{"inputSchema":{"type":"object","required":["controller","activities"],"additionalProperties":false,"properties":{"controller":{"type":"object","additionalProperties":false,"description":"The controller — Article 30(1)(a). Required.","required":["name"],"properties":{"name":{"type":"string","minLength":1,"maxLength":300,"description":"Legal name of the body."},"address":{"type":"string","maxLength":500,"description":"Postal address as one line."},"email":{"type":"string","maxLength":200,"description":"Contact mailbox of the body. A functional address, not a person."},"phone":{"type":"string","maxLength":60,"description":"Contact number of the body."}}},"representative":{"type":"object","additionalProperties":false,"description":"The representative under Article 27, where one is appointed. Article 30(1)(a).","required":["name"],"properties":{"name":{"type":"string","minLength":1,"maxLength":300,"description":"Legal name of the body."},"address":{"type":"string","maxLength":500,"description":"Postal address as one line."},"email":{"type":"string","maxLength":200,"description":"Contact mailbox of the body. A functional address, not a person."},"phone":{"type":"string","maxLength":60,"description":"Contact number of the body."}}},"dpo":{"type":"object","additionalProperties":false,"description":"The data protection officer, where one is appointed. Article 30(1)(a).","required":["name"],"properties":{"name":{"type":"string","minLength":1,"maxLength":300,"description":"Legal name of the body."},"address":{"type":"string","maxLength":500,"description":"Postal address as one line."},"email":{"type":"string","maxLength":200,"description":"Contact mailbox of the body. A functional address, not a person."},"phone":{"type":"string","maxLength":60,"description":"Contact number of the body."}}},"joint_controllers":{"type":"array","maxItems":20,"description":"Joint controllers under Article 26, where there are any. Article 30(1)(a).","items":{"type":"object","additionalProperties":false,"description":"One joint controller.","required":["name"],"properties":{"name":{"type":"string","minLength":1,"maxLength":300,"description":"Legal name of the body."},"address":{"type":"string","maxLength":500,"description":"Postal address as one line."},"email":{"type":"string","maxLength":200,"description":"Contact mailbox of the body. A functional address, not a person."},"phone":{"type":"string","maxLength":60,"description":"Contact number of the body."}}}},"activities":{"type":"array","minItems":1,"maxItems":100,"description":"One entry per processing activity. This is an inventory of activities, not a log of events.","items":{"type":"object","required":["name","purposes"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":1,"maxLength":200,"description":"Short label of the activity, e.g. \"Payroll\" or \"Applicant management\"."},"purposes":{"type":"array","minItems":1,"maxItems":20,"description":"Article 30(1)(b). One purpose per entry, in your own words.","items":{"type":"string","minLength":1,"maxLength":500}},"legal_basis":{"type":"array","maxItems":6,"description":"Which of Article 6(1)(a) to (f) you rely on. Your statement — it is recorded, not chosen or checked here.","items":{"type":"string","enum":["art6_1_a_consent","art6_1_b_contract","art6_1_c_legal_obligation","art6_1_d_vital_interests","art6_1_e_public_task","art6_1_f_legitimate_interests"]}},"legitimate_interests_description":{"type":"string","maxLength":2000,"description":"The interests relied on, where art6_1_f_legitimate_interests is named. Recorded as stated; no balancing test is performed here."},"special_category_basis":{"type":"array","maxItems":8,"description":"Which of Article 9(2) you rely on, where special categories of data are processed.","items":{"type":"string","enum":["art9_2_a_explicit_consent","art9_2_b_employment_law","art9_2_c_vital_interests","art9_2_f_legal_claims","art9_2_g_substantial_public_interest","art9_2_h_health_care","art9_2_i_public_health","art9_2_j_archiving_research"]}},"data_subject_categories":{"type":"array","maxItems":30,"description":"Article 30(1)(c), first half. Categories, e.g. \"employees\", \"applicants\" — never individuals.","items":{"type":"string","minLength":1,"maxLength":200}},"data_categories":{"type":"array","maxItems":60,"description":"Article 30(1)(c), second half. Categories, e.g. \"contact data\", \"payroll data\" — never values.","items":{"type":"string","minLength":1,"maxLength":200}},"special_categories":{"type":"array","maxItems":12,"description":"Which special categories under Article 9(1) occur, if any.","items":{"type":"string","enum":["racial_or_ethnic_origin","political_opinions","religious_or_philosophical_beliefs","trade_union_membership","genetic_data","biometric_data","health_data","sex_life_or_orientation"]}},"recipient_categories":{"type":"array","maxItems":40,"description":"Article 30(1)(d). Categories of recipients, e.g. \"payroll provider\", \"tax authority\".","items":{"type":"string","minLength":1,"maxLength":300}},"third_country_transfers":{"type":"array","maxItems":30,"description":"Article 30(1)(e). One entry per destination outside your own establishment. Destinations inside the EEA are recorded and marked as such.","items":{"type":"object","required":["country_code"],"additionalProperties":false,"properties":{"country_code":{"type":"string","minLength":2,"maxLength":2,"description":"ISO 3166-1 alpha-2, uppercase, e.g. US."},"recipient_category":{"type":"string","maxLength":300,"description":"Category of recipient in that country."},"safeguard":{"type":"string","enum":["adequacy_decision_art45","scc_art46_2_c","bcr_art47","codes_of_conduct_art46_2_e","certification_art46_2_f","derogation_art49","none_stated"],"description":"The safeguard you rely on under Article 46 or 49. Recorded as stated."},"safeguard_reference":{"type":"string","maxLength":500,"description":"Where the safeguard is documented, e.g. a contract reference. Recorded, not retrieved."}}}},"retention_period_days":{"type":"integer","minimum":0,"maximum":36525,"description":"Article 30(1)(f). Erasure period in days, where a fixed one applies. Unit is in the name: days."},"retention_criteria":{"type":"string","maxLength":2000,"description":"Article 30(1)(f). The criteria for erasure where no fixed period applies, e.g. \"six years after the end of the contract year\"."},"security_measures":{"type":"array","maxItems":40,"description":"Article 30(1)(g). General description of the technical and organisational measures under Article 32(1).","items":{"type":"string","minLength":1,"maxLength":500}},"systems":{"type":"array","maxItems":40,"description":"The systems the activity runs in. Not required by Article 30; carried through because a record without systems is hard to maintain.","items":{"type":"string","minLength":1,"maxLength":200}},"processors":{"type":"array","maxItems":40,"description":"Processors under Article 28. Not required by Article 30(1); carried through unchanged.","items":{"type":"string","minLength":1,"maxLength":300}}}}},"record_language":{"type":"string","enum":["de","en"],"default":"de","description":"Language of the article texts printed beside each letter. Your own wording is never translated."}}},"outputSchema":{"type":"object"},"priceModel":null,"requestExample":{"controller":{"name":"Nordlicht GmbH","address":"Hafenstrasse 4, 20359 Hamburg","email":"datenschutz@nordlicht.example"},"dpo":{"name":"Anna Berger","email":"dsb@nordlicht.example"},"activities":[{"name":"Personalverwaltung","purposes":["Durchfuehrung des Arbeitsverhaeltnisses","Lohnabrechnung"],"legal_basis":["art6_1_b_contract","art6_1_c_legal_obligation"],"data_subject_categories":["Beschaeftigte","Bewerberinnen und Bewerber"],"data_categories":["Stammdaten","Vertragsdaten","Abrechnungsdaten"],"recipient_categories":["Lohnbuero","Finanzamt","Sozialversicherungstraeger"],"retention_period_days":3650,"retention_criteria":"Zehn Jahre nach Ende des Arbeitsverhaeltnisses wegen handels- und steuerrechtlicher Aufbewahrungspflichten.","security_measures":["Rollenbasierte Zugriffsrechte","Verschluesselung im Ruhezustand","Protokollierung administrativer Zugriffe"],"systems":["HR-Suite"]},{"name":"Newsletter","purposes":["Versand des Kundennewsletters"],"legal_basis":["art6_1_a_consent"],"data_subject_categories":["Newsletter-Abonnenten"],"data_categories":["Kontaktdaten","Einwilligungsnachweis"],"recipient_categories":["Versanddienstleister"],"third_country_transfers":[{"country_code":"US","recipient_category":"Versanddienstleister","safeguard":"scc_art46_2_c","safeguard_reference":"Auftragsverarbeitungsvertrag 2026-014, Anlage 2"}],"retention_criteria":"Bis zum Widerruf der Einwilligung, danach Loeschung binnen 30 Tagen.","security_measures":["Double-Opt-in","Zugriff nur ueber Zwei-Faktor-Anmeldung"],"systems":["Mailversand"]}]},"price_usdc":"0.004"}