{
  "$schema": "https://openinherit.org/reference-data/data-protection-rules-schema.json",
  "version": "1.0.0",
  "lastUpdated": "2026-03-26",
  "description": "Per-jurisdiction data protection constraints for estate data handling",
  "rules": [
    {
      "jurisdiction": "GB-ENG",
      "framework": "UK GDPR + Data Protection Act 2018",
      "specialCategories": ["religion", "health", "ethnicity"],
      "consentMechanism": "explicit_consent",
      "retentionPeriod": "Duration of estate planning relationship + 6 years (Limitation Act 1980)",
      "crossBorderTransfer": "UK adequacy decisions apply; Standard Contractual Clauses for non-adequate countries",
      "rightToErasure": true,
      "dataPortability": true,
      "notes": "INHERIT export satisfies GDPR Article 20 data portability requirement (structured, machine-readable, commonly used format)"
    },
    {
      "jurisdiction": "GB-SCT",
      "framework": "UK GDPR + Data Protection Act 2018",
      "specialCategories": ["religion", "health", "ethnicity"],
      "consentMechanism": "explicit_consent",
      "retentionPeriod": "Duration of estate planning relationship + 5 years (Prescription and Limitation (Scotland) Act 1973)",
      "crossBorderTransfer": "UK adequacy decisions apply",
      "rightToErasure": true,
      "dataPortability": true,
      "notes": "Scottish limitation periods differ from England & Wales"
    },
    {
      "jurisdiction": "IE",
      "framework": "EU GDPR",
      "specialCategories": ["religion", "health", "ethnicity"],
      "consentMechanism": "explicit_consent",
      "retentionPeriod": "Duration of relationship + 6 years (Statute of Limitations 1957)",
      "crossBorderTransfer": "EU adequacy decisions; SCCs for third countries",
      "rightToErasure": true,
      "dataPortability": true,
      "notes": "DPC (Data Protection Commission) is supervisory authority"
    },
    {
      "jurisdiction": "US-NY",
      "framework": "No comprehensive federal privacy law; NY SHIELD Act; sector-specific (GLBA for financial data)",
      "specialCategories": ["financial", "health"],
      "consentMechanism": "opt_out",
      "retentionPeriod": "Varies by data type; typically 6-7 years for financial records",
      "crossBorderTransfer": "No general restriction; sector-specific rules apply",
      "rightToErasure": false,
      "dataPortability": false,
      "notes": "US lacks equivalent to GDPR. State-by-state privacy landscape."
    },
    {
      "jurisdiction": "CA-ON",
      "framework": "PIPEDA (federal) + Ontario specific requirements",
      "specialCategories": ["health", "financial"],
      "consentMechanism": "meaningful_consent",
      "retentionPeriod": "Only as long as necessary for the purpose; typically 6-7 years for legal records",
      "crossBorderTransfer": "Permitted with comparable protection; accountability principle",
      "rightToErasure": true,
      "dataPortability": false,
      "notes": "Bill C-27 (CPPA) may introduce enhanced rights when enacted"
    },
    {
      "jurisdiction": "AU-NSW",
      "framework": "Privacy Act 1988 (Cth) + Australian Privacy Principles",
      "specialCategories": ["health", "religion", "ethnicity"],
      "consentMechanism": "consent",
      "retentionPeriod": "Only as long as needed; destroy or de-identify when no longer required",
      "crossBorderTransfer": "APP 8 — reasonable steps to ensure overseas recipient complies with APPs",
      "rightToErasure": true,
      "dataPortability": false,
      "notes": "Privacy Act Review 2023 proposed enhanced rights; status pending"
    },
    {
      "jurisdiction": "SG",
      "framework": "Personal Data Protection Act 2012 (PDPA)",
      "specialCategories": ["health", "financial"],
      "consentMechanism": "consent",
      "retentionPeriod": "Only as long as necessary; cease retention when purpose no longer served",
      "crossBorderTransfer": "Permitted with comparable protection or consent",
      "rightToErasure": true,
      "dataPortability": true,
      "notes": "Data Portability Obligation effective Feb 2022"
    },
    {
      "jurisdiction": "AE",
      "framework": "Federal Decree-Law No. 45/2021 (PDPL)",
      "specialCategories": ["health", "religion", "ethnicity"],
      "consentMechanism": "explicit_consent",
      "retentionPeriod": "Only as long as necessary for the purpose",
      "crossBorderTransfer": "Adequate protection required; free zones may have separate rules",
      "rightToErasure": true,
      "dataPortability": true,
      "notes": "DIFC and ADGM have their own data protection laws"
    },
    {
      "jurisdiction": "JP",
      "framework": "Act on the Protection of Personal Information (APPI)",
      "specialCategories": ["health", "religion", "ethnicity", "criminal_record"],
      "consentMechanism": "consent",
      "retentionPeriod": "Purpose-limited; delete when purpose fulfilled",
      "crossBorderTransfer": "Consent + adequate protection (PPC whitelist) or binding corporate rules",
      "rightToErasure": true,
      "dataPortability": false,
      "notes": "2022 APPI amendments strengthened cross-border transfer rules"
    },
    {
      "jurisdiction": "IN-MH",
      "framework": "Digital Personal Data Protection Act 2023 (DPDPA)",
      "specialCategories": ["health", "financial"],
      "consentMechanism": "consent",
      "retentionPeriod": "Only as long as necessary; delete when consent withdrawn or purpose fulfilled",
      "crossBorderTransfer": "Permitted except to countries specifically blacklisted by Central Government",
      "rightToErasure": true,
      "dataPortability": false,
      "notes": "DPDPA implementation ongoing; rules still being notified"
    }
  ]
}