| { |
| "title": "GDPR Enterprise Data Dictionary (v2.0)", |
| "version": "2.0.0", |
| "standard": "Regulation (EU) 2016/679 (GDPR)", |
| "interoperability": { |
| "w3c_dpv": "W3C Data Privacy Vocabulary (v1.0)", |
| "iso_standards": [ |
| "ISO/IEC 27701:2019 (PIMS)", |
| "ISO/IEC 27001:2022 (ISMS)" |
| ] |
| }, |
| "controlled_vocabularies": { |
| "ProcessingOperation": { |
| "legal_basis": "Art. 4(2) GDPR", |
| "description": "Exhaustive taxonomy of data processing operations.", |
| "values": [ |
| { |
| "code": "COLLECTION", |
| "description": "Gathering personal data from data subjects or third parties." |
| }, |
| { |
| "code": "RECORDING", |
| "description": "Writing, logging, or inputting data into storage systems." |
| }, |
| { |
| "code": "ORGANISATION", |
| "description": "Structuring or categorizing data records." |
| }, |
| { |
| "code": "STRUCTURING", |
| "description": "Formatting or schema-normalizing data." |
| }, |
| { |
| "code": "STORAGE", |
| "description": "Retaining or archiving data on physical or digital media." |
| }, |
| { |
| "code": "ADAPTATION_OR_ALTERATION", |
| "description": "Modifying, transforming, or updating data." |
| }, |
| { |
| "code": "RETRIEVAL", |
| "description": "Searching, fetching, or querying stored data." |
| }, |
| { |
| "code": "CONSULTATION", |
| "description": "Viewing or reading data without modification." |
| }, |
| { |
| "code": "USE", |
| "description": "Applying data for business, analytics, or service delivery." |
| }, |
| { |
| "code": "DISCLOSURE_BY_TRANSMISSION", |
| "description": "Sending or transferring data across network boundaries." |
| }, |
| { |
| "code": "DISSEMINATION", |
| "description": "Publishing or making data broadly available to public." |
| }, |
| { |
| "code": "ALIGNMENT_OR_COMBINATION", |
| "description": "Merging datasets or cross-referencing records." |
| }, |
| { |
| "code": "RESTRICTION", |
| "description": "Marking stored data to limit future processing (Art. 4(3))." |
| }, |
| { |
| "code": "ERASURE", |
| "description": "Deleting or rendering data unrecoverable (Art. 17)." |
| }, |
| { |
| "code": "DESTRUCTION", |
| "description": "Physical or logical permanent destruction of data carriers." |
| } |
| ] |
| }, |
| "DataSensitivityLevel": { |
| "legal_basis": "Art. 4(1), Art. 9, Art. 10 GDPR", |
| "description": "Graduated hierarchy of data sensitivity for risk assessment and compliance requirements.", |
| "values": [ |
| { |
| "code": "ANONYMOUS", |
| "description": "Information that does not relate to an identified or identifiable natural person (Recital 26; GDPR exempt)." |
| }, |
| { |
| "code": "PSEUDONYMISED", |
| "description": "Data that cannot be attributed without separate key information (Art. 4(5); subject to GDPR safeguards)." |
| }, |
| { |
| "code": "STANDARD_PERSONAL_DATA", |
| "description": "Any standard identifying data (names, emails, IDs, location data)." |
| }, |
| { |
| "code": "SPECIAL_CATEGORY_ART_9", |
| "description": "Sensitive personal data prohibited by default unless Art. 9(2) exception applies." |
| }, |
| { |
| "code": "CRIMINAL_CONVICTIONS_ART_10", |
| "description": "Data relating to criminal convictions and offences; requires official authority or statutory authorisation." |
| } |
| ] |
| }, |
| "SpecialCategoryType": { |
| "legal_basis": "Art. 9(1) GDPR", |
| "description": "Statutory sub-types of special category personal data.", |
| "values": [ |
| { |
| "code": "RACIAL_OR_ETHNIC_ORIGIN", |
| "description": "Data revealing racial or ethnic origin." |
| }, |
| { |
| "code": "POLITICAL_OPINIONS", |
| "description": "Data revealing political opinions." |
| }, |
| { |
| "code": "RELIGIOUS_OR_PHILOSOPHICAL_BELIEFS", |
| "description": "Data revealing religious or philosophical beliefs." |
| }, |
| { |
| "code": "TRADE_UNION_MEMBERSHIP", |
| "description": "Data revealing trade union membership status." |
| }, |
| { |
| "code": "GENETIC_DATA", |
| "description": "Inherited or acquired genetic characteristics (Art. 4(13))." |
| }, |
| { |
| "code": "BIOMETRIC_DATA_FOR_ID", |
| "description": "Biometrics processed for unique identification (Art. 4(14))." |
| }, |
| { |
| "code": "DATA_CONCERNING_HEALTH", |
| "description": "Physical or mental health status, health services (Art. 4(15))." |
| }, |
| { |
| "code": "SEX_LIFE_OR_SEXUAL_ORIENTATION", |
| "description": "Data concerning natural person's sex life or sexual orientation." |
| } |
| ] |
| }, |
| "CrossBorderTransferMechanism": { |
| "legal_basis": "Chapter V GDPR (Art. 44-50)", |
| "description": "Legal instruments authorizing personal data transfers to third countries or international organizations.", |
| "values": [ |
| { |
| "code": "ADEQUACY_DECISION_ART_45", |
| "description": "Commission decision confirming adequate level of protection in recipient country." |
| }, |
| { |
| "code": "STANDARD_CONTRACTUAL_CLAUSES_ART_46", |
| "description": "EU Standard Contractual Clauses (SCCs) adopted by Commission." |
| }, |
| { |
| "code": "BINDING_CORPORATE_RULES_ART_47", |
| "description": "Approved BCRs within multinational group of undertakings." |
| }, |
| { |
| "code": "APPROVED_CODE_OF_CONDUCT_ART_40", |
| "description": "Adherence to approved code of conduct with binding commitments." |
| }, |
| { |
| "code": "APPROVED_CERTIFICATION_ART_42", |
| "description": "Approved certification mechanism with binding commitments." |
| }, |
| { |
| "code": "SPECIFIC_DEROGATION_ART_49", |
| "description": "Exceptional derogations (explicit consent, contract performance, public interest, legal claims)." |
| } |
| ] |
| }, |
| "LawfulBasisType": { |
| "legal_basis": "Art. 6(1) GDPR", |
| "description": "The 6 recognized legal bases to legitimize personal data processing.", |
| "values": [ |
| { |
| "code": "CONSENT_ART_6_1_A", |
| "description": "Freely given, specific, informed, unambiguous consent." |
| }, |
| { |
| "code": "CONTRACT_ART_6_1_B", |
| "description": "Necessary for performance of a contract or pre-contractual steps." |
| }, |
| { |
| "code": "LEGAL_OBLIGATION_ART_6_1_C", |
| "description": "Necessary for compliance with statutory obligation under EU/national law." |
| }, |
| { |
| "code": "VITAL_INTERESTS_ART_6_1_D", |
| "description": "Necessary to protect vital interests of data subject or natural person." |
| }, |
| { |
| "code": "PUBLIC_TASK_ART_6_1_E", |
| "description": "Necessary for public interest or exercise of official authority." |
| }, |
| { |
| "code": "LEGITIMATE_INTERESTS_ART_6_1_F", |
| "description": "Necessary for legitimate interests not overridden by individual rights (LIA required)." |
| } |
| ] |
| } |
| }, |
| "standards_mappings": [ |
| { |
| "gdpr_concept": "Controller", |
| "canonical_id": "concept-07", |
| "legal_basis": "Art. 4(7) GDPR", |
| "w3c_dpv_iri": "https://w3id.org/dpv#DataController", |
| "w3c_dpv_term": "dpv:DataController", |
| "iso_27701_clause": "Clause 7 (PII Controller Requirements)", |
| "iso_27001_mapping": "A.18.1.4 Privacy and protection of PII" |
| }, |
| { |
| "gdpr_concept": "Processor", |
| "canonical_id": "concept-08", |
| "legal_basis": "Art. 4(8) GDPR", |
| "w3c_dpv_iri": "https://w3id.org/dpv#DataProcessor", |
| "w3c_dpv_term": "dpv:DataProcessor", |
| "iso_27701_clause": "Clause 8 (PII Processor Requirements)", |
| "iso_27001_mapping": "A.15 Supplier relationships" |
| }, |
| { |
| "gdpr_concept": "Data Subject", |
| "canonical_id": "concept-01", |
| "legal_basis": "Art. 4(1) GDPR", |
| "w3c_dpv_iri": "https://w3id.org/dpv#DataSubject", |
| "w3c_dpv_term": "dpv:DataSubject", |
| "iso_27701_clause": "Clause 7.3.2 (Determining rights of PII principals)", |
| "iso_27001_mapping": "N/A" |
| }, |
| { |
| "gdpr_concept": "Personal Data", |
| "canonical_id": "concept-01", |
| "legal_basis": "Art. 4(1) GDPR", |
| "w3c_dpv_iri": "https://w3id.org/dpv#PersonalData", |
| "w3c_dpv_term": "dpv:PersonalData", |
| "iso_27701_clause": "Personally Identifiable Information (PII)", |
| "iso_27001_mapping": "A.8.2 Information classification" |
| }, |
| { |
| "gdpr_concept": "Special Categories of Personal Data", |
| "canonical_id": "concept-special-data", |
| "legal_basis": "Art. 9(1) GDPR", |
| "w3c_dpv_iri": "https://w3id.org/dpv#SpecialCategoryData", |
| "w3c_dpv_term": "dpv:SpecialCategoryData", |
| "iso_27701_clause": "Clause 7.2.4 (Sensitive PII processing)", |
| "iso_27001_mapping": "A.8.2.2 Labelling of information" |
| }, |
| { |
| "gdpr_concept": "Consent", |
| "canonical_id": "concept-11", |
| "legal_basis": "Art. 4(11), Art. 7 GDPR", |
| "w3c_dpv_iri": "https://w3id.org/dpv#Consent", |
| "w3c_dpv_term": "dpv:Consent", |
| "iso_27701_clause": "Clause 7.2.2 (Consent and choice)", |
| "iso_27001_mapping": "N/A" |
| }, |
| { |
| "gdpr_concept": "Data Protection Impact Assessment (DPIA)", |
| "canonical_id": "concept-dpia", |
| "legal_basis": "Art. 35 GDPR", |
| "w3c_dpv_iri": "https://w3id.org/dpv#DPIA", |
| "w3c_dpv_term": "dpv:DPIA", |
| "iso_27701_clause": "Clause 7.2.5 (Privacy Impact Assessment)", |
| "iso_27001_mapping": "A.12.6.1 Management of technical vulnerabilities" |
| }, |
| { |
| "gdpr_concept": "Data Protection Officer (DPO)", |
| "canonical_id": "actor-dpo", |
| "legal_basis": "Art. 37-39 GDPR", |
| "w3c_dpv_iri": "https://w3id.org/dpv#DataProtectionOfficer", |
| "w3c_dpv_term": "dpv:DataProtectionOfficer", |
| "iso_27701_clause": "Clause 6.3 (Information security roles and responsibilities)", |
| "iso_27001_mapping": "A.6.1.1 Information security roles" |
| }, |
| { |
| "gdpr_concept": "Technical and Organisational Measures (TOMs)", |
| "canonical_id": "concept-toms", |
| "legal_basis": "Art. 32 GDPR", |
| "w3c_dpv_iri": "https://w3id.org/dpv#TechnicalOrganisationalMeasure", |
| "w3c_dpv_term": "dpv:TechnicalOrganisationalMeasure", |
| "iso_27701_clause": "Clause 6.5 (Security of processing)", |
| "iso_27001_mapping": "ISO/IEC 27001 Annex A controls (A.9, A.10, A.12, A.13)" |
| }, |
| { |
| "gdpr_concept": "Personal Data Breach", |
| "canonical_id": "concept-12", |
| "legal_basis": "Art. 4(12), Art. 33-34 GDPR", |
| "w3c_dpv_iri": "https://w3id.org/dpv#DataBreach", |
| "w3c_dpv_term": "dpv:DataBreach", |
| "iso_27701_clause": "Clause 6.13 (Information security incident management)", |
| "iso_27001_mapping": "A.16.1 Management of information security incidents" |
| } |
| ], |
| "compliance_decision_triggers": { |
| "DPIA_Mandatory_Evaluation": { |
| "legal_basis": "Art. 35(3) GDPR", |
| "triggers": [ |
| { |
| "id": "TRIGGER_DPIA_PROFILING", |
| "criteria": "Systematic and extensive evaluation of personal aspects based on automated processing, including profiling, producing legal or similarly significant effects." |
| }, |
| { |
| "id": "TRIGGER_DPIA_SPECIAL_DATA", |
| "criteria": "Processing on a large scale of special categories of data (Art. 9) or criminal convictions/offences (Art. 10)." |
| }, |
| { |
| "id": "TRIGGER_DPIA_PUBLIC_MONITORING", |
| "criteria": "Systematic monitoring of a publicly accessible area on a large scale (e.g. CCTV, biometric surveillance)." |
| } |
| ] |
| }, |
| "DPO_Mandatory_Evaluation": { |
| "legal_basis": "Art. 37(1) GDPR", |
| "triggers": [ |
| { |
| "id": "TRIGGER_DPO_PUBLIC_BODY", |
| "criteria": "The processing is carried out by a public authority or public body (except courts acting in their judicial capacity)." |
| }, |
| { |
| "id": "TRIGGER_DPO_CORE_MONITORING", |
| "criteria": "Core activities consist of processing operations which, by virtue of nature, scope and/or purposes, require regular and systematic monitoring of data subjects on a large scale." |
| }, |
| { |
| "id": "TRIGGER_DPO_CORE_SENSITIVE", |
| "criteria": "Core activities consist of processing on a large scale of special categories of data pursuant to Art. 9 or data relating to criminal convictions pursuant to Art. 10." |
| } |
| ] |
| }, |
| "Breach_Escalation_Pathways": { |
| "legal_basis": "Art. 33 & 34 GDPR", |
| "pathways": [ |
| { |
| "tier": "TIER_1_INTERNAL_RECORD", |
| "risk_threshold": "Unlikely to result in risk to rights and freedoms of natural persons.", |
| "action": "Internal documentation only in breach register (facts, effects, remedial action) pursuant to Art. 33(5)." |
| }, |
| { |
| "tier": "TIER_2_DPA_NOTIFICATION", |
| "risk_threshold": "Likely to result in risk to rights and freedoms of natural persons.", |
| "action": "Notify competent Supervisory Authority without undue delay and within 72 hours (Art. 33(1))." |
| }, |
| { |
| "tier": "TIER_3_DATA_SUBJECT_COMMUNICATION", |
| "risk_threshold": "Likely to result in HIGH risk to rights and freedoms of natural persons.", |
| "action": "Communicate directly to data subjects in clear and plain language without undue delay (Art. 34(1)), unless exemptions in Art. 34(3) apply (encryption, subsequent measures, disproportionate effort)." |
| } |
| ] |
| } |
| }, |
| "node_entities": [ |
| { |
| "name": "Chapter", |
| "label": ":Chapter:GDPRNode", |
| "description": "Top-level structural division of the GDPR.", |
| "count": 11, |
| "id_pattern": "^chapter-[0-9]{2}$", |
| "attributes": [ |
| { |
| "name": "id", |
| "type": "string", |
| "required": true, |
| "example": "chapter-01" |
| }, |
| { |
| "name": "number", |
| "type": "integer", |
| "required": true, |
| "range": [ |
| 1, |
| 11 |
| ], |
| "example": 1 |
| }, |
| { |
| "name": "title", |
| "type": "string", |
| "required": true, |
| "example": "General provisions" |
| }, |
| { |
| "name": "start_article", |
| "type": "integer", |
| "required": true, |
| "range": [ |
| 1, |
| 99 |
| ], |
| "example": 1 |
| }, |
| { |
| "name": "end_article", |
| "type": "integer", |
| "required": true, |
| "range": [ |
| 1, |
| 99 |
| ], |
| "example": 4 |
| } |
| ] |
| }, |
| { |
| "name": "Article", |
| "label": ":Article:GDPRNode", |
| "description": "Statutory article containing binding legal norms, rules, and rights.", |
| "count": 99, |
| "id_pattern": "^art-[0-9]{2}$", |
| "attributes": [ |
| { |
| "name": "id", |
| "type": "string", |
| "required": true, |
| "example": "art-06" |
| }, |
| { |
| "name": "number", |
| "type": "integer", |
| "required": true, |
| "range": [ |
| 1, |
| 99 |
| ], |
| "example": 6 |
| }, |
| { |
| "name": "title", |
| "type": "string", |
| "required": true, |
| "example": "Lawfulness of processing" |
| }, |
| { |
| "name": "chapter", |
| "type": "string", |
| "required": true, |
| "foreign_key": "Chapter.id", |
| "example": "chapter-02" |
| } |
| ] |
| }, |
| { |
| "name": "Recital", |
| "label": ":Recital:GDPRNode", |
| "description": "Legislative preamble recital expressing normative purpose.", |
| "count": 173, |
| "id_pattern": "^recital-[0-9]{3}$", |
| "attributes": [ |
| { |
| "name": "id", |
| "type": "string", |
| "required": true, |
| "example": "recital-039" |
| }, |
| { |
| "name": "number", |
| "type": "integer", |
| "required": true, |
| "range": [ |
| 1, |
| 173 |
| ], |
| "example": 39 |
| }, |
| { |
| "name": "title", |
| "type": "string", |
| "required": true, |
| "example": "Principles of Data Processing" |
| } |
| ] |
| }, |
| { |
| "name": "Concept", |
| "label": ":Concept:GDPRNode", |
| "description": "Statutory term defined under Article 4 GDPR.", |
| "count": 26, |
| "id_pattern": "^concept-[0-9]{2}$", |
| "attributes": [ |
| { |
| "name": "id", |
| "type": "string", |
| "required": true, |
| "example": "concept-01" |
| }, |
| { |
| "name": "item_number", |
| "type": "integer", |
| "required": true, |
| "range": [ |
| 1, |
| 26 |
| ], |
| "example": 1 |
| }, |
| { |
| "name": "term", |
| "type": "string", |
| "required": true, |
| "example": "personal data" |
| }, |
| { |
| "name": "definition", |
| "type": "string", |
| "required": true, |
| "example": "any information relating to an identified or identifiable natural person..." |
| }, |
| { |
| "name": "aliases", |
| "type": "array<string>", |
| "required": false, |
| "example": [ |
| "data subject" |
| ] |
| } |
| ] |
| }, |
| { |
| "name": "Principle", |
| "label": ":Principle:GDPRNode", |
| "description": "Data protection principle established under Article 5.", |
| "count": 7, |
| "attributes": [ |
| { |
| "name": "id", |
| "type": "string", |
| "required": true, |
| "example": "principle-purpose-limitation" |
| }, |
| { |
| "name": "name", |
| "type": "string", |
| "required": true, |
| "example": "Purpose Limitation" |
| }, |
| { |
| "name": "legal_basis", |
| "type": "string", |
| "required": true, |
| "example": "Art. 5(1)(b) GDPR" |
| }, |
| { |
| "name": "description", |
| "type": "string", |
| "required": true, |
| "example": "Personal data shall be collected for specified, explicit and legitimate purposes..." |
| } |
| ] |
| }, |
| { |
| "name": "LawfulBasis", |
| "label": ":LawfulBasis:GDPRNode", |
| "description": "Legal ground under Article 6(1) or Article 9(2).", |
| "count": 6, |
| "attributes": [ |
| { |
| "name": "id", |
| "type": "string", |
| "required": true, |
| "example": "lawful-basis-consent" |
| }, |
| { |
| "name": "point", |
| "type": "string", |
| "required": true, |
| "example": "Art. 6(1)(a)" |
| }, |
| { |
| "name": "name", |
| "type": "string", |
| "required": true, |
| "example": "Consent" |
| }, |
| { |
| "name": "description", |
| "type": "string", |
| "required": true, |
| "example": "The data subject has given consent..." |
| } |
| ] |
| }, |
| { |
| "name": "DataSubjectRight", |
| "label": ":DataSubjectRight:GDPRNode", |
| "description": "Actionable right granted to natural persons under Articles 12-22.", |
| "count": 8, |
| "attributes": [ |
| { |
| "name": "id", |
| "type": "string", |
| "required": true, |
| "example": "right-to-erasure" |
| }, |
| { |
| "name": "name", |
| "type": "string", |
| "required": true, |
| "example": "Right to Erasure ('Right to be Forgotten')" |
| }, |
| { |
| "name": "timeline", |
| "type": "string", |
| "required": true, |
| "example": "Without undue delay (within one month)." |
| }, |
| { |
| "name": "description", |
| "type": "string", |
| "required": true, |
| "example": "Right to obtain erasure of personal data without undue delay..." |
| } |
| ] |
| }, |
| { |
| "name": "ComplianceObligation", |
| "label": ":ComplianceObligation:GDPRNode", |
| "description": "Mandated controller/processor compliance duty under Articles 24-37.", |
| "count": 9, |
| "attributes": [ |
| { |
| "name": "id", |
| "type": "string", |
| "required": true, |
| "example": "obligation-breach-notification-dpa" |
| }, |
| { |
| "name": "name", |
| "type": "string", |
| "required": true, |
| "example": "Breach Notification to Supervisory Authority" |
| }, |
| { |
| "name": "summary", |
| "type": "string", |
| "required": true, |
| "example": "Notify DPA within 72 hours of becoming aware of breach..." |
| }, |
| { |
| "name": "applies_to", |
| "type": "array<string>", |
| "required": true, |
| "example": [ |
| "Controller", |
| "Processor" |
| ] |
| } |
| ] |
| }, |
| { |
| "name": "PenaltyTier", |
| "label": ":PenaltyTier:GDPRNode", |
| "description": "Fine ceiling tier under Article 83.", |
| "count": 2, |
| "attributes": [ |
| { |
| "name": "id", |
| "type": "string", |
| "required": true, |
| "example": "penalty-tier-2" |
| }, |
| { |
| "name": "max_fine_eur", |
| "type": "integer", |
| "required": true, |
| "example": 20000000 |
| }, |
| { |
| "name": "max_percentage_turnover", |
| "type": "float", |
| "required": true, |
| "example": 4.0 |
| }, |
| { |
| "name": "summary", |
| "type": "string", |
| "required": true, |
| "example": "Basic principles, rights, cross-border transfers..." |
| } |
| ] |
| } |
| ], |
| "graph_relationships": [ |
| { |
| "relation": "CONTAINS", |
| "source": "Chapter", |
| "target": "Article", |
| "cardinality": "1-to-Many", |
| "description": "Structural containment of articles inside a chapter." |
| }, |
| { |
| "relation": "INTERPRETS", |
| "source": "Recital", |
| "target": "Article", |
| "cardinality": "Many-to-Many", |
| "description": "Preamble recital providing interpretive rationale for an article." |
| }, |
| { |
| "relation": "CITES", |
| "source": "Article", |
| "target": "Article", |
| "cardinality": "Many-to-Many", |
| "description": "Statutory cross-reference where one article explicitly cites another." |
| }, |
| { |
| "relation": "DEFINES", |
| "source": "Article", |
| "target": "Concept", |
| "cardinality": "1-to-Many", |
| "description": "Article 4 establishing canonical definitions of legal terms." |
| }, |
| { |
| "relation": "ESTABLISHES_PRINCIPLE", |
| "source": "Article", |
| "target": "Principle", |
| "cardinality": "1-to-Many", |
| "description": "Article 5 establishing data protection principles." |
| }, |
| { |
| "relation": "PROVIDES_LAWFUL_BASIS", |
| "source": "Article", |
| "target": "LawfulBasis", |
| "cardinality": "1-to-Many", |
| "description": "Article 6 establishing lawful bases for processing." |
| }, |
| { |
| "relation": "CONFERS_RIGHT", |
| "source": "Article", |
| "target": "DataSubjectRight", |
| "cardinality": "Many-to-1", |
| "description": "Articles 12-22 granting actionable rights to data subjects." |
| }, |
| { |
| "relation": "IMPOSES_OBLIGATION", |
| "source": "Article", |
| "target": "ComplianceObligation", |
| "cardinality": "1-to-1", |
| "description": "Articles 24-37 mandating compliance duties." |
| }, |
| { |
| "relation": "SANCTIONED_BY", |
| "source": "Article", |
| "target": "PenaltyTier", |
| "cardinality": "Many-to-1", |
| "description": "Article non-compliance subject to Art. 83 administrative fine ceilings." |
| }, |
| { |
| "relation": "ADDRESSES_ARTICLE", |
| "source": "KeyIssue", |
| "target": "Article", |
| "cardinality": "Many-to-Many", |
| "description": "Key Issue topical guide referencing an article." |
| } |
| ], |
| "normative_triple_schema": { |
| "description": "Standardized Subject-Predicate-Object normative tuple across all 99 articles with 4-tier legal provenance anchoring.", |
| "fields": [ |
| { |
| "name": "id", |
| "type": "string", |
| "description": "Unique identifier of the extracted triple.", |
| "example": "triple-0062" |
| }, |
| { |
| "name": "article", |
| "type": "integer", |
| "description": "Statutory article number (1-99).", |
| "example": 6 |
| }, |
| { |
| "name": "paragraph", |
| "type": "integer", |
| "description": "Paragraph index within the article.", |
| "example": 1 |
| }, |
| { |
| "name": "subparagraph", |
| "type": "string | null", |
| "description": "Subparagraph point identifier (e.g. 'a', 'b').", |
| "example": "a" |
| }, |
| { |
| "name": "sentence_index", |
| "type": "integer", |
| "description": "Sentence sequence number within the clause.", |
| "example": 1 |
| }, |
| { |
| "name": "provenance", |
| "type": "object", |
| "description": "4-tier legal provenance metadata block (ELI, CELEX, source line, SHA-256).", |
| "example": { |
| "jurisdiction": "European Union", |
| "statutory_act": "Regulation (EU) 2016/679 (GDPR)", |
| "celex": "32016R0679", |
| "official_journal": "OJ L 119, 4.5.2016, p. 1-88", |
| "eli_permalink": "http://data.europa.eu/eli/reg/2016/679/art_6/oj", |
| "gdpr_info_permalink": "https://gdpr-info.eu/art-6-gdpr/", |
| "source_file": "articles/art-06.md", |
| "source_line_number": 8, |
| "sentence_index": 1, |
| "sha256_hash": "9a310f08e7b99c7f66a87c0627e7fa60897e937d576a0d33e5c9f95fceef1234" |
| } |
| }, |
| { |
| "name": "subject", |
| "type": "object", |
| "description": "Norm addressee or actor bound by the rule.", |
| "example": { |
| "name": "Controller", |
| "id": "concept-07" |
| } |
| }, |
| { |
| "name": "modality", |
| "type": "enum", |
| "allowed_values": [ |
| "OBLIGATION", |
| "PROHIBITION", |
| "RIGHT", |
| "PERMISSION", |
| "DEFINITION", |
| "DECLARATIVE" |
| ], |
| "description": "Hohfeldian / Deontic normative modality.", |
| "example": "OBLIGATION" |
| }, |
| { |
| "name": "predicate", |
| "type": "string", |
| "description": "Operative legal verb or mandated action.", |
| "example": "notify" |
| }, |
| { |
| "name": "object", |
| "type": "object", |
| "description": "Primary regulated theme, asset, or legal concept.", |
| "example": { |
| "name": "Personal Data Breach", |
| "id": "concept-12" |
| } |
| }, |
| { |
| "name": "target_actor", |
| "type": "object | null", |
| "description": "Counterpart beneficiary or recipient actor.", |
| "example": { |
| "name": "Supervisory Authority", |
| "id": "concept-21" |
| } |
| }, |
| { |
| "name": "condition", |
| "type": "string | null", |
| "description": "Pre-condition or trigger for the legal norm to apply.", |
| "example": "In the case of a personal data breach" |
| }, |
| { |
| "name": "temporal_constraint", |
| "type": "string | null", |
| "description": "Statutory deadline, timeframe, or temporal rule.", |
| "example": "without undue delay" |
| }, |
| { |
| "name": "exception", |
| "type": "string | null", |
| "description": "Derogation or statutory exception clause.", |
| "example": "unless the personal data breach is unlikely to result in a risk..." |
| }, |
| { |
| "name": "citations", |
| "type": "array<string>", |
| "description": "Inter-article or recital statutory cross-citations.", |
| "example": [ |
| "Art. 55" |
| ] |
| }, |
| { |
| "name": "raw_text", |
| "type": "string", |
| "description": "Verbatim source sentence extracted from the GDPR.", |
| "example": "In the case of a personal data breach, the controller shall..." |
| } |
| ] |
| } |
| } |
