 'Conducting surveys to measure customer satisfaction',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Messung der Kundenzufriedenheit', en: 'Measuring customer satisfaction' },
|
||||
{ de: 'Qualitätsverbesserung', en: 'Quality improvement' },
|
||||
],
|
||||
dataSubjectCategories: ['CUSTOMERS'],
|
||||
personalDataCategories: ['NAME', 'CONTACT', 'USAGE_DATA'],
|
||||
suggestedLegalBasis: ['CONSENT', 'LEGITIMATE_INTEREST'],
|
||||
suggestedRetentionYears: 2,
|
||||
suggestedProtectionLevel: 'LOW',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['SurveyMonkey', 'Typeform', 'NPS-Tools'],
|
||||
commonVendorCategories: ['ANALYTICS', 'MARKETING'],
|
||||
},
|
||||
|
||||
// ==========================================
|
||||
// WEBSITE & APPS
|
||||
// ==========================================
|
||||
{
|
||||
id: 'tpl-web-analytics',
|
||||
category: 'WEBSITE',
|
||||
name: {
|
||||
de: 'Web-Analyse',
|
||||
en: 'Web Analytics',
|
||||
},
|
||||
description: {
|
||||
de: 'Analyse des Nutzerverhaltens auf der Website zur Optimierung',
|
||||
en: 'Analyzing user behavior on the website for optimization',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Analyse des Nutzerverhaltens', en: 'Analyzing user behavior' },
|
||||
{ de: 'Website-Optimierung', en: 'Website optimization' },
|
||||
{ de: 'Conversion-Tracking', en: 'Conversion tracking' },
|
||||
],
|
||||
dataSubjectCategories: ['WEBSITE_USERS'],
|
||||
personalDataCategories: ['IP_ADDRESS', 'DEVICE_ID', 'USAGE_DATA', 'LOCATION_DATA'],
|
||||
suggestedLegalBasis: ['CONSENT'],
|
||||
suggestedRetentionYears: 2,
|
||||
suggestedProtectionLevel: 'MEDIUM',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['Google Analytics', 'Matomo', 'Plausible'],
|
||||
commonVendorCategories: ['ANALYTICS'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-web-contact-form',
|
||||
category: 'WEBSITE',
|
||||
name: {
|
||||
de: 'Kontaktformular',
|
||||
en: 'Contact Form',
|
||||
},
|
||||
description: {
|
||||
de: 'Verarbeitung von Anfragen über das Website-Kontaktformular',
|
||||
en: 'Processing inquiries submitted via the website contact form',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Bearbeitung von Kontaktanfragen', en: 'Processing contact inquiries' },
|
||||
{ de: 'Kommunikation mit Interessenten', en: 'Communication with prospects' },
|
||||
],
|
||||
dataSubjectCategories: ['PROSPECTIVE_CUSTOMERS', 'WEBSITE_USERS'],
|
||||
personalDataCategories: ['NAME', 'CONTACT', 'COMMUNICATION_DATA'],
|
||||
suggestedLegalBasis: ['CONTRACT', 'LEGITIMATE_INTEREST'],
|
||||
suggestedRetentionYears: 1,
|
||||
suggestedProtectionLevel: 'LOW',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['CRM', 'E-Mail-System'],
|
||||
commonVendorCategories: ['CRM', 'EMAIL'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-web-user-accounts',
|
||||
category: 'WEBSITE',
|
||||
name: {
|
||||
de: 'Benutzerkonten / Kundenportal',
|
||||
en: 'User Accounts / Customer Portal',
|
||||
},
|
||||
description: {
|
||||
de: 'Verwaltung von Benutzerkonten im Kundenportal oder Online-Shop',
|
||||
en: 'Managing user accounts in customer portal or online shop',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Bereitstellung des Kundenportals', en: 'Providing customer portal' },
|
||||
{ de: 'Benutzerverwaltung', en: 'User management' },
|
||||
{ de: 'Personalisierung', en: 'Personalization' },
|
||||
],
|
||||
dataSubjectCategories: ['CUSTOMERS', 'APP_USERS'],
|
||||
personalDataCategories: ['NAME', 'CONTACT', 'LOGIN_DATA', 'USAGE_DATA', 'CONTRACT_DATA'],
|
||||
suggestedLegalBasis: ['CONTRACT'],
|
||||
suggestedRetentionYears: 1, // Nach Kontoschließung
|
||||
suggestedProtectionLevel: 'MEDIUM',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['E-Commerce', 'CRM', 'Auth0'],
|
||||
commonVendorCategories: ['HOSTING', 'CRM', 'SECURITY'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-web-cookies',
|
||||
category: 'WEBSITE',
|
||||
name: {
|
||||
de: 'Cookie-Verwaltung',
|
||||
en: 'Cookie Management',
|
||||
},
|
||||
description: {
|
||||
de: 'Verwaltung von Cookies und Einholung von Cookie-Einwilligungen',
|
||||
en: 'Managing cookies and obtaining cookie consents',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Speicherung von Cookie-Präferenzen', en: 'Storing cookie preferences' },
|
||||
{ de: 'Einwilligungsmanagement', en: 'Consent management' },
|
||||
],
|
||||
dataSubjectCategories: ['WEBSITE_USERS'],
|
||||
personalDataCategories: ['IP_ADDRESS', 'DEVICE_ID', 'USAGE_DATA'],
|
||||
suggestedLegalBasis: ['CONSENT', 'LEGITIMATE_INTEREST'],
|
||||
suggestedRetentionYears: 1,
|
||||
suggestedProtectionLevel: 'LOW',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['Cookiebot', 'Usercentrics', 'OneTrust'],
|
||||
commonVendorCategories: ['ANALYTICS', 'SECURITY'],
|
||||
},
|
||||
|
||||
// ==========================================
|
||||
// GENERAL
|
||||
// ==========================================
|
||||
{
|
||||
id: 'tpl-gen-communication',
|
||||
category: 'GENERAL',
|
||||
name: {
|
||||
de: 'Geschäftliche Kommunikation',
|
||||
en: 'Business Communication',
|
||||
},
|
||||
description: {
|
||||
de: 'E-Mail-Kommunikation, Telefonie und Messaging im Geschäftsverkehr',
|
||||
en: 'Email communication, telephony, and messaging in business operations',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Geschäftliche Kommunikation', en: 'Business communication' },
|
||||
{ de: 'Dokumentation von Korrespondenz', en: 'Documentation of correspondence' },
|
||||
],
|
||||
dataSubjectCategories: ['CUSTOMERS', 'SUPPLIERS', 'BUSINESS_PARTNERS', 'EMPLOYEES'],
|
||||
personalDataCategories: ['NAME', 'CONTACT', 'COMMUNICATION_DATA'],
|
||||
suggestedLegalBasis: ['CONTRACT', 'LEGITIMATE_INTEREST'],
|
||||
suggestedRetentionYears: 6, // Handelsrechtlich relevant
|
||||
suggestedProtectionLevel: 'MEDIUM',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['Microsoft 365', 'Google Workspace', 'Slack'],
|
||||
commonVendorCategories: ['EMAIL', 'COMMUNICATION', 'CLOUD_INFRASTRUCTURE'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-gen-visitor',
|
||||
category: 'GENERAL',
|
||||
name: {
|
||||
de: 'Besucherverwaltung',
|
||||
en: 'Visitor Management',
|
||||
},
|
||||
description: {
|
||||
de: 'Erfassung und Verwaltung von Besuchern in Geschäftsräumen',
|
||||
en: 'Recording and managing visitors in business premises',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Zutrittskontrolle', en: 'Access control' },
|
||||
{ de: 'Sicherheit', en: 'Security' },
|
||||
{ de: 'Nachvollziehbarkeit', en: 'Traceability' },
|
||||
],
|
||||
dataSubjectCategories: ['VISITORS'],
|
||||
personalDataCategories: ['NAME', 'CONTACT', 'PHOTO_VIDEO'],
|
||||
suggestedLegalBasis: ['LEGITIMATE_INTEREST'],
|
||||
suggestedRetentionYears: 0.1, // 1 Monat
|
||||
suggestedProtectionLevel: 'LOW',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['Besuchermanagement-System'],
|
||||
commonVendorCategories: ['SECURITY'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-gen-supplier',
|
||||
category: 'GENERAL',
|
||||
name: {
|
||||
de: 'Lieferantenverwaltung',
|
||||
en: 'Supplier Management',
|
||||
},
|
||||
description: {
|
||||
de: 'Verwaltung von Lieferantenbeziehungen und Beschaffung',
|
||||
en: 'Managing supplier relationships and procurement',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Lieferantenverwaltung', en: 'Supplier management' },
|
||||
{ de: 'Beschaffung', en: 'Procurement' },
|
||||
{ de: 'Qualitätsmanagement', en: 'Quality management' },
|
||||
],
|
||||
dataSubjectCategories: ['SUPPLIERS', 'BUSINESS_PARTNERS'],
|
||||
personalDataCategories: ['NAME', 'CONTACT', 'ADDRESS', 'CONTRACT_DATA', 'BANK_ACCOUNT'],
|
||||
suggestedLegalBasis: ['CONTRACT', 'LEGITIMATE_INTEREST'],
|
||||
suggestedRetentionYears: 10,
|
||||
suggestedProtectionLevel: 'MEDIUM',
|
||||
dpiaLikely: false,
|
||||
commonSystems: ['ERP', 'Lieferantenportal'],
|
||||
commonVendorCategories: ['ERP'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-gen-whistleblower',
|
||||
category: 'GENERAL',
|
||||
name: {
|
||||
de: 'Hinweisgebersystem',
|
||||
en: 'Whistleblower System',
|
||||
},
|
||||
description: {
|
||||
de: 'Entgegennahme und Bearbeitung von Hinweisen gemäß Hinweisgeberschutzgesetz',
|
||||
en: 'Receiving and processing reports according to whistleblower protection law',
|
||||
},
|
||||
purposes: [
|
||||
{ de: 'Entgegennahme von Hinweisen', en: 'Receiving reports' },
|
||||
{ de: 'Untersuchung von Verstößen', en: 'Investigating violations' },
|
||||
{ de: 'Schutz von Hinweisgebern', en: 'Protecting whistleblowers' },
|
||||
],
|
||||
dataSubjectCategories: ['EMPLOYEES', 'BUSINESS_PARTNERS'],
|
||||
personalDataCategories: ['NAME', 'CONTACT', 'COMMUNICATION_DATA'],
|
||||
suggestedLegalBasis: ['LEGAL_OBLIGATION'],
|
||||
suggestedRetentionYears: 3,
|
||||
suggestedProtectionLevel: 'HIGH',
|
||||
dpiaLikely: true,
|
||||
commonSystems: ['Hinweisgeberportal'],
|
||||
commonVendorCategories: ['SECURITY', 'LEGAL'],
|
||||
},
|
||||
]
|
||||
|
||||
/**
|
||||
* Get templates by category
|
||||
*/
|
||||
export function getTemplatesByCategory(
|
||||
category: ProcessingActivityCategory
|
||||
): ProcessingActivityTemplate[] {
|
||||
return PROCESSING_ACTIVITY_TEMPLATES.filter((t) => t.category === category)
|
||||
}
|
||||
|
||||
/**
|
||||
* Get template by ID
|
||||
*/
|
||||
export function getTemplateById(id: string): ProcessingActivityTemplate | undefined {
|
||||
return PROCESSING_ACTIVITY_TEMPLATES.find((t) => t.id === id)
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all categories with their templates
|
||||
*/
|
||||
export function getGroupedTemplates(): Map<ProcessingActivityCategory, ProcessingActivityTemplate[]> {
|
||||
const grouped = new Map<ProcessingActivityCategory, ProcessingActivityTemplate[]>()
|
||||
|
||||
for (const template of PROCESSING_ACTIVITY_TEMPLATES) {
|
||||
const existing = grouped.get(template.category) || []
|
||||
grouped.set(template.category, [...existing, template])
|
||||
}
|
||||
|
||||
return grouped
|
||||
}
|
||||
|
||||
/**
|
||||
* Create form data from template
|
||||
*/
|
||||
export function createFormDataFromTemplate(
|
||||
template: ProcessingActivityTemplate,
|
||||
organizationDefaults?: {
|
||||
responsible?: ProcessingActivityFormData['responsible']
|
||||
dpoContact?: ProcessingActivityFormData['dpoContact']
|
||||
}
|
||||
): Partial<ProcessingActivityFormData> {
|
||||
return {
|
||||
vvtId: '', // Will be generated
|
||||
name: template.name,
|
||||
purposes: template.purposes,
|
||||
dataSubjectCategories: template.dataSubjectCategories,
|
||||
personalDataCategories: template.personalDataCategories,
|
||||
legalBasis: template.suggestedLegalBasis.map((type) => ({ type })),
|
||||
protectionLevel: template.suggestedProtectionLevel,
|
||||
dpiaRequired: template.dpiaLikely,
|
||||
retentionPeriod: {
|
||||
duration: template.suggestedRetentionYears,
|
||||
durationUnit: 'YEARS',
|
||||
description: { de: '', en: '' },
|
||||
},
|
||||
recipientCategories: [],
|
||||
thirdCountryTransfers: [],
|
||||
technicalMeasures: [],
|
||||
dataSources: [],
|
||||
systems: [],
|
||||
dataFlows: [],
|
||||
subProcessors: [],
|
||||
owner: '',
|
||||
responsible: organizationDefaults?.responsible,
|
||||
dpoContact: organizationDefaults?.dpoContact,
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,564 @@
|
||||
/**
|
||||
* Vendor Templates and Categories
|
||||
*
|
||||
* Pre-defined vendor templates and risk profiles
|
||||
*/
|
||||
|
||||
import {
|
||||
VendorFormData,
|
||||
VendorRole,
|
||||
ServiceCategory,
|
||||
DataAccessLevel,
|
||||
TransferMechanismType,
|
||||
DocumentType,
|
||||
ReviewFrequency,
|
||||
LocalizedText,
|
||||
PersonalDataCategory,
|
||||
} from '../types'
|
||||
|
||||
export interface VendorTemplate {
|
||||
id: string
|
||||
name: LocalizedText
|
||||
description: LocalizedText
|
||||
serviceCategory: ServiceCategory
|
||||
suggestedRole: VendorRole
|
||||
suggestedDataAccess: DataAccessLevel
|
||||
suggestedTransferMechanisms: TransferMechanismType[]
|
||||
suggestedContractTypes: DocumentType[]
|
||||
typicalDataCategories: PersonalDataCategory[]
|
||||
typicalCertifications: string[]
|
||||
inherentRiskFactors: RiskFactorWeight[]
|
||||
commonProviders: string[]
|
||||
}
|
||||
|
||||
export interface RiskFactorWeight {
|
||||
factor: string
|
||||
weight: number // 0-1
|
||||
description: LocalizedText
|
||||
}
|
||||
|
||||
export interface CountryRiskProfile {
|
||||
code: string // ISO 3166-1 alpha-2
|
||||
name: LocalizedText
|
||||
isEU: boolean
|
||||
isEEA: boolean
|
||||
hasAdequacyDecision: boolean
|
||||
adequacyDecisionDate?: string
|
||||
riskLevel: 'LOW' | 'MEDIUM' | 'HIGH' | 'VERY_HIGH'
|
||||
notes?: LocalizedText
|
||||
}
|
||||
|
||||
// ==========================================
|
||||
// VENDOR TEMPLATES
|
||||
// ==========================================
|
||||
|
||||
export const VENDOR_TEMPLATES: VendorTemplate[] = [
|
||||
// Cloud & Infrastructure
|
||||
{
|
||||
id: 'tpl-vendor-cloud-iaas',
|
||||
name: { de: 'Cloud IaaS-Anbieter', en: 'Cloud IaaS Provider' },
|
||||
description: {
|
||||
de: 'Infrastructure-as-a-Service Anbieter (AWS, Azure, GCP)',
|
||||
en: 'Infrastructure-as-a-Service provider (AWS, Azure, GCP)',
|
||||
},
|
||||
serviceCategory: 'CLOUD_INFRASTRUCTURE',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'CONTENT',
|
||||
suggestedTransferMechanisms: ['SCC_PROCESSOR', 'BCR'],
|
||||
suggestedContractTypes: ['AVV', 'MSA', 'SLA', 'TOM_ANNEX'],
|
||||
typicalDataCategories: ['NAME', 'CONTACT', 'USAGE_DATA', 'IP_ADDRESS'],
|
||||
typicalCertifications: ['ISO 27001', 'SOC 2', 'C5'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'data_volume', weight: 0.9, description: { de: 'Hohes Datenvolumen', en: 'High data volume' } },
|
||||
{ factor: 'criticality', weight: 0.9, description: { de: 'Geschäftskritisch', en: 'Business critical' } },
|
||||
{ factor: 'sub_processors', weight: 0.7, description: { de: 'Viele Unterauftragnehmer', en: 'Many sub-processors' } },
|
||||
],
|
||||
commonProviders: ['AWS', 'Microsoft Azure', 'Google Cloud Platform', 'Hetzner', 'OVH'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-vendor-hosting',
|
||||
name: { de: 'Webhosting-Anbieter', en: 'Web Hosting Provider' },
|
||||
description: {
|
||||
de: 'Hosting von Websites und Webanwendungen',
|
||||
en: 'Hosting of websites and web applications',
|
||||
},
|
||||
serviceCategory: 'HOSTING',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'ADMINISTRATIVE',
|
||||
suggestedTransferMechanisms: ['ADEQUACY_DECISION', 'SCC_PROCESSOR'],
|
||||
suggestedContractTypes: ['AVV', 'MSA', 'SLA'],
|
||||
typicalDataCategories: ['IP_ADDRESS', 'USAGE_DATA', 'LOGIN_DATA'],
|
||||
typicalCertifications: ['ISO 27001'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'data_volume', weight: 0.6, description: { de: 'Mittleres Datenvolumen', en: 'Medium data volume' } },
|
||||
{ factor: 'criticality', weight: 0.7, description: { de: 'Wichtig für Betrieb', en: 'Important for operations' } },
|
||||
],
|
||||
commonProviders: ['Hetzner', 'All-Inkl', 'IONOS', 'Strato', 'DigitalOcean'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-vendor-cdn',
|
||||
name: { de: 'CDN-Anbieter', en: 'CDN Provider' },
|
||||
description: {
|
||||
de: 'Content Delivery Network für schnelle Inhaltsauslieferung',
|
||||
en: 'Content Delivery Network for fast content delivery',
|
||||
},
|
||||
serviceCategory: 'CDN',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'POTENTIAL',
|
||||
suggestedTransferMechanisms: ['SCC_PROCESSOR'],
|
||||
suggestedContractTypes: ['AVV', 'MSA'],
|
||||
typicalDataCategories: ['IP_ADDRESS', 'USAGE_DATA'],
|
||||
typicalCertifications: ['ISO 27001', 'SOC 2'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'data_transit', weight: 0.5, description: { de: 'Daten im Transit', en: 'Data in transit' } },
|
||||
{ factor: 'global_presence', weight: 0.6, description: { de: 'Globale Präsenz', en: 'Global presence' } },
|
||||
],
|
||||
commonProviders: ['Cloudflare', 'Fastly', 'Akamai', 'AWS CloudFront'],
|
||||
},
|
||||
|
||||
// Business Software
|
||||
{
|
||||
id: 'tpl-vendor-crm',
|
||||
name: { de: 'CRM-System', en: 'CRM System' },
|
||||
description: {
|
||||
de: 'Customer Relationship Management System',
|
||||
en: 'Customer Relationship Management System',
|
||||
},
|
||||
serviceCategory: 'CRM',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'CONTENT',
|
||||
suggestedTransferMechanisms: ['SCC_PROCESSOR', 'BCR'],
|
||||
suggestedContractTypes: ['AVV', 'MSA', 'SLA', 'TOM_ANNEX'],
|
||||
typicalDataCategories: ['NAME', 'CONTACT', 'ADDRESS', 'COMMUNICATION_DATA', 'CONTRACT_DATA'],
|
||||
typicalCertifications: ['ISO 27001', 'SOC 2'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'customer_data', weight: 0.8, description: { de: 'Kundendaten', en: 'Customer data' } },
|
||||
{ factor: 'data_volume', weight: 0.7, description: { de: 'Hohes Datenvolumen', en: 'High data volume' } },
|
||||
],
|
||||
commonProviders: ['Salesforce', 'HubSpot', 'Pipedrive', 'Microsoft Dynamics', 'Zoho CRM'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-vendor-erp',
|
||||
name: { de: 'ERP-System', en: 'ERP System' },
|
||||
description: {
|
||||
de: 'Enterprise Resource Planning System',
|
||||
en: 'Enterprise Resource Planning System',
|
||||
},
|
||||
serviceCategory: 'ERP',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'CONTENT',
|
||||
suggestedTransferMechanisms: ['ADEQUACY_DECISION', 'SCC_PROCESSOR'],
|
||||
suggestedContractTypes: ['AVV', 'MSA', 'SLA', 'TOM_ANNEX'],
|
||||
typicalDataCategories: [
|
||||
'NAME', 'CONTACT', 'ADDRESS', 'BANK_ACCOUNT', 'CONTRACT_DATA',
|
||||
'EMPLOYMENT_DATA', 'SALARY_DATA',
|
||||
],
|
||||
typicalCertifications: ['ISO 27001', 'SOC 2'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'data_volume', weight: 0.9, description: { de: 'Sehr hohes Datenvolumen', en: 'Very high data volume' } },
|
||||
{ factor: 'criticality', weight: 0.95, description: { de: 'Geschäftskritisch', en: 'Business critical' } },
|
||||
{ factor: 'sensitive_data', weight: 0.8, description: { de: 'Sensible Daten', en: 'Sensitive data' } },
|
||||
],
|
||||
commonProviders: ['SAP', 'Oracle', 'Microsoft Dynamics', 'Sage', 'Odoo'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-vendor-hr',
|
||||
name: { de: 'HR-Software', en: 'HR Software' },
|
||||
description: {
|
||||
de: 'Personalverwaltung und HR-Management',
|
||||
en: 'Personnel administration and HR management',
|
||||
},
|
||||
serviceCategory: 'HR_SOFTWARE',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'CONTENT',
|
||||
suggestedTransferMechanisms: ['ADEQUACY_DECISION', 'SCC_PROCESSOR'],
|
||||
suggestedContractTypes: ['AVV', 'MSA', 'TOM_ANNEX'],
|
||||
typicalDataCategories: [
|
||||
'NAME', 'CONTACT', 'ADDRESS', 'DOB', 'SOCIAL_SECURITY', 'TAX_ID',
|
||||
'BANK_ACCOUNT', 'EMPLOYMENT_DATA', 'SALARY_DATA', 'HEALTH_DATA',
|
||||
],
|
||||
typicalCertifications: ['ISO 27001'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'employee_data', weight: 0.9, description: { de: 'Mitarbeiterdaten', en: 'Employee data' } },
|
||||
{ factor: 'sensitive_data', weight: 0.85, description: { de: 'Sensible Daten', en: 'Sensitive data' } },
|
||||
{ factor: 'special_categories', weight: 0.7, description: { de: 'Besondere Kategorien möglich', en: 'Special categories possible' } },
|
||||
],
|
||||
commonProviders: ['Personio', 'Workday', 'SAP SuccessFactors', 'HRworks', 'Factorial'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-vendor-accounting',
|
||||
name: { de: 'Buchhaltungssoftware', en: 'Accounting Software' },
|
||||
description: {
|
||||
de: 'Finanzbuchhaltung und Rechnungswesen',
|
||||
en: 'Financial accounting and bookkeeping',
|
||||
},
|
||||
serviceCategory: 'ACCOUNTING',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'CONTENT',
|
||||
suggestedTransferMechanisms: ['ADEQUACY_DECISION'],
|
||||
suggestedContractTypes: ['AVV', 'MSA'],
|
||||
typicalDataCategories: ['NAME', 'ADDRESS', 'BANK_ACCOUNT', 'PAYMENT_DATA', 'TAX_ID'],
|
||||
typicalCertifications: ['ISO 27001', 'IDW PS 951'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'financial_data', weight: 0.85, description: { de: 'Finanzdaten', en: 'Financial data' } },
|
||||
{ factor: 'legal_retention', weight: 0.7, description: { de: 'Aufbewahrungspflichten', en: 'Retention requirements' } },
|
||||
],
|
||||
commonProviders: ['DATEV', 'Lexware', 'SevDesk', 'Xero', 'Sage'],
|
||||
},
|
||||
|
||||
// Communication & Collaboration
|
||||
{
|
||||
id: 'tpl-vendor-email',
|
||||
name: { de: 'E-Mail-Dienst', en: 'Email Service' },
|
||||
description: {
|
||||
de: 'E-Mail-Hosting und -Kommunikation',
|
||||
en: 'Email hosting and communication',
|
||||
},
|
||||
serviceCategory: 'EMAIL',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'CONTENT',
|
||||
suggestedTransferMechanisms: ['SCC_PROCESSOR', 'BCR'],
|
||||
suggestedContractTypes: ['AVV', 'MSA', 'SLA'],
|
||||
typicalDataCategories: ['NAME', 'CONTACT', 'COMMUNICATION_DATA'],
|
||||
typicalCertifications: ['ISO 27001', 'SOC 2'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'communication_data', weight: 0.8, description: { de: 'Kommunikationsdaten', en: 'Communication data' } },
|
||||
{ factor: 'criticality', weight: 0.8, description: { de: 'Geschäftskritisch', en: 'Business critical' } },
|
||||
],
|
||||
commonProviders: ['Microsoft 365', 'Google Workspace', 'Zoho Mail', 'ProtonMail'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-vendor-communication',
|
||||
name: { de: 'Kollaborations-Tool', en: 'Collaboration Tool' },
|
||||
description: {
|
||||
de: 'Team-Kommunikation und Zusammenarbeit',
|
||||
en: 'Team communication and collaboration',
|
||||
},
|
||||
serviceCategory: 'COMMUNICATION',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'CONTENT',
|
||||
suggestedTransferMechanisms: ['SCC_PROCESSOR', 'BCR'],
|
||||
suggestedContractTypes: ['AVV', 'MSA'],
|
||||
typicalDataCategories: ['NAME', 'CONTACT', 'COMMUNICATION_DATA', 'PHOTO_VIDEO'],
|
||||
typicalCertifications: ['ISO 27001', 'SOC 2'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'communication_data', weight: 0.7, description: { de: 'Kommunikationsdaten', en: 'Communication data' } },
|
||||
{ factor: 'file_sharing', weight: 0.6, description: { de: 'Dateifreigabe', en: 'File sharing' } },
|
||||
],
|
||||
commonProviders: ['Slack', 'Microsoft Teams', 'Zoom', 'Google Meet', 'Webex'],
|
||||
},
|
||||
|
||||
// Marketing & Analytics
|
||||
{
|
||||
id: 'tpl-vendor-analytics',
|
||||
name: { de: 'Analytics-Tool', en: 'Analytics Tool' },
|
||||
description: {
|
||||
de: 'Web-Analyse und Nutzerverhalten',
|
||||
en: 'Web analytics and user behavior',
|
||||
},
|
||||
serviceCategory: 'ANALYTICS',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'CONTENT',
|
||||
suggestedTransferMechanisms: ['SCC_PROCESSOR'],
|
||||
suggestedContractTypes: ['AVV', 'MSA'],
|
||||
typicalDataCategories: ['IP_ADDRESS', 'DEVICE_ID', 'USAGE_DATA', 'LOCATION_DATA'],
|
||||
typicalCertifications: ['ISO 27001'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'tracking', weight: 0.7, description: { de: 'Tracking', en: 'Tracking' } },
|
||||
{ factor: 'profiling', weight: 0.6, description: { de: 'Profiling möglich', en: 'Profiling possible' } },
|
||||
],
|
||||
commonProviders: ['Google Analytics', 'Matomo', 'Plausible', 'Mixpanel', 'Amplitude'],
|
||||
},
|
||||
{
|
||||
id: 'tpl-vendor-marketing-automation',
|
||||
name: { de: 'Marketing-Automatisierung', en: 'Marketing Automation' },
|
||||
description: {
|
||||
de: 'E-Mail-Marketing und Automatisierung',
|
||||
en: 'Email marketing and automation',
|
||||
},
|
||||
serviceCategory: 'MARKETING',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'CONTENT',
|
||||
suggestedTransferMechanisms: ['SCC_PROCESSOR'],
|
||||
suggestedContractTypes: ['AVV', 'MSA'],
|
||||
typicalDataCategories: ['NAME', 'CONTACT', 'USAGE_DATA'],
|
||||
typicalCertifications: ['ISO 27001'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'marketing_data', weight: 0.6, description: { de: 'Marketing-Daten', en: 'Marketing data' } },
|
||||
{ factor: 'consent_management', weight: 0.7, description: { de: 'Einwilligungsmanagement', en: 'Consent management' } },
|
||||
],
|
||||
commonProviders: ['Mailchimp', 'HubSpot', 'Sendinblue', 'CleverReach', 'ActiveCampaign'],
|
||||
},
|
||||
|
||||
// Support & Service
|
||||
{
|
||||
id: 'tpl-vendor-support',
|
||||
name: { de: 'Support-/Ticketsystem', en: 'Support/Ticket System' },
|
||||
description: {
|
||||
de: 'Kundenservice und Ticket-Management',
|
||||
en: 'Customer service and ticket management',
|
||||
},
|
||||
serviceCategory: 'SUPPORT',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'CONTENT',
|
||||
suggestedTransferMechanisms: ['SCC_PROCESSOR'],
|
||||
suggestedContractTypes: ['AVV', 'MSA'],
|
||||
typicalDataCategories: ['NAME', 'CONTACT', 'COMMUNICATION_DATA', 'CONTRACT_DATA'],
|
||||
typicalCertifications: ['ISO 27001', 'SOC 2'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'customer_data', weight: 0.7, description: { de: 'Kundendaten', en: 'Customer data' } },
|
||||
{ factor: 'communication', weight: 0.6, description: { de: 'Kommunikationsinhalte', en: 'Communication content' } },
|
||||
],
|
||||
commonProviders: ['Zendesk', 'Freshdesk', 'Intercom', 'HelpScout', 'Jira Service Management'],
|
||||
},
|
||||
|
||||
// Payment & Finance
|
||||
{
|
||||
id: 'tpl-vendor-payment',
|
||||
name: { de: 'Zahlungsdienstleister', en: 'Payment Service Provider' },
|
||||
description: {
|
||||
de: 'Zahlungsabwicklung und Payment Gateway',
|
||||
en: 'Payment processing and payment gateway',
|
||||
},
|
||||
serviceCategory: 'PAYMENT',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'CONTENT',
|
||||
suggestedTransferMechanisms: ['SCC_PROCESSOR', 'BCR'],
|
||||
suggestedContractTypes: ['AVV', 'MSA', 'SLA'],
|
||||
typicalDataCategories: ['NAME', 'ADDRESS', 'BANK_ACCOUNT', 'PAYMENT_DATA'],
|
||||
typicalCertifications: ['PCI DSS', 'ISO 27001'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'financial_data', weight: 0.9, description: { de: 'Finanzdaten', en: 'Financial data' } },
|
||||
{ factor: 'pci_scope', weight: 0.8, description: { de: 'PCI-Scope', en: 'PCI scope' } },
|
||||
],
|
||||
commonProviders: ['Stripe', 'PayPal', 'Adyen', 'Mollie', 'Klarna'],
|
||||
},
|
||||
|
||||
// Security
|
||||
{
|
||||
id: 'tpl-vendor-security',
|
||||
name: { de: 'Sicherheitsdienstleister', en: 'Security Service Provider' },
|
||||
description: {
|
||||
de: 'IT-Sicherheit, Penetrationstests, SIEM',
|
||||
en: 'IT security, penetration testing, SIEM',
|
||||
},
|
||||
serviceCategory: 'SECURITY',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'ADMINISTRATIVE',
|
||||
suggestedTransferMechanisms: ['ADEQUACY_DECISION', 'SCC_PROCESSOR'],
|
||||
suggestedContractTypes: ['AVV', 'MSA', 'NDA'],
|
||||
typicalDataCategories: ['IP_ADDRESS', 'USAGE_DATA', 'LOGIN_DATA'],
|
||||
typicalCertifications: ['ISO 27001', 'SOC 2'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'system_access', weight: 0.8, description: { de: 'Systemzugriff', en: 'System access' } },
|
||||
{ factor: 'security_data', weight: 0.7, description: { de: 'Sicherheitsdaten', en: 'Security data' } },
|
||||
],
|
||||
commonProviders: ['CrowdStrike', 'Splunk', 'Palo Alto Networks', 'Tenable'],
|
||||
},
|
||||
|
||||
// Backup & Storage
|
||||
{
|
||||
id: 'tpl-vendor-backup',
|
||||
name: { de: 'Backup-Anbieter', en: 'Backup Provider' },
|
||||
description: {
|
||||
de: 'Datensicherung und Disaster Recovery',
|
||||
en: 'Data backup and disaster recovery',
|
||||
},
|
||||
serviceCategory: 'BACKUP',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'CONTENT',
|
||||
suggestedTransferMechanisms: ['ADEQUACY_DECISION', 'SCC_PROCESSOR'],
|
||||
suggestedContractTypes: ['AVV', 'MSA', 'SLA'],
|
||||
typicalDataCategories: ['NAME', 'CONTACT', 'CONTRACT_DATA'],
|
||||
typicalCertifications: ['ISO 27001', 'SOC 2'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'full_backup', weight: 0.9, description: { de: 'Vollständige Kopie', en: 'Full copy' } },
|
||||
{ factor: 'retention', weight: 0.7, description: { de: 'Lange Aufbewahrung', en: 'Long retention' } },
|
||||
],
|
||||
commonProviders: ['Veeam', 'Acronis', 'Commvault', 'AWS Backup'],
|
||||
},
|
||||
|
||||
// Consulting
|
||||
{
|
||||
id: 'tpl-vendor-consulting',
|
||||
name: { de: 'Beratungsunternehmen', en: 'Consulting Company' },
|
||||
description: {
|
||||
de: 'IT-Beratung, Projektunterstützung',
|
||||
en: 'IT consulting, project support',
|
||||
},
|
||||
serviceCategory: 'CONSULTING',
|
||||
suggestedRole: 'PROCESSOR',
|
||||
suggestedDataAccess: 'POTENTIAL',
|
||||
suggestedTransferMechanisms: ['ADEQUACY_DECISION'],
|
||||
suggestedContractTypes: ['AVV', 'MSA', 'NDA'],
|
||||
typicalDataCategories: ['NAME', 'CONTACT', 'CONTRACT_DATA'],
|
||||
typicalCertifications: ['ISO 27001'],
|
||||
inherentRiskFactors: [
|
||||
{ factor: 'project_access', weight: 0.5, description: { de: 'Projektzugriff', en: 'Project access' } },
|
||||
{ factor: 'temporary', weight: 0.4, description: { de: 'Temporär', en: 'Temporary' } },
|
||||
],
|
||||
commonProviders: ['Accenture', 'McKinsey', 'Deloitte', 'PwC', 'KPMG'],
|
||||
},
|
||||
]
|
||||
|
||||
// ==========================================
|
||||
// COUNTRY RISK PROFILES
|
||||
// ==========================================
|
||||
|
||||
export const COUNTRY_RISK_PROFILES: CountryRiskProfile[] = [
|
||||
// EU Countries (Low Risk)
|
||||
{ code: 'DE', name: { de: 'Deutschland', en: 'Germany' }, isEU: true, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'AT', name: { de: 'Österreich', en: 'Austria' }, isEU: true, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'FR', name: { de: 'Frankreich', en: 'France' }, isEU: true, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'NL', name: { de: 'Niederlande', en: 'Netherlands' }, isEU: true, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'BE', name: { de: 'Belgien', en: 'Belgium' }, isEU: true, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'IT', name: { de: 'Italien', en: 'Italy' }, isEU: true, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'ES', name: { de: 'Spanien', en: 'Spain' }, isEU: true, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'PT', name: { de: 'Portugal', en: 'Portugal' }, isEU: true, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'PL', name: { de: 'Polen', en: 'Poland' }, isEU: true, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'CZ', name: { de: 'Tschechien', en: 'Czech Republic' }, isEU: true, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'SE', name: { de: 'Schweden', en: 'Sweden' }, isEU: true, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'DK', name: { de: 'Dänemark', en: 'Denmark' }, isEU: true, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'FI', name: { de: 'Finnland', en: 'Finland' }, isEU: true, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'IE', name: { de: 'Irland', en: 'Ireland' }, isEU: true, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'LU', name: { de: 'Luxemburg', en: 'Luxembourg' }, isEU: true, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
|
||||
// EEA Countries
|
||||
{ code: 'NO', name: { de: 'Norwegen', en: 'Norway' }, isEU: false, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'IS', name: { de: 'Island', en: 'Iceland' }, isEU: false, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'LI', name: { de: 'Liechtenstein', en: 'Liechtenstein' }, isEU: false, isEEA: true, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
|
||||
// Adequacy Decision Countries
|
||||
{ code: 'CH', name: { de: 'Schweiz', en: 'Switzerland' }, isEU: false, isEEA: false, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'GB', name: { de: 'Vereinigtes Königreich', en: 'United Kingdom' }, isEU: false, isEEA: false, hasAdequacyDecision: true, adequacyDecisionDate: '2021-06-28', riskLevel: 'LOW' },
|
||||
{ code: 'JP', name: { de: 'Japan', en: 'Japan' }, isEU: false, isEEA: false, hasAdequacyDecision: true, adequacyDecisionDate: '2019-01-23', riskLevel: 'LOW' },
|
||||
{ code: 'KR', name: { de: 'Südkorea', en: 'South Korea' }, isEU: false, isEEA: false, hasAdequacyDecision: true, adequacyDecisionDate: '2022-12-17', riskLevel: 'LOW' },
|
||||
{ code: 'IL', name: { de: 'Israel', en: 'Israel' }, isEU: false, isEEA: false, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'NZ', name: { de: 'Neuseeland', en: 'New Zealand' }, isEU: false, isEEA: false, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'CA', name: { de: 'Kanada', en: 'Canada' }, isEU: false, isEEA: false, hasAdequacyDecision: true, riskLevel: 'LOW', notes: { de: 'Nur PIPEDA-Bereich', en: 'PIPEDA scope only' } },
|
||||
{ code: 'AR', name: { de: 'Argentinien', en: 'Argentina' }, isEU: false, isEEA: false, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
{ code: 'UY', name: { de: 'Uruguay', en: 'Uruguay' }, isEU: false, isEEA: false, hasAdequacyDecision: true, riskLevel: 'LOW' },
|
||||
|
||||
// US (Special - DPF)
|
||||
{ code: 'US', name: { de: 'USA', en: 'United States' }, isEU: false, isEEA: false, hasAdequacyDecision: true, adequacyDecisionDate: '2023-07-10', riskLevel: 'MEDIUM', notes: { de: 'EU-US Data Privacy Framework erforderlich', en: 'EU-US Data Privacy Framework required' } },
|
||||
|
||||
// Third Countries without Adequacy (High Risk)
|
||||
{ code: 'CN', name: { de: 'China', en: 'China' }, isEU: false, isEEA: false, hasAdequacyDecision: false, riskLevel: 'VERY_HIGH', notes: { de: 'Staatlicher Datenzugriff möglich', en: 'Government data access possible' } },
|
||||
{ code: 'RU', name: { de: 'Russland', en: 'Russia' }, isEU: false, isEEA: false, hasAdequacyDecision: false, riskLevel: 'VERY_HIGH', notes: { de: 'Sanktionen beachten', en: 'Consider sanctions' } },
|
||||
{ code: 'IN', name: { de: 'Indien', en: 'India' }, isEU: false, isEEA: false, hasAdequacyDecision: false, riskLevel: 'HIGH' },
|
||||
{ code: 'BR', name: { de: 'Brasilien', en: 'Brazil' }, isEU: false, isEEA: false, hasAdequacyDecision: false, riskLevel: 'MEDIUM', notes: { de: 'LGPD vorhanden', en: 'LGPD in place' } },
|
||||
{ code: 'AU', name: { de: 'Australien', en: 'Australia' }, isEU: false, isEEA: false, hasAdequacyDecision: false, riskLevel: 'MEDIUM' },
|
||||
{ code: 'SG', name: { de: 'Singapur', en: 'Singapore' }, isEU: false, isEEA: false, hasAdequacyDecision: false, riskLevel: 'MEDIUM', notes: { de: 'PDPA vorhanden', en: 'PDPA in place' } },
|
||||
{ code: 'HK', name: { de: 'Hongkong', en: 'Hong Kong' }, isEU: false, isEEA: false, hasAdequacyDecision: false, riskLevel: 'HIGH' },
|
||||
{ code: 'AE', name: { de: 'VAE', en: 'UAE' }, isEU: false, isEEA: false, hasAdequacyDecision: false, riskLevel: 'HIGH' },
|
||||
{ code: 'ZA', name: { de: 'Südafrika', en: 'South Africa' }, isEU: false, isEEA: false, hasAdequacyDecision: false, riskLevel: 'MEDIUM', notes: { de: 'POPIA vorhanden', en: 'POPIA in place' } },
|
||||
]
|
||||
|
||||
// ==========================================
|
||||
// HELPER FUNCTIONS
|
||||
// ==========================================
|
||||
|
||||
/**
|
||||
* Get vendor template by ID
|
||||
*/
|
||||
export function getVendorTemplateById(id: string): VendorTemplate | undefined {
|
||||
return VENDOR_TEMPLATES.find((t) => t.id === id)
|
||||
}
|
||||
|
||||
/**
|
||||
* Get vendor templates by category
|
||||
*/
|
||||
export function getVendorTemplatesByCategory(category: ServiceCategory): VendorTemplate[] {
|
||||
return VENDOR_TEMPLATES.filter((t) => t.serviceCategory === category)
|
||||
}
|
||||
|
||||
/**
|
||||
* Get country risk profile
|
||||
*/
|
||||
export function getCountryRiskProfile(countryCode: string): CountryRiskProfile | undefined {
|
||||
return COUNTRY_RISK_PROFILES.find((c) => c.code === countryCode.toUpperCase())
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if country requires transfer mechanism
|
||||
*/
|
||||
export function requiresTransferMechanism(countryCode: string): boolean {
|
||||
const profile = getCountryRiskProfile(countryCode)
|
||||
if (!profile) return true // Unknown country = requires mechanism
|
||||
return !profile.isEU && !profile.isEEA && !profile.hasAdequacyDecision
|
||||
}
|
||||
|
||||
/**
|
||||
* Get suggested transfer mechanisms for country
|
||||
*/
|
||||
export function getSuggestedTransferMechanisms(countryCode: string): TransferMechanismType[] {
|
||||
const profile = getCountryRiskProfile(countryCode)
|
||||
|
||||
if (!profile) {
|
||||
return ['SCC_PROCESSOR']
|
||||
}
|
||||
|
||||
if (profile.isEU || profile.isEEA) {
|
||||
return [] // No mechanism needed
|
||||
}
|
||||
|
||||
if (profile.hasAdequacyDecision) {
|
||||
return ['ADEQUACY_DECISION']
|
||||
}
|
||||
|
||||
// Third country without adequacy
|
||||
return ['SCC_PROCESSOR', 'BCR']
|
||||
}
|
||||
|
||||
/**
|
||||
* Calculate inherent risk score for vendor template
|
||||
*/
|
||||
export function calculateTemplateRiskScore(template: VendorTemplate): number {
|
||||
const baseScore = template.inherentRiskFactors.reduce(
|
||||
(sum, factor) => sum + factor.weight * 100,
|
||||
0
|
||||
)
|
||||
return Math.min(100, baseScore / template.inherentRiskFactors.length)
|
||||
}
|
||||
|
||||
/**
|
||||
* Create form data from vendor template
|
||||
*/
|
||||
export function createVendorFormDataFromTemplate(
|
||||
template: VendorTemplate
|
||||
): Partial<VendorFormData> {
|
||||
return {
|
||||
serviceCategory: template.serviceCategory,
|
||||
role: template.suggestedRole,
|
||||
dataAccessLevel: template.suggestedDataAccess,
|
||||
transferMechanisms: template.suggestedTransferMechanisms,
|
||||
contractTypes: template.suggestedContractTypes,
|
||||
certifications: template.typicalCertifications.map((type) => ({
|
||||
type,
|
||||
issuedDate: undefined,
|
||||
expirationDate: undefined,
|
||||
})),
|
||||
reviewFrequency: 'ANNUAL',
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all EU/EEA countries
|
||||
*/
|
||||
export function getEUEEACountries(): CountryRiskProfile[] {
|
||||
return COUNTRY_RISK_PROFILES.filter((c) => c.isEU || c.isEEA)
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all countries with adequacy decision
|
||||
*/
|
||||
export function getAdequateCountries(): CountryRiskProfile[] {
|
||||
return COUNTRY_RISK_PROFILES.filter((c) => c.hasAdequacyDecision)
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all high-risk countries
|
||||
*/
|
||||
export function getHighRiskCountries(): CountryRiskProfile[] {
|
||||
return COUNTRY_RISK_PROFILES.filter((c) => c.riskLevel === 'HIGH' || c.riskLevel === 'VERY_HIGH')
|
||||
}
|
||||
Reference in New Issue
Block a user