steps

index.html

@@ -127,7 +127,7 @@
           items: [
             {
               k: "1a",
-              label: "(a) Set pathway & roles (controller/joint).",
+              label: "Set pathway & roles (controller/joint).",
               req: true,
               refs: [
                 { title: "GDPR Art. 4 (defs) & Art. 4(7) (controller)", url: "https://gdpr-info.eu/art-4-gdpr/" },
@@ -137,7 +137,7 @@
             },
             {
               k: "1b",
-              label: "(b) Record data status: personal / special / anonymised.",
+              label: "Record data status: personal / special / anonymised.",
               req: true,
               refs: [
                 { title: "GDPR Art. 9(1) (special categories)", url: "https://gdpr-info.eu/art-9-gdpr/" },
@@ -147,7 +147,7 @@
             },
             {
               k: "1c",
-              label: "(c) Note purpose & apply minimisation.",
+              label: "Note purpose & apply minimisation.",
               req: true,
               refs: [
                 { title: "GDPR Art. 5(1)(b)-(c) (purpose/minimisation)", url: "https://gdpr-info.eu/art-5-gdpr/" }
@@ -155,7 +155,7 @@
             },
             {
               k: "1d",
-              label: "(d) If research: check HRA scope; REK decides.",
+              label: "If research: check HRA scope; REK decides.",
               req: true,
               refs: [
                 { title: "HRA §2, §4 (scope/defs)", url: "https://lovdata.no/lov/2008-06-20-44/%C2%A72" },
@@ -165,7 +165,7 @@
             },
             {
               k: "1e",
-              label: "(e) Using registries? Note registry rules.",
+              label: "Using registries? Note registry rules.",
               req: false,
               refs: [
                 { title: "HRL (Helseregisterloven)", url: "https://lovdata.no/dokument/NL/lov/2014-06-20-43" }
@@ -174,7 +174,7 @@
             },
             {
               k: "1f",
-              label: "(f) Get DPO advice; keep rationale.",
+              label: "Get DPO advice; keep rationale.",
               req: true,
               refs: [
                 { title: "GDPR Art. 5(2) (accountability)", url: "https://gdpr-info.eu/art-5-gdpr/" },
@@ -183,7 +183,7 @@
             },
             {
               k: "1g",
-              label: "(g) DPIA screening (high risk?).",
+              label: "DPIA screening (high risk?).",
               req: true,
               refs: [
                 { title: "GDPR Art. 35 (DPIA)", url: "https://gdpr-info.eu/art-35-gdpr/" }
@@ -198,24 +198,17 @@
           items: [
             {
               k: "2a",
-              label: "(a) Set GDPR Art. 6 basis (e.g., 6(1)(e)).",
-              req: true,
-              refs: [
-                { title: "GDPR Art. 6(1) (lawful basis)", url: "https://gdpr-info.eu/art-6-gdpr/" }
-              ],
-            },
-            {
-              k: "2b",
-              label: "(b) Set Art. 9(2) condition (h/j) + Art. 89(1) safeguards.",
+              label: "Set a legal basic amoung public interest/official authority, research/statistics with safeguards, healthcare/management/QI)",
               req: true,
               refs: [
+                { title: "GDPR Art. 6(1) (lawful basis)", url: "https://gdpr-info.eu/art-6-gdpr/" },
                 { title: "GDPR Art. 9(2)(h)/(j)", url: "https://gdpr-info.eu/art-9-gdpr/" },
                 { title: "GDPR Art. 89(1) (safeguards)", url: "https://gdpr-info.eu/art-89-gdpr/" }
               ],
             },
             {
               k: "2c",
-              label: "(c) If using consent: valid, informed, withdrawable.",
+              label: "If using consent: valid, informed, withdrawable.",
               req: false,
               refs: [
                 { title: "GDPR Art. 7 (consent)", url: "https://gdpr-info.eu/art-7-gdpr/" },
@@ -225,7 +218,7 @@
             },
             {
               k: "2d",
-              label: "(d) Health-law confidentiality/dispensation handled.",
+              label: "Health-law confidentiality/dispensation handled.",
               req: true,
               refs: [
                 { title: "HPA §21 (confidentiality)", url: "https://lovdata.no/lov/1999-07-02-64/%C2%A721" },
@@ -235,7 +228,7 @@
             },
             {
               k: "2e",
-              label: "(e) Non-care record access lawful & logged.",
+              label: "Non-care record access lawful & logged.",
               req: true,
               refs: [
                 { title: "PRA §22 (security/logging)", url: "https://lovdata.no/lov/2014-06-20-42/%C2%A722" },
@@ -244,7 +237,7 @@
             },
             {
               k: "2f",
-              label: "(f) Purpose limitation documented.",
+              label: "Purpose limitation documented.",
               req: true,
               refs: [
                 { title: "GDPR Art. 5(1)(b) (purpose limitation)", url: "https://gdpr-info.eu/art-5-gdpr/" }
@@ -259,7 +252,7 @@
           items: [
             {
               k: "3a",
-              label: "(a) REK approval/confirmation (before access).",
+              label: "REK approval/confirmation (before access).",
               req: true,
               showFor: ["research"],
               refs: [
@@ -269,7 +262,7 @@
             },
             {
               k: "3b",
-              label: "(b) Registry conditions addressed.",
+              label: "Registry conditions addressed.",
               req: true,
               showFor: ["statistics", "research"],
               refs: [
@@ -279,7 +272,7 @@
             },
             {
               k: "3c",
-              label: "(c) QI/other: internal governance in place.",
+              label: "QI/other: internal governance in place.",
               req: true,
               showFor: ["quality", "other"],
               refs: [
@@ -288,7 +281,7 @@
             },
             {
               k: "3d",
-              label: "(d) For AI: plan obligations (risk, data, docs, oversight).",
+              label: "For AI: plan obligations (risk, data, docs, oversight).",
               req: true,
               showFor: ["innovation"],
               refs: [
@@ -297,7 +290,7 @@
             },
             {
               k: "3e",
-              label: "(e) RoPA & transparency notices ready.",
+              label: "RoPA & transparency notices ready.",
               req: true,
               refs: [
                 { title: "GDPR Art. 30 (RoPA)", url: "https://gdpr-info.eu/art-30-gdpr/" },
@@ -313,7 +306,7 @@
           items: [
             {
               k: "4a",
-              label: "(a) Access route confirmed (e.g., Helsedataservice).",
+              label: "Access route confirmed (e.g., Helsedataservice).",
               req: true,
               refs: [
                 { title: "Helsedataservice", url: "https://helsedata.no/" },
@@ -324,7 +317,7 @@
             },
             {
               k: "4b",
-              label: "(b) Contracts in place (DPA/DSA/DUA; joint/processor).",
+              label: "Contracts in place (DPA/DSA/DUA; joint/processor).",
               req: true,
               refs: [
                 { title: "GDPR Art. 28(3) (processor contract)", url: "https://gdpr-info.eu/art-28-gdpr/" },
@@ -333,7 +326,7 @@
             },
             {
               k: "4c",
-              label: "(c) Access control & logging set.",
+              label: "Access control & logging set.",
               req: true,
               refs: [
                 { title: "GDPR Art. 32 (security)", url: "https://gdpr-info.eu/art-32-gdpr/" },
@@ -343,7 +336,7 @@
             },
             {
               k: "4d",
-              label: "(d) Team confidentiality/training signed.",
+              label: "Team confidentiality/training signed.",
               req: true,
               refs: [
                 { title: "HPA §21 (duty of confidentiality)", url: "https://lovdata.no/lov/1999-07-02-64/%C2%A721" }
@@ -351,7 +344,7 @@
             },
             {
               k: "4e",
-              label: "(e) Secure transfer to analysis environment.",
+              label: "Secure transfer to analysis environment.",
               req: true,
               refs: [
                 { title: "GDPR Art. 32 (security)", url: "https://gdpr-info.eu/art-32-gdpr/" },
@@ -360,7 +353,7 @@
             },
             {
               k: "4f",
-              label: "(f) Sharing datasets/AI models lawfully permitted.",
+              label: "Sharing datasets/AI models lawfully permitted.",
               req: false,
               refs: [
                 { title: "AI Act Art. 2(7) (scope)", url: "https://ai-act-law.eu/article/2/" },
@@ -371,10 +364,10 @@
             },
             {
               k: "4g",
-              label: "(g) EHDS alignment (if cross-border/secondary use).",
+              label: "EHDS alignment (if cross-border/secondary use).",
               req: false,
               refs: [
-                { title: "EHDS (OJ L_202500327)", url: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202500327" }
+                { title: "EHDS", url: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202500327" }
               ],
             },
           ],
@@ -386,7 +379,7 @@
           items: [
             {
               k: "5a",
-              label: "(a) Pseudonymise; keep keys separate.",
+              label: "Pseudonymise; keep keys separate.",
               req: true,
               refs: [
                 { title: "GDPR Art. 4(5) (pseudonymisation)", url: "https://gdpr-info.eu/art-4-gdpr/" }
@@ -394,7 +387,7 @@
             },
             {
               k: "5b",
-              label: "(b) Encryption, RBAC, MFA, network safeguards, logging.",
+              label: "Encryption, RBAC, MFA, network safeguards, logging.",
               req: true,
               refs: [
                 { title: "GDPR Art. 32 (security)", url: "https://gdpr-info.eu/art-32-gdpr/" },
@@ -404,7 +397,7 @@
             },
             {
               k: "5c",
-              label: "(c) Derived data protected equally.",
+              label: "Derived data protected equally.",
               req: true,
               refs: [
                 { title: "GDPR Art. 5(1)(f); Art. 32", url: "https://gdpr-info.eu/art-5-gdpr/" }
@@ -412,7 +405,7 @@
             },
             {
               k: "5d",
-              label: "(d) DPIA done/recorded; DPO consulted as needed.",
+              label: "DPIA done/recorded; DPO consulted as needed.",
               req: true,
               refs: [
                 { title: "GDPR Art. 35 (DPIA)", url: "https://gdpr-info.eu/art-35-gdpr/" },
@@ -421,7 +414,7 @@
             },
             {
               k: "5e",
-              label: "(e) Transfers outside EEA lawful (adequacy/SCC/derog.).",
+              label: "Transfers outside EEA lawful (adequacy/SCC/derog.).",
               req: true,
               refs: [
                 { title: "GDPR Arts. 44–46 (transfers/SCCs)", url: "https://gdpr-info.eu/chapter-5/" },
@@ -430,7 +423,7 @@
             },
             {
               k: "5f",
-              label: "(f) Vendor/processor DPAs signed.",
+              label: "Vendor/processor DPAs signed.",
               req: true,
               refs: [
                 { title: "GDPR Art. 28 (processors)", url: "https://gdpr-info.eu/art-28-gdpr/" }
@@ -438,7 +431,7 @@
             },
             {
               k: "5g",
-              label: "(g) Breach plan & notify (72h) if required.",
+              label: "Breach plan & notify (72h) if required.",
               req: true,
               refs: [
                 { title: "GDPR Art. 33–34 (breach/notify)", url: "https://gdpr-info.eu/art-33-gdpr/" }
@@ -446,7 +439,7 @@
             },
             {
               k: "5h",
-              label: "(h) Periodic security review.",
+              label: "Periodic security review.",
               req: true,
               refs: [],
             },
@@ -459,7 +452,7 @@
           items: [
             {
               k: "6a",
-              label: "(a) Extract only necessary/approved fields.",
+              label: "Extract only necessary/approved fields.",
               req: true,
               refs: [
                 { title: "GDPR Art. 5(1)(b)-(c)", url: "https://gdpr-info.eu/art-5-gdpr/" }
@@ -467,7 +460,7 @@
             },
             {
               k: "6b",
-              label: "(b) Sweep extracts for unexpected content.",
+              label: "Sweep extracts for unexpected content.",
               req: true,
               refs: [
                 { title: "GDPR Art. 5(1)(c); Art. 25", url: "https://gdpr-info.eu/art-25-gdpr/" }
@@ -475,7 +468,7 @@
             },
             {
               k: "6c",
-              label: "(c) For AI: bias audits & data governance.",
+              label: "For AI: bias audits & data governance.",
               req: true,
               showFor: ["innovation"],
               refs: [
@@ -485,7 +478,7 @@
             },
             {
               k: "6d",
-              label: "(d) Plan periodic data quality reviews.",
+              label: "Plan periodic data quality reviews.",
               req: true,
               refs: [
                 { title: "GDPR Art. 5(1)(d) (accuracy); Art. 5(2)", url: "https://gdpr-info.eu/art-5-gdpr/" }
@@ -500,7 +493,7 @@
           items: [
             {
               k: "7a",
-              label: "(a) Use validated tools; no re-ID unless authorised.",
+              label: "Use validated tools; no re-ID unless authorised.",
               req: true,
               refs: [
                 { title: "GDPR Art. 5(1)(a)-(b)", url: "https://gdpr-info.eu/art-5-gdpr/" }
@@ -508,7 +501,7 @@
             },
             {
               k: "7b",
-              label: "(b) Keep preprocessing & tech docs/records.",
+              label: "Keep preprocessing & tech docs/records.",
               req: true,
               refs: [
                 { title: "AI Act Art. 10 (data); Art. 11 (tech docs); Art. 12 (records)", url: "https://ai-act-law.eu/article/10/" },
@@ -520,7 +513,7 @@
             },
             {
               k: "7c",
-              label: "(c) AI risk classification documented.",
+              label: "AI risk classification documented.",
               req: true,
               showFor: ["innovation"],
               refs: [
@@ -530,7 +523,7 @@
             },
             {
               k: "7d",
-              label: "(d) High-risk: controls, oversight, validation, cybersecurity.",
+              label: "High-risk: controls, oversight, validation, cybersecurity.",
               req: true,
               showFor: ["innovation"],
               refs: [
@@ -539,7 +532,7 @@
             },
             {
               k: "7e",
-              label: "(e) Non-high-risk: good practice / voluntary codes.",
+              label: "Non-high-risk: good practice / voluntary codes.",
               req: false,
               showFor: ["innovation"],
               refs: [
@@ -548,7 +541,7 @@
             },
             {
               k: "7f",
-              label: "(f) If placing on EU market: conformity/CE/AI DB.",
+              label: "If placing on EU market: conformity/CE/AI DB.",
               req: false,
               showFor: ["innovation"],
               refs: [
@@ -557,7 +550,7 @@
             },
             {
               k: "7g",
-              label: "(g) Bias mitigation & fairness checks documented.",
+              label: "Bias mitigation & fairness checks documented.",
               req: true,
               showFor: ["innovation"],
               refs: [
@@ -567,7 +560,7 @@
             },
             {
               k: "7h",
-              label: "(h) Plan periodic reassessment/review.",
+              label: "Plan periodic reassessment/review.",
               req: true,
               refs: [],
             },
@@ -580,7 +573,7 @@
           items: [
             {
               k: "8a",
-              label: "(a) Internal audit done; issues remediated.",
+              label: "Internal audit done; issues remediated.",
               req: true,
               refs: [
                 { title: "GDPR Art. 5(2) (accountability); Art. 24", url: "https://gdpr-info.eu/art-24-gdpr/" }
@@ -588,13 +581,13 @@
             },
             {
               k: "8b",
-              label: "(b) Maintain compliance report (docs/approvals).",
+              label: "Maintain compliance report (docs/approvals).",
               req: true,
               refs: [],
             },
             {
               k: "8c",
-              label: "(c) Source-system extractions logged; periodic log review.",
+              label: "Source-system extractions logged; periodic log review.",
               req: true,
               refs: [
                 { title: "PRA §22; PRR §14; Normen 5.4.4", url: "https://lovdata.no/forskrift/2019-03-01-168/%C2%A714" }
@@ -602,7 +595,7 @@
             },
             {
               k: "8d",
-              label: "(d) Use only within approvals; amend before new use.",
+              label: "Use only within approvals; amend before new use.",
               req: true,
               refs: [
                 { title: "GDPR Art. 5(1)(b) (purpose); HRA §33", url: "https://gdpr-info.eu/art-5-gdpr/" }
@@ -610,7 +603,7 @@
             },
             {
               k: "8e",
-              label: "(e) Periodically update audit/compliance process.",
+              label: "Periodically update audit/compliance process.",
               req: true,
               refs: [],
             },
@@ -623,7 +616,7 @@
           items: [
             {
               k: "9a",
-              label: "(a) Disclosure control OK (no IDs in outputs).",
+              label: "Disclosure control OK (no IDs in outputs).",
               req: true,
               refs: [
                 { title: "GDPR Art. 5(1)(c); Art. 89(1)", url: "https://gdpr-info.eu/art-89-gdpr/" }
@@ -631,7 +624,7 @@
             },
             {
               k: "9b",
-              label: "(b) Publications: ethics/DP statements; AI transparency.",
+              label: "Publications: ethics/DP statements; AI transparency.",
               req: false,
               refs: [
                 { title: "AI Act Art. 13 (transparency)", url: "https://ai-act-law.eu/article/13/" }
@@ -639,7 +632,7 @@
             },
             {
               k: "9c",
-              label: "(c) Required reports submitted (REK/registries/AI DB).",
+              label: "Required reports submitted (REK/registries/AI DB).",
               req: false,
               refs: [
                 { title: "AI Act Chapter III (registering duties)", url: "https://ai-act-law.eu/chapter/3/" }
@@ -647,7 +640,7 @@
             },
             {
               k: "9d",
-              label: "(d) Delete/anonymise at retention end; document.",
+              label: "Delete/anonymise at retention end; document.",
               req: true,
               refs: [
                 { title: "GDPR Art. 5(1)(e); Art. 5(2)", url: "https://gdpr-info.eu/art-5-gdpr/" }
@@ -655,7 +648,7 @@
             },
             {
               k: "9e",
-              label: "(e) Archive key docs securely (no raw IDs).",
+              label: "Archive key docs securely (no raw IDs).",
               req: true,
               refs: [
                 { title: "GDPR Art. 5(1)(e); Art. 89(1)", url: "https://gdpr-info.eu/art-89-gdpr/" }
@@ -663,7 +656,7 @@
             },
             {
               k: "9f",
-              label: "(f) If retain/reuse: set new legal basis/approvals.",
+              label: "If retain/reuse: set new legal basis/approvals.",
               req: true,
               refs: [
                 { title: "GDPR Art. 6(1); Art. 9(2)", url: "https://gdpr-info.eu/art-6-gdpr/" },
@@ -673,7 +666,7 @@
             },
             {
               k: "9g",
-              label: "(g) Final debrief; notify closure; update RoPA.",
+              label: "Final debrief; notify closure; update RoPA.",
               req: true,
               refs: [
                 { title: "GDPR Art. 30 (RoPA)", url: "https://gdpr-info.eu/art-30-gdpr/" }
@@ -681,7 +674,7 @@
             },
             {
               k: "9h",
-              label: "(h) If AI continues: monitor; if stopped: purge artifacts.",
+              label: "If AI continues: monitor; if stopped: purge artifacts.",
               req: false,
               showFor: ["innovation"],
               refs: [