Privacy Compliance

#!/usr/bin/env python3
"""
Data Subject Request (DSR) Tracker

Tracks DSR lifecycle across multiple privacy regulations with deadline calculation,
status management, and overdue alerts.

Usage:
    python dsr_tracker.py add --type access --regulation gdpr --subject "Jane Smith" --email "jane@example.com"
    python dsr_tracker.py list
    python dsr_tracker.py list --overdue
    python dsr_tracker.py update --id DSR-0001 --status verified
    python dsr_tracker.py dashboard
    python dsr_tracker.py dashboard --json
"""

import argparse
import json
import os
import sys
from datetime import datetime, timedelta
from pathlib import Path
from typing import Dict, List, Optional

DEFAULT_DATA_FILE = "dsr_requests.json"

REQUEST_TYPES = [
    "access", "deletion", "correction", "portability",
    "restriction", "objection", "automated_decision", "withdraw_consent",
]

VALID_STATUSES = ["received", "verified", "processing", "completed", "denied", "extended"]

REGULATION_DEADLINES: Dict[str, Dict] = {
    "gdpr": {
        "name": "GDPR",
        "initial_days": 30,
        "calendar_type": "calendar",
        "extension_days": 60,
        "ack_business_days": None,
        "max_total_days": 90,
    },
    "ccpa": {
        "name": "CCPA/CPRA",
        "initial_days": 45,
        "calendar_type": "calendar",
        "extension_days": 45,
        "ack_business_days": 10,
        "max_total_days": 90,
    },
    "lgpd": {
        "name": "LGPD",
        "initial_days": 15,
        "calendar_type": "calendar",
        "extension_days": 0,
        "ack_business_days": None,
        "max_total_days": 15,
    },
    "popia": {
        "name": "POPIA",
        "initial_days": 30,
        "calendar_type": "calendar",
        "extension_days": 0,
        "ack_business_days": None,
        "max_total_days": 30,
    },
    "pipeda": {
        "name": "PIPEDA",
        "initial_days": 30,
        "calendar_type": "calendar",
        "extension_days": 30,
        "ack_business_days": None,
        "max_total_days": 60,
    },
    "pdpa": {
        "name": "PDPA",
        "initial_days": 30,
        "calendar_type": "calendar",
        "extension_days": 0,
        "ack_business_days": None,
        "max_total_days": 30,
    },
    "privacy_act_au": {
        "name": "Privacy Act (AU)",
        "initial_days": 30,
        "calendar_type": "calendar",
        "extension_days": 30,
        "ack_business_days": None,
        "max_total_days": 60,
    },
    "pipl": {
        "name": "PIPL",
        "initial_days": 15,
        "calendar_type": "calendar",
        "extension_days": 15,
        "ack_business_days": None,
        "max_total_days": 30,
    },
    "uk_gdpr": {
        "name": "UK GDPR",
        "initial_days": 30,
        "calendar_type": "calendar",
        "extension_days": 60,
        "ack_business_days": None,
        "max_total_days": 90,
    },
}


def load_data(data_file: str) -> Dict:
    """Load DSR data from JSON file."""
    path = Path(data_file)
    if path.exists():
        with open(path, "r") as f:
            return json.load(f)
    return {"requests": [], "next_id": 1}


def save_data(data: Dict, data_file: str) -> None:
    """Save DSR data to JSON file."""
    with open(data_file, "w") as f:
        json.dump(data, f, indent=2, default=str)


def calculate_deadline(received_date: str, regulation: str, is_extended: bool = False) -> Dict:
    """Calculate deadline based on regulation and extension status."""
    reg = REGULATION_DEADLINES.get(regulation)
    if not reg:
        return {"error": f"Unknown regulation: {regulation}"}

    received = datetime.fromisoformat(received_date)
    initial_deadline = received + timedelta(days=reg["initial_days"])

    if is_extended and reg["extension_days"] > 0:
        final_deadline = received + timedelta(days=reg["max_total_days"])
    else:
        final_deadline = initial_deadline

    now = datetime.now()
    remaining = (final_deadline - now).days
    ack_deadline = None
    ack_remaining = None
    if reg["ack_business_days"]:
        # Approximate business days (skip weekends)
        bd = reg["ack_business_days"]
        ack_date = received
        added = 0
        while added < bd:
            ack_date += timedelta(days=1)
            if ack_date.weekday() < 5:
                added += 1
        ack_deadline = ack_date.isoformat()
        ack_remaining = (ack_date - now).days

    return {
        "initial_deadline": initial_deadline.isoformat(),
        "final_deadline": final_deadline.isoformat(),
        "days_remaining": remaining,
        "is_overdue": remaining < 0,
        "ack_deadline": ack_deadline,
        "ack_days_remaining": ack_remaining,
        "extension_available": not is_extended and reg["extension_days"] > 0,
        "extension_days": reg["extension_days"],
    }


def add_request(data: Dict, request_type: str, regulation: str,
                subject: str, email: str) -> Dict:
    """Add a new DSR to the tracker."""
    req_id = f"DSR-{data['next_id']:04d}"
    now = datetime.now().isoformat()

    deadline_info = calculate_deadline(now, regulation)

    request = {
        "id": req_id,
        "type": request_type,
        "regulation": regulation,
        "regulation_name": REGULATION_DEADLINES[regulation]["name"],
        "subject": subject,
        "email": email,
        "status": "received",
        "received_date": now,
        "initial_deadline": deadline_info["initial_deadline"],
        "final_deadline": deadline_info["final_deadline"],
        "ack_deadline": deadline_info.get("ack_deadline"),
        "is_extended": False,
        "status_history": [
            {"status": "received", "date": now, "note": "Request logged"}
        ],
    }

    data["requests"].append(request)
    data["next_id"] += 1
    return request


def update_status(data: Dict, req_id: str, new_status: str, note: str = "") -> Optional[Dict]:
    """Update the status of a DSR."""
    for req in data["requests"]:
        if req["id"] == req_id:
            old_status = req["status"]
            req["status"] = new_status
            now = datetime.now().isoformat()

            if new_status == "extended":
                req["is_extended"] = True
                deadline_info = calculate_deadline(req["received_date"], req["regulation"], True)
                req["final_deadline"] = deadline_info["final_deadline"]

            entry = {"status": new_status, "date": now, "note": note or f"Status changed from {old_status}"}
            req["status_history"].append(entry)
            return req
    return None


def list_requests(data: Dict, overdue_only: bool = False) -> List[Dict]:
    """List requests with current deadline status."""
    results = []
    for req in data["requests"]:
        if req["status"] in ("completed", "denied"):
            if overdue_only:
                continue
            results.append({**req, "days_remaining": None, "is_overdue": False})
            continue

        deadline_info = calculate_deadline(
            req["received_date"], req["regulation"], req.get("is_extended", False)
        )
        enriched = {
            **req,
            "days_remaining": deadline_info["days_remaining"],
            "is_overdue": deadline_info["is_overdue"],
            "ack_days_remaining": deadline_info.get("ack_days_remaining"),
            "extension_available": deadline_info.get("extension_available", False),
        }
        if overdue_only and not deadline_info["is_overdue"]:
            continue
        results.append(enriched)
    return results


def generate_dashboard(data: Dict) -> Dict:
    """Generate dashboard summary with alerts."""
    all_requests = list_requests(data)
    open_requests = [r for r in all_requests if r["status"] not in ("completed", "denied")]
    overdue = [r for r in open_requests if r.get("is_overdue")]
    urgent = [r for r in open_requests if not r.get("is_overdue") and r.get("days_remaining") is not None and r["days_remaining"] <= 7]
    completed = [r for r in all_requests if r["status"] == "completed"]
    denied = [r for r in all_requests if r["status"] == "denied"]

    by_regulation = {}
    for r in open_requests:
        reg = r.get("regulation_name", r.get("regulation", "unknown"))
        by_regulation.setdefault(reg, 0)
        by_regulation[reg] += 1

    by_type = {}
    for r in open_requests:
        by_type.setdefault(r["type"], 0)
        by_type[r["type"]] += 1

    return {
        "generated": datetime.now().isoformat(),
        "summary": {
            "total_requests": len(all_requests),
            "open": len(open_requests),
            "overdue": len(overdue),
            "urgent_within_7_days": len(urgent),
            "completed": len(completed),
            "denied": len(denied),
        },
        "by_regulation": by_regulation,
        "by_type": by_type,
        "overdue_requests": [
            {"id": r["id"], "type": r["type"], "regulation": r.get("regulation_name", ""),
             "subject": r["subject"], "days_overdue": abs(r["days_remaining"]),
             "status": r["status"]}
            for r in overdue
        ],
        "urgent_requests": [
            {"id": r["id"], "type": r["type"], "regulation": r.get("regulation_name", ""),
             "subject": r["subject"], "days_remaining": r["days_remaining"],
             "status": r["status"]}
            for r in urgent
        ],
    }


def format_dashboard_text(dashboard: Dict) -> str:
    """Format dashboard as human-readable text."""
    lines = []
    s = dashboard["summary"]
    lines.append("=" * 60)
    lines.append("DSR TRACKER DASHBOARD")
    lines.append(f"Generated: {dashboard['generated'][:16]}")
    lines.append("=" * 60)
    lines.append(f"\n  Total Requests:    {s['total_requests']}")
    lines.append(f"  Open:              {s['open']}")
    lines.append(f"  Overdue:           {s['overdue']}")
    lines.append(f"  Urgent (<=7 days): {s['urgent_within_7_days']}")
    lines.append(f"  Completed:         {s['completed']}")
    lines.append(f"  Denied:            {s['denied']}")

    if dashboard["by_regulation"]:
        lines.append("\n  Open by Regulation:")
        for reg, count in dashboard["by_regulation"].items():
            lines.append(f"    {reg}: {count}")

    if dashboard["overdue_requests"]:
        lines.append(f"\n{'!' * 60}")
        lines.append("  OVERDUE REQUESTS")
        lines.append(f"{'!' * 60}")
        for r in dashboard["overdue_requests"]:
            lines.append(f"  [{r['id']}] {r['type']} ({r['regulation']}) — {r['subject']}")
            lines.append(f"    {r['days_overdue']} days overdue | Status: {r['status']}")

    if dashboard["urgent_requests"]:
        lines.append(f"\n{'-' * 60}")
        lines.append("  URGENT REQUESTS (due within 7 days)")
        lines.append(f"{'-' * 60}")
        for r in dashboard["urgent_requests"]:
            lines.append(f"  [{r['id']}] {r['type']} ({r['regulation']}) — {r['subject']}")
            lines.append(f"    {r['days_remaining']} days remaining | Status: {r['status']}")

    if not dashboard["overdue_requests"] and not dashboard["urgent_requests"]:
        lines.append("\n  No overdue or urgent requests.")

    return "\n".join(lines)


def format_list_text(requests: List[Dict]) -> str:
    """Format request list as human-readable text."""
    if not requests:
        return "No requests found."
    lines = []
    lines.append(f"{'ID':<12} {'Type':<20} {'Regulation':<15} {'Subject':<20} {'Status':<12} {'Days Left':<10}")
    lines.append("-" * 89)
    for r in requests:
        days = r.get("days_remaining")
        days_str = str(days) if days is not None else "—"
        if r.get("is_overdue"):
            days_str = f"OVERDUE ({abs(days)}d)"
        reg_name = r.get("regulation_name", r.get("regulation", ""))
        lines.append(f"{r['id']:<12} {r['type']:<20} {reg_name:<15} {r['subject']:<20} {r['status']:<12} {days_str:<10}")
    return "\n".join(lines)


def main():
    parser = argparse.ArgumentParser(description="Data Subject Request Lifecycle Tracker")
    subparsers = parser.add_subparsers(dest="command", help="Command to execute")

    # Shared arguments for all subcommands
    parent_parser = argparse.ArgumentParser(add_help=False)
    parent_parser.add_argument("--json", action="store_true", help="Output in JSON format")
    parent_parser.add_argument("--data-file", default=DEFAULT_DATA_FILE, help="Path to data file")

    # Add command
    add_parser = subparsers.add_parser("add", help="Add a new DSR", parents=[parent_parser])
    add_parser.add_argument("--type", required=True, choices=REQUEST_TYPES, help="Request type")
    add_parser.add_argument("--regulation", required=True, choices=list(REGULATION_DEADLINES.keys()), help="Applicable regulation")
    add_parser.add_argument("--subject", required=True, help="Data subject name")
    add_parser.add_argument("--email", required=True, help="Data subject email")

    # List command
    list_parser = subparsers.add_parser("list", help="List DSRs", parents=[parent_parser])
    list_parser.add_argument("--overdue", action="store_true", help="Show overdue only")

    # Update command
    update_parser = subparsers.add_parser("update", help="Update DSR status", parents=[parent_parser])
    update_parser.add_argument("--id", required=True, help="Request ID (e.g., DSR-0001)")
    update_parser.add_argument("--status", required=True, choices=VALID_STATUSES, help="New status")
    update_parser.add_argument("--note", default="", help="Optional note")

    # Dashboard command
    subparsers.add_parser("dashboard", help="Show dashboard summary", parents=[parent_parser])

    args = parser.parse_args()

    if not args.command:
        parser.print_help()
        sys.exit(1)

    try:
        data = load_data(args.data_file)

        if args.command == "add":
            request = add_request(data, args.type, args.regulation, args.subject, args.email)
            save_data(data, args.data_file)
            if args.json:
                print(json.dumps(request, indent=2, default=str))
            else:
                dl = request["initial_deadline"][:10]
                print(f"Created {request['id']}: {request['type']} ({request['regulation_name']})")
                print(f"  Subject: {request['subject']} <{request['email']}>")
                print(f"  Deadline: {dl}")
                if request.get("ack_deadline"):
                    print(f"  Acknowledgment deadline: {request['ack_deadline'][:10]}")

        elif args.command == "list":
            requests = list_requests(data, overdue_only=args.overdue)
            if args.json:
                print(json.dumps(requests, indent=2, default=str))
            else:
                print(format_list_text(requests))

        elif args.command == "update":
            result = update_status(data, args.id, args.status, args.note)
            if result is None:
                print(f"Error: Request {args.id} not found.", file=sys.stderr)
                sys.exit(1)
            save_data(data, args.data_file)
            if args.json:
                print(json.dumps(result, indent=2, default=str))
            else:
                print(f"Updated {result['id']}: status -> {result['status']}")
                if args.status == "extended":
                    print(f"  Extended deadline: {result['final_deadline'][:10]}")

        elif args.command == "dashboard":
            dashboard = generate_dashboard(data)
            if args.json:
                print(json.dumps(dashboard, indent=2, default=str))
            else:
                print(format_dashboard_text(dashboard))

    except Exception as e:
        print(f"Error: {e}", file=sys.stderr)
        sys.exit(1)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Privacy Regulation Checker

Determines which privacy regulations apply to an organization based on location,
data subjects, data types, and processing activities. Maps obligations per regulation
and flags gaps where current practices may not meet requirements.

Usage:
    python privacy_regulation_checker.py --org-location DE --data-subjects EU,US --data-types personal,sensitive --processing-activities marketing,analytics
    python privacy_regulation_checker.py --org-location US-CA --data-subjects EU,BR --data-types personal --processing-activities ecommerce --json
    python privacy_regulation_checker.py --org-location SG --data-subjects SG,AU --data-types health --processing-activities healthcare --current-practices consent_mechanism,breach_process
"""

import argparse
import json
import sys
from datetime import datetime
from typing import Dict, List, Optional, Set, Tuple


REGULATIONS: Dict[str, Dict] = {
    "gdpr": {
        "name": "GDPR (EU)",
        "full_name": "General Data Protection Regulation (EU) 2016/679",
        "territorial_scope": ["EU"],
        "applies_when": "Processing personal data of EU/EEA residents, or organization established in EU",
        "dpo_required": True,
        "breach_notification_hours": 72,
        "max_penalty_pct": 4.0,
        "max_penalty_amount": "EUR 20M",
        "dsr_deadline_days": 30,
        "dsr_extension_days": 60,
        "legal_bases": ["consent", "contract", "legal_obligation", "vital_interests", "public_task", "legitimate_interests"],
        "key_obligations": [
            "Lawful basis for processing (Art. 6)",
            "Data subject rights (Art. 15-22)",
            "Records of processing activities (Art. 30)",
            "Data Protection Impact Assessment (Art. 35)",
            "Data Protection Officer appointment (Art. 37)",
            "Breach notification within 72 hours (Art. 33)",
            "International transfer safeguards (Chapter V)",
            "Privacy by design and default (Art. 25)",
        ],
        "data_subject_rights": ["access", "rectification", "erasure", "restriction", "portability", "objection", "automated_decision"],
    },
    "ccpa": {
        "name": "CCPA/CPRA (California)",
        "full_name": "California Consumer Privacy Act / California Privacy Rights Act",
        "territorial_scope": ["US"],
        "applies_when": "For-profit business meeting revenue/data thresholds processing CA residents' data",
        "dpo_required": False,
        "breach_notification_hours": None,
        "max_penalty_pct": None,
        "max_penalty_amount": "USD 7,500 per violation",
        "dsr_deadline_days": 45,
        "dsr_extension_days": 45,
        "dsr_ack_business_days": 10,
        "legal_bases": ["notice_and_opt_out"],
        "key_obligations": [
            "Privacy notice at collection (§1798.100)",
            "Right to opt-out of sale/sharing (§1798.120)",
            "Do Not Sell or Share link (§1798.135)",
            "Honor Global Privacy Control signal",
            "Annual metrics disclosure",
            "Service provider contract requirements",
            "Risk assessments for high-risk processing (CPRA)",
            "Limit use of sensitive personal information",
        ],
        "data_subject_rights": ["access", "deletion", "correction", "opt_out_sale", "limit_sensitive", "portability"],
    },
    "lgpd": {
        "name": "LGPD (Brazil)",
        "full_name": "Lei Geral de Proteção de Dados (Law 13,709/2018)",
        "territorial_scope": ["BR"],
        "applies_when": "Processing personal data collected in Brazil or of individuals in Brazil",
        "dpo_required": True,
        "breach_notification_hours": None,
        "max_penalty_pct": 2.0,
        "max_penalty_amount": "BRL 50M per violation",
        "dsr_deadline_days": 15,
        "dsr_extension_days": 0,
        "legal_bases": ["consent", "legal_obligation", "public_policy", "research", "contract", "legitimate_interests",
                        "health_protection", "credit_protection", "life_protection", "regulatory_exercise"],
        "key_obligations": [
            "Lawful basis for processing (Art. 7)",
            "Data subject rights (Art. 18)",
            "DPO appointment (Art. 41) — called Encarregado",
            "International transfer restrictions (Art. 33)",
            "Breach notification to ANPD (Art. 48)",
            "Privacy Impact Assessment (Art. 38)",
            "Records of processing activities (Art. 37)",
        ],
        "data_subject_rights": ["access", "correction", "anonymization", "portability", "deletion", "information_sharing",
                                "consent_info", "objection", "review_automated"],
    },
    "popia": {
        "name": "POPIA (South Africa)",
        "full_name": "Protection of Personal Information Act 4 of 2013",
        "territorial_scope": ["ZA"],
        "applies_when": "Processing personal information of South African data subjects",
        "dpo_required": True,
        "breach_notification_hours": None,
        "max_penalty_pct": None,
        "max_penalty_amount": "ZAR 10M or imprisonment",
        "dsr_deadline_days": 30,
        "dsr_extension_days": 0,
        "legal_bases": ["consent", "contract", "legal_obligation", "legitimate_interests", "public_law", "public_interest"],
        "key_obligations": [
            "Lawful processing conditions (Section 9-12)",
            "Information Officer registration (Section 55)",
            "Security safeguards (Section 19)",
            "Breach notification to Information Regulator (Section 22)",
            "Cross-border transfer restrictions (Section 72)",
            "Data subject rights (Section 23-25)",
        ],
        "data_subject_rights": ["access", "correction", "deletion", "objection"],
    },
    "pipeda": {
        "name": "PIPEDA (Canada)",
        "full_name": "Personal Information Protection and Electronic Documents Act",
        "territorial_scope": ["CA"],
        "applies_when": "Commercial activity involving personal information in Canada",
        "dpo_required": True,
        "breach_notification_hours": None,
        "max_penalty_pct": None,
        "max_penalty_amount": "CAD 100,000 per violation",
        "dsr_deadline_days": 30,
        "dsr_extension_days": 30,
        "legal_bases": ["consent", "legitimate_purpose"],
        "key_obligations": [
            "10 fair information principles (Schedule 1)",
            "Meaningful consent requirements",
            "Breach notification to OPC and individuals",
            "Privacy Officer designation (Principle 1)",
            "Breach record-keeping",
            "Cross-border transfer accountability",
        ],
        "data_subject_rights": ["access", "correction", "withdrawal_consent", "complaint"],
    },
    "pdpa": {
        "name": "PDPA (Singapore)",
        "full_name": "Personal Data Protection Act 2012",
        "territorial_scope": ["SG"],
        "applies_when": "Organization collecting, using, or disclosing personal data in Singapore",
        "dpo_required": True,
        "breach_notification_hours": 72,
        "max_penalty_pct": None,
        "max_penalty_amount": "SGD 1M or 10% annual turnover",
        "dsr_deadline_days": 30,
        "dsr_extension_days": 0,
        "legal_bases": ["consent", "legitimate_interests", "business_improvement", "contractual_necessity"],
        "key_obligations": [
            "Consent obligation",
            "Purpose limitation obligation",
            "Data Protection Officer appointment",
            "Notification obligation (data breaches)",
            "Transfer limitation obligation",
            "Data portability obligation",
            "Do Not Call Registry compliance",
        ],
        "data_subject_rights": ["access", "correction", "portability"],
    },
    "privacy_act_au": {
        "name": "Privacy Act (Australia)",
        "full_name": "Privacy Act 1988 (Cth) with 2024 amendments",
        "territorial_scope": ["AU"],
        "applies_when": "Organization with AUD 3M+ annual turnover handling personal information in Australia",
        "dpo_required": False,
        "breach_notification_hours": None,
        "max_penalty_pct": None,
        "max_penalty_amount": "AUD 50M or 30% turnover or 3x benefit",
        "dsr_deadline_days": 30,
        "dsr_extension_days": 30,
        "legal_bases": ["consent", "reasonable_expectation"],
        "key_obligations": [
            "13 Australian Privacy Principles (APPs)",
            "Notifiable Data Breaches scheme (Part IIIC)",
            "Cross-border disclosure restrictions (APP 8)",
            "Privacy Impact Assessment (for high-risk activities)",
            "Direct marketing opt-out (APP 7)",
        ],
        "data_subject_rights": ["access", "correction", "complaint", "erasure"],
    },
    "pipl": {
        "name": "PIPL (China)",
        "full_name": "Personal Information Protection Law of the PRC",
        "territorial_scope": ["CN"],
        "applies_when": "Processing personal information of individuals in China",
        "dpo_required": True,
        "breach_notification_hours": None,
        "max_penalty_pct": 5.0,
        "max_penalty_amount": "CNY 50M or 5% annual revenue",
        "dsr_deadline_days": 15,
        "dsr_extension_days": 15,
        "legal_bases": ["consent", "contract", "legal_obligation", "public_health", "public_interest", "legitimate_interests"],
        "key_obligations": [
            "Separate consent for sensitive data and cross-border transfers",
            "Data localization (critical information infrastructure)",
            "Security assessment for cross-border transfers",
            "Personal Information Impact Assessment (Art. 55)",
            "DPO appointment for threshold processing",
            "Government access and cooperation requirements",
        ],
        "data_subject_rights": ["access", "correction", "deletion", "portability", "restriction", "automated_decision_explanation"],
    },
    "uk_gdpr": {
        "name": "UK GDPR",
        "full_name": "UK General Data Protection Regulation (retained EU law)",
        "territorial_scope": ["UK"],
        "applies_when": "Processing personal data of UK residents or organization established in UK",
        "dpo_required": True,
        "breach_notification_hours": 72,
        "max_penalty_pct": 4.0,
        "max_penalty_amount": "GBP 17.5M",
        "dsr_deadline_days": 30,
        "dsr_extension_days": 60,
        "legal_bases": ["consent", "contract", "legal_obligation", "vital_interests", "public_task", "legitimate_interests"],
        "key_obligations": [
            "Substantially mirrors GDPR obligations",
            "UK International Data Transfer Agreement (IDTA)",
            "UK Addendum to EU SCCs",
            "ICO registration and fee payment",
            "Breach notification to ICO within 72 hours",
            "UK-specific adequacy decisions for transfers",
        ],
        "data_subject_rights": ["access", "rectification", "erasure", "restriction", "portability", "objection", "automated_decision"],
    },
}

REGION_MAPPING = {
    "EU": ["gdpr"],
    "US": ["ccpa"],
    "US-CA": ["ccpa"],
    "BR": ["lgpd"],
    "ZA": ["popia"],
    "CA": ["pipeda"],
    "SG": ["pdpa"],
    "AU": ["privacy_act_au"],
    "CN": ["pipl"],
    "UK": ["uk_gdpr"],
}

EU_COUNTRIES = {"AT", "BE", "BG", "HR", "CY", "CZ", "DK", "EE", "FI", "FR", "DE", "GR",
                "HU", "IE", "IT", "LV", "LT", "LU", "MT", "NL", "PL", "PT", "RO", "SK",
                "SI", "ES", "SE", "IS", "LI", "NO"}

CURRENT_PRACTICES_EXPECTED = {
    "consent_mechanism": "Consent collection and management",
    "breach_process": "Breach notification process",
    "retention_policy": "Data retention policy",
    "dpo_appointed": "Data Protection Officer appointed",
    "dsr_process": "Data subject request handling process",
    "privacy_notice": "Privacy notice published",
    "ropa": "Records of processing activities",
    "dpia_process": "Data protection impact assessment process",
    "transfer_mechanism": "International transfer safeguards",
    "vendor_management": "Processor/vendor DPA management",
}


def resolve_regions(locations: List[str]) -> Set[str]:
    """Resolve location codes to applicable regulation keys."""
    regs: Set[str] = set()
    for loc in locations:
        loc_upper = loc.upper().strip()
        if loc_upper in EU_COUNTRIES:
            regs.update(REGION_MAPPING.get("EU", []))
        elif loc_upper in REGION_MAPPING:
            regs.update(REGION_MAPPING[loc_upper])
        elif loc_upper == "EU":
            regs.update(REGION_MAPPING["EU"])
    return regs


def determine_applicable(org_location: str, data_subjects: List[str],
                         data_types: List[str], processing_activities: List[str]) -> List[Dict]:
    """Determine which regulations apply and why."""
    applicable = []
    from_org = resolve_regions([org_location])
    from_subjects = resolve_regions(data_subjects)
    all_regs = from_org | from_subjects

    for reg_key in sorted(all_regs):
        reg = REGULATIONS[reg_key]
        reasons = []
        if reg_key in from_org:
            reasons.append(f"Organization established in scope territory ({org_location})")
        if reg_key in from_subjects:
            matching = [s for s in data_subjects if reg_key in resolve_regions([s])]
            reasons.append(f"Data subjects located in: {', '.join(matching)}")

        risk_factors = []
        if "sensitive" in data_types or "health" in data_types or "biometric" in data_types:
            risk_factors.append("Processes sensitive/special category data — heightened obligations")
        if "children" in data_types:
            risk_factors.append("Processes children's data — additional consent requirements")
        if "profiling" in processing_activities:
            risk_factors.append("Profiling activity — may trigger DPIA and Art. 22 obligations")

        applicable.append({
            "regulation": reg_key,
            "name": reg["name"],
            "full_name": reg["full_name"],
            "reasons": reasons,
            "risk_factors": risk_factors,
            "obligations": reg["key_obligations"],
            "data_subject_rights": reg["data_subject_rights"],
            "dsr_deadline_days": reg["dsr_deadline_days"],
            "dsr_extension_days": reg.get("dsr_extension_days", 0),
            "breach_notification_hours": reg.get("breach_notification_hours"),
            "dpo_required": reg["dpo_required"],
            "max_penalty": reg.get("max_penalty_amount", "N/A"),
        })
    return applicable


def gap_analysis(applicable: List[Dict], current_practices: List[str]) -> List[Dict]:
    """Analyze gaps between current practices and regulatory requirements."""
    gaps = []
    practice_set = set(p.strip().lower() for p in current_practices)

    required_map = {
        "consent_mechanism": ["gdpr", "lgpd", "popia", "pipeda", "pdpa", "pipl", "uk_gdpr"],
        "breach_process": ["gdpr", "ccpa", "lgpd", "popia", "pipeda", "pdpa", "privacy_act_au", "pipl", "uk_gdpr"],
        "retention_policy": ["gdpr", "ccpa", "lgpd", "popia", "pipeda", "pdpa", "privacy_act_au", "pipl", "uk_gdpr"],
        "dpo_appointed": ["gdpr", "lgpd", "popia", "pipeda", "pdpa", "pipl", "uk_gdpr"],
        "dsr_process": ["gdpr", "ccpa", "lgpd", "popia", "pipeda", "pdpa", "privacy_act_au", "pipl", "uk_gdpr"],
        "privacy_notice": ["gdpr", "ccpa", "lgpd", "popia", "pipeda", "pdpa", "privacy_act_au", "pipl", "uk_gdpr"],
        "ropa": ["gdpr", "lgpd", "uk_gdpr"],
        "dpia_process": ["gdpr", "lgpd", "pipl", "uk_gdpr"],
        "transfer_mechanism": ["gdpr", "lgpd", "popia", "pipl", "uk_gdpr"],
        "vendor_management": ["gdpr", "ccpa", "lgpd", "uk_gdpr"],
    }

    applicable_keys = {a["regulation"] for a in applicable}

    for practice_key, required_by in required_map.items():
        affected_regs = [r for r in required_by if r in applicable_keys]
        if not affected_regs:
            continue
        if practice_key not in practice_set:
            risk = "critical" if len(affected_regs) >= 3 else ("high" if len(affected_regs) >= 2 else "medium")
            gaps.append({
                "practice": practice_key,
                "description": CURRENT_PRACTICES_EXPECTED.get(practice_key, practice_key),
                "missing": True,
                "required_by": [REGULATIONS[r]["name"] for r in affected_regs],
                "risk": risk,
            })
    return sorted(gaps, key=lambda g: {"critical": 0, "high": 1, "medium": 2}.get(g["risk"], 3))


def format_text(applicable: List[Dict], gaps: Optional[List[Dict]] = None) -> str:
    """Format results as human-readable text."""
    lines = []
    lines.append("=" * 70)
    lines.append("PRIVACY REGULATION APPLICABILITY REPORT")
    lines.append(f"Generated: {datetime.now().strftime('%Y-%m-%d %H:%M')}")
    lines.append("=" * 70)

    if not applicable:
        lines.append("\nNo applicable regulations identified for the given parameters.")
        return "\n".join(lines)

    lines.append(f"\nApplicable Regulations: {len(applicable)}\n")

    for reg in applicable:
        lines.append("-" * 50)
        lines.append(f"  {reg['name']}")
        lines.append(f"  {reg['full_name']}")
        lines.append(f"  Reasons:")
        for r in reg["reasons"]:
            lines.append(f"    - {r}")
        if reg["risk_factors"]:
            lines.append(f"  Risk Factors:")
            for rf in reg["risk_factors"]:
                lines.append(f"    ! {rf}")
        lines.append(f"  DPO Required: {'Yes' if reg['dpo_required'] else 'No'}")
        lines.append(f"  DSR Deadline: {reg['dsr_deadline_days']} days (ext. +{reg['dsr_extension_days']}d)")
        breach = reg.get("breach_notification_hours")
        lines.append(f"  Breach Notification: {f'{breach} hours' if breach else 'As soon as reasonably possible'}")
        lines.append(f"  Max Penalty: {reg['max_penalty']}")
        lines.append(f"  Key Obligations:")
        for ob in reg["obligations"]:
            lines.append(f"    - {ob}")
        lines.append(f"  Data Subject Rights: {', '.join(reg['data_subject_rights'])}")
        lines.append("")

    if gaps is not None:
        lines.append("=" * 70)
        lines.append("GAP ANALYSIS")
        lines.append("=" * 70)
        if not gaps:
            lines.append("\nNo gaps identified — all expected practices in place.")
        else:
            for g in gaps:
                risk_icon = {"critical": "[!!!]", "high": "[!!]", "medium": "[!]"}.get(g["risk"], "[?]")
                lines.append(f"\n{risk_icon} {g['risk'].upper()}: {g['description']}")
                lines.append(f"    Status: MISSING")
                lines.append(f"    Required by: {', '.join(g['required_by'])}")

    return "\n".join(lines)


def main():
    parser = argparse.ArgumentParser(
        description="Determine applicable privacy regulations for an organization"
    )
    parser.add_argument("--org-location", required=True, help="Organization HQ (ISO code: DE, US-CA, SG, etc.)")
    parser.add_argument("--data-subjects", required=True, help="Data subject locations (comma-separated: EU,US,BR)")
    parser.add_argument("--data-types", required=True, help="Data types (comma-separated: personal,sensitive,financial,health,biometric,children)")
    parser.add_argument("--processing-activities", required=True, help="Activities (comma-separated: marketing,analytics,hr,ecommerce,profiling,healthcare,research)")
    parser.add_argument("--current-practices", default=None, help="Current practices for gap analysis (comma-separated)")
    parser.add_argument("--json", action="store_true", help="Output in JSON format")

    args = parser.parse_args()

    try:
        subjects = [s.strip() for s in args.data_subjects.split(",")]
        data_types = [d.strip() for d in args.data_types.split(",")]
        activities = [a.strip() for a in args.processing_activities.split(",")]

        applicable = determine_applicable(args.org_location, subjects, data_types, activities)

        gaps = None
        if args.current_practices:
            practices = [p.strip() for p in args.current_practices.split(",")]
            gaps = gap_analysis(applicable, practices)

        if args.json:
            output = {
                "report_date": datetime.now().isoformat(),
                "parameters": {
                    "org_location": args.org_location,
                    "data_subjects": subjects,
                    "data_types": data_types,
                    "processing_activities": activities,
                },
                "applicable_regulations": applicable,
                "total_applicable": len(applicable),
            }
            if gaps is not None:
                output["gap_analysis"] = gaps
                output["total_gaps"] = len(gaps)
            print(json.dumps(output, indent=2))
        else:
            print(format_text(applicable, gaps))

    except Exception as e:
        print(f"Error: {e}", file=sys.stderr)
        sys.exit(1)


if __name__ == "__main__":
    main()