{
  "summary": {
    "dataAssets": 3,
    "personalDataAssets": 3,
    "restrictedAssets": 2,
    "processingActivities": 1,
    "approvedPurposes": 1,
    "approvedPias": 0,
    "activePreferences": 0,
    "openDataSubjectRequests": 0,
    "approvedVendors": 0,
    "residencyRules": 1,
    "openPrivacyIncidents": 0,
    "approvedAttestations": 0,
    "frameworks": 3,
    "controls": 8,
    "readiness": {
      "score": 61,
      "tier": "Conditional",
      "blockers": [
        {
          "code": "PIA_REQUIRED",
          "message": "1 processing activity or activities require an approved privacy impact assessment."
        }
      ],
      "warnings": [
        {
          "code": "NO_APPROVED_PRIVACY_ATTESTATIONS",
          "message": "No independently reviewed privacy-control attestation is approved."
        }
      ],
      "controlCoveragePct": 0,
      "inventoryCoveragePct": 100,
      "complianceClaimed": false,
      "legalAdviceClaimed": false
    },
    "complianceClaimed": false,
    "legalAdviceClaimed": false,
    "snapshotHash": "c746be1c0a0af6ae6bc9de33123f1c2bcb2c72cc8bf5153763968c802f37bcbc"
  },
  "dataAssets": [
    {
      "id": "data_asset_crm_contacts",
      "name": "CRM Contact and Lead Records",
      "systemName": "HDP Sales CRM",
      "ventureId": "venture_voice_agent",
      "ownerRoleId": "role_revenue_lead",
      "stewardRoleId": "role_revenue_lead",
      "classification": "CONFIDENTIAL",
      "personalData": true,
      "sensitiveData": false,
      "dataCategories": [
        "name",
        "business email",
        "business phone",
        "company",
        "interaction history"
      ],
      "subjectCategories": [
        "prospects",
        "customers"
      ],
      "sourceSystems": [
        "HDP Sales CRM"
      ],
      "storageLocations": [
        "Local governed JSON store boundary"
      ],
      "residencyRegions": [
        "US"
      ],
      "recipients": [
        "Authorized sales and management roles"
      ],
      "encryptionAtRest": true,
      "encryptionInTransit": true,
      "retentionDays": 730,
      "deletionMethod": "Governed deletion workflow",
      "minimizationNote": "Retain only contact and interaction fields needed for approved sales and service purposes.",
      "purposeIds": [],
      "vendorIds": [],
      "status": "ACTIVE",
      "createdAt": "2026-07-20T13:05:23.770Z",
      "updatedAt": "2026-07-20T13:05:23.770Z",
      "snapshotHash": "ccb82a7fec07432430830b563cb07acc40899093e0fd6af0e9d6d8864c8f089a"
    },
    {
      "id": "data_asset_voice_records",
      "name": "Voice Call Metadata and Transcripts",
      "systemName": "HDP Voice Agent Services",
      "ventureId": "venture_voice_agent",
      "ownerRoleId": "role_product_lead",
      "stewardRoleId": "role_product_lead",
      "classification": "RESTRICTED",
      "personalData": true,
      "sensitiveData": true,
      "dataCategories": [
        "call metadata",
        "transcript",
        "consent status",
        "appointment outcome"
      ],
      "subjectCategories": [
        "callers",
        "prospects",
        "customers"
      ],
      "sourceSystems": [
        "Voice Agent",
        "CRM"
      ],
      "storageLocations": [
        "Local governed record boundary"
      ],
      "residencyRegions": [
        "US"
      ],
      "recipients": [
        "Authorized service delivery and governance roles"
      ],
      "encryptionAtRest": true,
      "encryptionInTransit": true,
      "retentionDays": 180,
      "deletionMethod": "Governed deletion workflow",
      "minimizationNote": "Store only approved transcripts and metadata; redact unnecessary sensitive content.",
      "purposeIds": [],
      "vendorIds": [],
      "status": "ACTIVE",
      "createdAt": "2026-07-20T13:05:23.771Z",
      "updatedAt": "2026-07-20T13:05:23.771Z",
      "snapshotHash": "bc147d00dfb07ab17455c4282d0a9b2b4f454d0e0ceeaa823e54fc24f3a578af"
    },
    {
      "id": "data_asset_operator_identity",
      "name": "Operator Identity and Session Metadata",
      "systemName": "MBA Agent Identity Boundary",
      "ventureId": null,
      "ownerRoleId": "role_governance_lead",
      "stewardRoleId": "role_governance_lead",
      "classification": "RESTRICTED",
      "personalData": true,
      "sensitiveData": true,
      "dataCategories": [
        "operator identifier",
        "federated subject",
        "MFA assurance",
        "session metadata"
      ],
      "subjectCategories": [
        "operators"
      ],
      "sourceSystems": [
        "OIDC boundary",
        "local session manager"
      ],
      "storageLocations": [
        "Local application state"
      ],
      "residencyRegions": [
        "US"
      ],
      "recipients": [
        "Security and governance roles"
      ],
      "encryptionAtRest": true,
      "encryptionInTransit": true,
      "retentionDays": 365,
      "deletionMethod": "Governed deletion workflow",
      "minimizationNote": "Never retain upstream tokens, passwords, signing keys, or unnecessary identity claims.",
      "purposeIds": [],
      "vendorIds": [],
      "status": "ACTIVE",
      "createdAt": "2026-07-20T13:05:23.771Z",
      "updatedAt": "2026-07-20T13:05:23.771Z",
      "snapshotHash": "4195e098d5155cf87e1dc8050ed3dad0acda13aae3d9856a0d5fc85973ea1284"
    }
  ],
  "processingActivities": [
    {
      "id": "processing_voice_service_delivery",
      "name": "Voice Agent Service Delivery",
      "ventureId": "venture_voice_agent",
      "purpose": "Provide approved call intake, qualification, logging, appointment, and service-improvement workflows.",
      "purposeStatus": "APPROVED",
      "ownerRoleId": "role_product_lead",
      "dataAssetIds": [
        "data_asset_crm_contacts",
        "data_asset_voice_records"
      ],
      "subjectCategories": [
        "callers",
        "prospects",
        "customers"
      ],
      "dataCategories": [
        "contact data",
        "call metadata",
        "transcripts",
        "consent status"
      ],
      "lawfulBasis": "Contract, requested service, and management-approved legitimate business purpose subject to applicable review",
      "businessAuthority": "Approved customer engagement and service configuration",
      "recipients": [
        "Authorized delivery and governance roles"
      ],
      "vendors": [],
      "retentionDays": 180,
      "residencyRegions": [
        "US"
      ],
      "crossBorderTransfer": false,
      "transferMechanism": "",
      "automatedDecisionMaking": false,
      "automatedDecisionDescription": "",
      "largeScale": false,
      "systematicMonitoring": true,
      "vulnerableSubjectCategories": [],
      "minimizationControls": [
        "Field-level collection limits",
        "Transcript redaction boundary",
        "Retention schedule"
      ],
      "securityControls": [
        "Access control",
        "Encryption boundary",
        "Audit chain"
      ],
      "risk": {
        "score": 55,
        "tier": "MODERATE",
        "reasons": [
          "Sensitive data involved",
          "Restricted classification",
          "Systematic monitoring"
        ],
        "piaRequired": true
      },
      "piaRequired": true,
      "approvedBy": "Harrison L. Gerling II",
      "approvedAt": "2026-07-20T13:05:23.841Z",
      "approvalNote": "Approve the local demonstration processing purpose subject to customer-specific review.",
      "status": "ACTIVE",
      "createdAt": "2026-07-20T13:05:23.841Z",
      "updatedAt": "2026-07-20T13:05:23.841Z",
      "snapshotHash": "267a5366ada8a5e444e84d641b25add68c57e790016f1f7e6af3302326352afb",
      "approvalHash": "a6f56c34840a8d24adfe70d7723a76c3e08f976fb89bd24b0959a78c6679221c"
    }
  ],
  "privacyImpactAssessments": [],
  "privacyPreferences": [],
  "dataSubjectRequests": [],
  "vendorPrivacyAssessments": [],
  "dataResidencyRules": [
    {
      "id": "residency_rule_us_default",
      "name": "US Local-First Default Residency",
      "dataAssetIds": [],
      "classifications": [
        "CONFIDENTIAL",
        "RESTRICTED",
        "HIGHLY_RESTRICTED"
      ],
      "allowedRegions": [
        "US"
      ],
      "prohibitedRegions": [],
      "transferApprovalRequired": true,
      "approvedTransferMechanisms": [
        "MANAGEMENT_APPROVED_TRANSFER"
      ],
      "ownerRoleId": "role_governance_lead",
      "status": "ACTIVE",
      "createdAt": "2026-07-20T13:05:23.841Z",
      "updatedAt": "2026-07-20T13:05:23.841Z",
      "snapshotHash": "4dafa411ed45fb7fbd7d5c2f7b1159b845954d1399ec299130ef59f9c8dd83f8"
    }
  ],
  "privacyIncidentAssessments": [],
  "privacyAttestations": [],
  "privacyFrameworks": [
    {
      "id": "privacy_framework_ccpa_cpra",
      "name": "California Consumer Privacy Act / CPRA",
      "version": "Reference boundary as of v1.5",
      "status": "REFERENCE_MAPPING_ONLY",
      "complianceClaimed": false,
      "createdAt": "2026-07-20T13:05:23.771Z",
      "updatedAt": "2026-07-20T13:05:23.771Z",
      "snapshotHash": "c07a6b53da505d82ea2cbda3e52b6777adbc608b7c5fc14b43f19337887c9ad4"
    },
    {
      "id": "privacy_framework_gdpr",
      "name": "EU General Data Protection Regulation",
      "version": "Reference boundary as of v1.5",
      "status": "REFERENCE_MAPPING_ONLY",
      "complianceClaimed": false,
      "createdAt": "2026-07-20T13:05:23.771Z",
      "updatedAt": "2026-07-20T13:05:23.771Z",
      "snapshotHash": "e25810f05dfa13309ea805fcb3e306cca3ec4211cc9c7dd99a7c60032ee8024e"
    },
    {
      "id": "privacy_framework_nist",
      "name": "NIST Privacy Framework",
      "version": "1.0 reference boundary",
      "status": "REFERENCE_MAPPING_ONLY",
      "complianceClaimed": false,
      "createdAt": "2026-07-20T13:05:23.771Z",
      "updatedAt": "2026-07-20T13:05:23.771Z",
      "snapshotHash": "b353a4dab61815ea262023c95d62598047e6a31435ba3ae2ecdff7ec996573a4"
    }
  ],
  "privacyControls": [
    {
      "id": "privacy_control_inventory",
      "name": "Data inventory and classification",
      "domain": "INVENTORY",
      "ownerRoleId": "role_governance_lead",
      "status": "DESIGNED",
      "testFrequencyDays": 90,
      "mappings": [
        "privacy_framework_ccpa_cpra:NOTICE",
        "privacy_framework_gdpr:Art30",
        "privacy_framework_nist:ID.IM-P"
      ],
      "evidenceCollections": [
        "dataAssets",
        "processingActivities"
      ],
      "exceptions": [],
      "createdAt": "2026-07-20T13:05:23.771Z",
      "updatedAt": "2026-07-20T13:05:23.771Z",
      "snapshotHash": "3b9af80384edf9614e924d36f6d8487ecd12063903856bf58e1d34f6c757b682"
    },
    {
      "id": "privacy_control_purpose",
      "name": "Purpose limitation and minimization",
      "domain": "PROCESSING",
      "ownerRoleId": "role_governance_lead",
      "status": "DESIGNED",
      "testFrequencyDays": 90,
      "mappings": [
        "privacy_framework_ccpa_cpra:PURPOSE_LIMITATION",
        "privacy_framework_gdpr:Art5",
        "privacy_framework_nist:CT.PO-P"
      ],
      "evidenceCollections": [
        "processingActivities",
        "privacyImpactAssessments"
      ],
      "exceptions": [],
      "createdAt": "2026-07-20T13:05:23.771Z",
      "updatedAt": "2026-07-20T13:05:23.771Z",
      "snapshotHash": "f3a4326def55ab244cd311f031252a7d60335f36b295372bb6d71f98ab6a9850"
    },
    {
      "id": "privacy_control_preferences",
      "name": "Consent and preference governance",
      "domain": "PREFERENCES",
      "ownerRoleId": "role_revenue_lead",
      "status": "DESIGNED",
      "testFrequencyDays": 90,
      "mappings": [
        "privacy_framework_ccpa_cpra:OPT_OUT",
        "privacy_framework_gdpr:Art7",
        "privacy_framework_nist:CT.DP-P"
      ],
      "evidenceCollections": [
        "privacyPreferences"
      ],
      "exceptions": [],
      "createdAt": "2026-07-20T13:05:23.771Z",
      "updatedAt": "2026-07-20T13:05:23.771Z",
      "snapshotHash": "4a5fa710d1edf22959f272daf24a0a21e56380e4a3895976a679bd0a42d3bf89"
    },
    {
      "id": "privacy_control_dsr",
      "name": "Data-subject request operations",
      "domain": "RIGHTS",
      "ownerRoleId": "role_governance_lead",
      "status": "DESIGNED",
      "testFrequencyDays": 90,
      "mappings": [
        "privacy_framework_ccpa_cpra:CONSUMER_RIGHTS",
        "privacy_framework_gdpr:ChIII",
        "privacy_framework_nist:CT.DM-P"
      ],
      "evidenceCollections": [
        "dataSubjectRequests"
      ],
      "exceptions": [],
      "createdAt": "2026-07-20T13:05:23.771Z",
      "updatedAt": "2026-07-20T13:05:23.771Z",
      "snapshotHash": "871ab7a63ada35b200286113bd69018b9dc418fbc8a6366c24846d54efe3ae05"
    },
    {
      "id": "privacy_control_vendor",
      "name": "Vendor privacy risk",
      "domain": "THIRD_PARTY",
      "ownerRoleId": "role_governance_lead",
      "status": "DESIGNED",
      "testFrequencyDays": 90,
      "mappings": [
        "privacy_framework_ccpa_cpra:SERVICE_PROVIDER",
        "privacy_framework_gdpr:Art28",
        "privacy_framework_nist:GV.PO-P"
      ],
      "evidenceCollections": [
        "vendorPrivacyAssessments"
      ],
      "exceptions": [],
      "createdAt": "2026-07-20T13:05:23.771Z",
      "updatedAt": "2026-07-20T13:05:23.771Z",
      "snapshotHash": "109d92f2bf776dc197c3e851d3b3b3f5a116e18774b3952e0b4850c4760ac4ee"
    },
    {
      "id": "privacy_control_residency",
      "name": "Residency and transfer governance",
      "domain": "RESIDENCY",
      "ownerRoleId": "role_product_lead",
      "status": "DESIGNED",
      "testFrequencyDays": 90,
      "mappings": [
        "privacy_framework_ccpa_cpra:DISCLOSURE",
        "privacy_framework_gdpr:ChV",
        "privacy_framework_nist:GV.DE-P"
      ],
      "evidenceCollections": [
        "dataResidencyRules",
        "processingActivities"
      ],
      "exceptions": [],
      "createdAt": "2026-07-20T13:05:23.771Z",
      "updatedAt": "2026-07-20T13:05:23.771Z",
      "snapshotHash": "52c1c222fac26a6f44fab99672849f2b779ad90c77bd010362738abe305890cf"
    },
    {
      "id": "privacy_control_breach",
      "name": "Privacy incident and notification assessment",
      "domain": "INCIDENT",
      "ownerRoleId": "role_governance_lead",
      "status": "DESIGNED",
      "testFrequencyDays": 90,
      "mappings": [
        "privacy_framework_ccpa_cpra:BREACH",
        "privacy_framework_gdpr:Art33-34",
        "privacy_framework_nist:PR.IR-P"
      ],
      "evidenceCollections": [
        "privacyIncidentAssessments",
        "securityIncidents"
      ],
      "exceptions": [],
      "createdAt": "2026-07-20T13:05:23.771Z",
      "updatedAt": "2026-07-20T13:05:23.771Z",
      "snapshotHash": "68c56d60df2d0d19872048cae04cefcb0ecabc50866530474d34b42b2b60634f"
    },
    {
      "id": "privacy_control_attestation",
      "name": "Privacy control attestation",
      "domain": "ASSURANCE",
      "ownerRoleId": "role_owner",
      "status": "DESIGNED",
      "testFrequencyDays": 90,
      "mappings": [
        "privacy_framework_ccpa_cpra:ACCOUNTABILITY",
        "privacy_framework_gdpr:Art24",
        "privacy_framework_nist:GV.AT-P"
      ],
      "evidenceCollections": [
        "privacyAttestations"
      ],
      "exceptions": [],
      "createdAt": "2026-07-20T13:05:23.771Z",
      "updatedAt": "2026-07-20T13:05:23.771Z",
      "snapshotHash": "68d9eaa564dafbc05ad453286672586777c72e6158e717f071b9d46157f531c7"
    }
  ]
}