class GDPRPrinciples:
    """GDPR principles as they apply to AI systems."""
 
    principles = {
        'lawfulness_fairness_transparency': {
            'requirement': 'Processing must have legal basis and be fair and transparent',
            'ai_implications': [
                'Document legal basis for AI training data use',
                'Explain AI decision-making process to data subjects',
                'Disclose use of AI in automated decisions',
                'Ensure AI outputs are fair and non-discriminatory'
            ]
        },
        'purpose_limitation': {
            'requirement': 'Data collected for specified purposes only',
            'ai_implications': [
                'AI models should only use data for stated purposes',
                'Repurposing training data requires new legal basis',
                'Model outputs limited to original purpose scope',
                'Document purpose for each AI processing activity'
            ]
        },
        'data_minimisation': {
            'requirement': 'Only process data necessary for the purpose',
            'ai_implications': [
                'Minimize training data to what\'s necessary',
                'Remove unnecessary features from models',
                'Implement feature selection for privacy',
                'Regular review of data requirements'
            ]
        },
        'accuracy': {
            'requirement': 'Personal data must be accurate and kept up to date',
            'ai_implications': [
                'AI models must maintain prediction accuracy',
                'Training data must be accurate',
                'Processes for correcting inaccurate data',
                'Regular model retraining with updated data'
            ]
        },
        'storage_limitation': {
            'requirement': 'Keep data only as long as necessary',
            'ai_implications': [
                'Define retention periods for training data',
                'Implement training data deletion procedures',
                'Consider model unlearning requirements',
                'Document retention justification'
            ]
        },
        'integrity_confidentiality': {
            'requirement': 'Appropriate security for personal data',
            'ai_implications': [
                'Secure training data and model weights',
                'Protect against adversarial attacks',
                'Prevent training data extraction from models',
                'Encrypt data at rest and in transit'
            ]
        },
        'accountability': {
            'requirement': 'Demonstrate compliance',
            'ai_implications': [
                'Document AI processing activities',
                'Maintain records of AI development decisions',
                'Implement AI governance framework',
                'Regular compliance audits'
            ]
        }
    }

from enum import Enum
from dataclasses import dataclass
from typing import List, Optional
 
class LawfulBasis(Enum):
    CONSENT = "consent"
    CONTRACT = "contract"
    LEGAL_OBLIGATION = "legal_obligation"
    VITAL_INTERESTS = "vital_interests"
    PUBLIC_TASK = "public_task"
    LEGITIMATE_INTERESTS = "legitimate_interests"
 
@dataclass
class AIProcessingActivity:
    """Document AI processing activity for GDPR compliance."""
 
    activity_id: str
    purpose: str
    description: str
    data_categories: List[str]
    special_categories: List[str]  # Article 9 data
    lawful_basis: LawfulBasis
    lawful_basis_justification: str
    data_subjects: List[str]
    retention_period: str
    third_party_sharing: Optional[List[str]]
    automated_decision_making: bool
    safeguards: List[str]
 
    def to_ropa_entry(self) -> dict:
        """Generate Records of Processing Activities entry."""
        return {
            'activity_id': self.activity_id,
            'purpose': self.purpose,
            'lawful_basis': self.lawful_basis.value,
            'data_categories': self.data_categories,
            'special_categories': self.special_categories,
            'data_subjects': self.data_subjects,
            'retention': self.retention_period,
            'recipients': self.third_party_sharing,
            'automated_decisions': self.automated_decision_making,
            'safeguards': self.safeguards
        }
 
 
class LegitimateInterestsAssessment:
    """Conduct Legitimate Interests Assessment for AI processing."""
 
    def assess(self, processing: AIProcessingActivity) -> dict:
        """Perform three-part LIA test."""
 
        assessment = {
            'processing_activity': processing.activity_id,
            'assessment_date': datetime.utcnow().isoformat(),
            'tests': {}
        }
 
        # Test 1: Purpose test
        assessment['tests']['purpose'] = self._purpose_test(processing)
 
        # Test 2: Necessity test
        assessment['tests']['necessity'] = self._necessity_test(processing)
 
        # Test 3: Balancing test
        assessment['tests']['balancing'] = self._balancing_test(processing)
 
        # Overall result
        all_passed = all(
            t['passed'] for t in assessment['tests'].values()
        )
        assessment['legitimate_interests_established'] = all_passed
 
        return assessment
 
    def _purpose_test(self, processing: AIProcessingActivity) -> dict:
        """Assess whether there is a legitimate interest."""
        return {
            'question': 'Is there a legitimate interest behind the processing?',
            'considerations': [
                'Is the purpose lawful?',
                'Is the interest real and present (not speculative)?',
                'Is it sufficiently specific and clearly articulated?'
            ],
            'documentation': processing.lawful_basis_justification,
            'passed': bool(processing.lawful_basis_justification)
        }
 
    def _necessity_test(self, processing: AIProcessingActivity) -> dict:
        """Assess whether processing is necessary for the interest."""
        return {
            'question': 'Is the processing necessary for the interest?',
            'considerations': [
                'Is there a less intrusive way to achieve the purpose?',
                'Is the processing proportionate?',
                'Could you achieve the same result with less data?'
            ],
            'alternatives_considered': True,  # Document alternatives
            'passed': True  # Based on documented analysis
        }
 
    def _balancing_test(self, processing: AIProcessingActivity) -> dict:
        """Balance interests against data subject rights."""
        return {
            'question': 'Do the interests override the rights of the data subject?',
            'factors_in_favor': [
                'Business need for AI processing',
                'Benefits to data subjects',
                'Wider public benefits'
            ],
            'factors_against': [
                'Impact on data subjects',
                'Reasonable expectations of data subjects',
                'Nature of the data processed'
            ],
            'safeguards': processing.safeguards,
            'passed': len(processing.safeguards) > 0
        }

from abc import ABC, abstractmethod
from datetime import datetime, timedelta
 
class DataSubjectRightsHandler:
    """Handle GDPR data subject rights for AI systems."""
 
    def __init__(self, config: dict):
        self.response_deadline_days = 30
        self.request_log = []
 
    def handle_request(self, request: dict) -> dict:
        """Process a data subject rights request."""
 
        request_id = str(uuid.uuid4())
        request_type = request['type']
        data_subject_id = request['data_subject_id']
 
        # Log the request
        self._log_request(request_id, request)
 
        # Route to appropriate handler
        handlers = {
            'access': self._handle_access_request,
            'rectification': self._handle_rectification_request,
            'erasure': self._handle_erasure_request,
            'restriction': self._handle_restriction_request,
            'portability': self._handle_portability_request,
            'objection': self._handle_objection_request,
            'automated_decision': self._handle_automated_decision_request
        }
 
        handler = handlers.get(request_type)
        if not handler:
            return {'error': 'Unknown request type'}
 
        result = handler(data_subject_id, request)
 
        # Calculate deadline
        result['request_id'] = request_id
        result['deadline'] = (
            datetime.utcnow() + timedelta(days=self.response_deadline_days)
        ).isoformat()
 
        return result
 
    def _handle_access_request(self, data_subject_id: str,
                               request: dict) -> dict:
        """Article 15: Right of access."""
 
        # Gather all personal data
        personal_data = self._collect_personal_data(data_subject_id)
 
        # Include AI-specific information
        ai_data = {
            'training_data_used': self._check_training_data_inclusion(data_subject_id),
            'ai_profiles': self._get_ai_profiles(data_subject_id),
            'automated_decisions': self._get_automated_decisions(data_subject_id),
            'profiling_logic': self._get_profiling_explanation(data_subject_id)
        }
 
        return {
            'status': 'completed',
            'personal_data': personal_data,
            'ai_related_data': ai_data,
            'processing_purposes': self._get_processing_purposes(data_subject_id),
            'recipients': self._get_data_recipients(data_subject_id),
            'retention_periods': self._get_retention_info(),
            'source_of_data': self._get_data_sources(data_subject_id),
            'safeguards_for_transfers': self._get_transfer_safeguards()
        }
 
    def _handle_erasure_request(self, data_subject_id: str,
                                request: dict) -> dict:
        """Article 17: Right to erasure (Right to be forgotten)."""
 
        # Check if erasure is applicable
        erasure_check = self._check_erasure_eligibility(data_subject_id)
 
        if not erasure_check['eligible']:
            return {
                'status': 'denied',
                'reason': erasure_check['reason'],
                'legal_basis': erasure_check['legal_basis']
            }
 
        # Perform erasure
        erasure_actions = []
 
        # 1. Delete from operational systems
        erasure_actions.append(self._delete_from_systems(data_subject_id))
 
        # 2. Handle AI-specific erasure
        if request.get('include_ai_data', True):
            # Remove from training datasets
            erasure_actions.append(
                self._remove_from_training_data(data_subject_id)
            )
 
            # Consider model unlearning (if technically feasible)
            if self._model_unlearning_feasible():
                erasure_actions.append(
                    self._trigger_model_unlearning(data_subject_id)
                )
            else:
                # Document why unlearning isn't feasible
                erasure_actions.append({
                    'action': 'model_unlearning_not_feasible',
                    'reason': 'Technical limitations',
                    'alternative_measures': [
                        'Data flagged as deleted',
                        'Model scheduled for retraining',
                        'Inference filtering implemented'
                    ]
                })
 
        # 3. Notify third parties
        if request.get('notify_third_parties', True):
            erasure_actions.append(
                self._notify_third_parties(data_subject_id, 'erasure')
            )
 
        return {
            'status': 'completed',
            'actions_taken': erasure_actions,
            'timestamp': datetime.utcnow().isoformat()
        }
 
    def _handle_automated_decision_request(self, data_subject_id: str,
                                          request: dict) -> dict:
        """Article 22: Rights related to automated decision-making."""
 
        request_subtype = request.get('subtype', 'information')
 
        if request_subtype == 'information':
            # Provide meaningful information about the logic
            return {
                'status': 'completed',
                'decision_id': request.get('decision_id'),
                'meaningful_information': self._explain_automated_decision(
                    data_subject_id, request.get('decision_id')
                ),
                'significance': self._describe_decision_significance(
                    request.get('decision_id')
                ),
                'consequences': self._describe_decision_consequences(
                    request.get('decision_id')
                )
            }
 
        elif request_subtype == 'human_intervention':
            # Request human review of automated decision
            return self._request_human_review(
                data_subject_id, request.get('decision_id')
            )
 
        elif request_subtype == 'contest':
            # Data subject wishes to contest the decision
            return self._initiate_decision_review(
                data_subject_id,
                request.get('decision_id'),
                request.get('grounds_for_contest')
            )
 
    def _explain_automated_decision(self, data_subject_id: str,
                                   decision_id: str) -> dict:
        """Provide meaningful explanation of automated decision."""
 
        decision = self._get_decision(decision_id)
 
        return {
            'decision_type': decision['type'],
            'decision_date': decision['timestamp'],
            'outcome': decision['outcome'],
            'explanation': {
                'factors_considered': decision['factors'],
                'factor_weights': 'Approximate importance ranking provided',
                'main_factors': decision['top_factors'],
                'logic_summary': decision['explanation_text'],
                'model_type': decision['model_type'],
                'accuracy_metrics': decision.get('model_accuracy')
            },
            'your_data_used': decision['input_data_summary'],
            'comparison_context': decision.get('percentile_context')
        }

class AutomatedDecisionMakingCompliance:
    """Ensure Article 22 compliance for AI automated decisions."""
 
    def __init__(self, config: dict):
        self.adm_register = {}
        self.human_reviewers = config.get('human_reviewers', [])
 
    def register_adm_system(self, system: dict) -> str:
        """Register an automated decision-making system."""
 
        system_id = str(uuid.uuid4())
 
        adm_entry = {
            'system_id': system_id,
            'name': system['name'],
            'purpose': system['purpose'],
            'decision_types': system['decision_types'],
            'legal_basis': system['legal_basis'],
            'produces_legal_effects': system.get('produces_legal_effects', False),
            'significantly_affects': system.get('significantly_affects', False),
            'special_category_data': system.get('special_category_data', False),
            'safeguards': [],
            'registered_at': datetime.utcnow().isoformat()
        }
 
        # Determine required safeguards based on Article 22
        if adm_entry['produces_legal_effects'] or adm_entry['significantly_affects']:
            adm_entry['article_22_applies'] = True
            adm_entry['required_safeguards'] = self._determine_required_safeguards(adm_entry)
        else:
            adm_entry['article_22_applies'] = False
 
        self.adm_register[system_id] = adm_entry
        return system_id
 
    def _determine_required_safeguards(self, adm_entry: dict) -> List[dict]:
        """Determine required safeguards for Article 22 decisions."""
 
        safeguards = [
            {
                'requirement': 'human_intervention',
                'description': 'Right to obtain human intervention',
                'implementation': 'Human review process required'
            },
            {
                'requirement': 'express_view',
                'description': 'Right to express point of view',
                'implementation': 'Appeal/review mechanism required'
            },
            {
                'requirement': 'contest_decision',
                'description': 'Right to contest the decision',
                'implementation': 'Decision review process required'
            },
            {
                'requirement': 'meaningful_information',
                'description': 'Information about the logic involved',
                'implementation': 'Explanation system required'
            }
        ]
 
        # Additional safeguards for special category data (Article 22(4))
        if adm_entry['special_category_data']:
            safeguards.append({
                'requirement': 'explicit_consent_or_substantial_public_interest',
                'description': 'Article 9(2)(a) or (g) legal basis required',
                'implementation': 'Consent mechanism or legal basis documentation'
            })
            safeguards.append({
                'requirement': 'suitable_measures',
                'description': 'Suitable measures to safeguard rights',
                'implementation': 'Enhanced security and access controls'
            })
 
        return safeguards
 
    def record_automated_decision(self, system_id: str,
                                  decision: dict) -> str:
        """Record an automated decision for compliance."""
 
        decision_id = str(uuid.uuid4())
 
        decision_record = {
            'decision_id': decision_id,
            'system_id': system_id,
            'data_subject_id': decision['data_subject_id'],
            'timestamp': datetime.utcnow().isoformat(),
            'input_data': decision['input_data'],
            'output': decision['output'],
            'confidence': decision.get('confidence'),
            'explanation': decision.get('explanation'),
            'human_reviewed': False,
            'contested': False
        }
 
        # Store decision record
        self._store_decision(decision_record)
 
        return decision_id
 
    def request_human_review(self, decision_id: str,
                            requester_id: str,
                            reason: str) -> dict:
        """Handle request for human intervention in automated decision."""
 
        decision = self._get_decision(decision_id)
 
        # Create review request
        review_request = {
            'request_id': str(uuid.uuid4()),
            'decision_id': decision_id,
            'requester_id': requester_id,
            'reason': reason,
            'requested_at': datetime.utcnow().isoformat(),
            'status': 'pending',
            'assigned_reviewer': self._assign_reviewer(),
            'deadline': (datetime.utcnow() + timedelta(days=7)).isoformat()
        }
 
        # Notify reviewer
        self._notify_reviewer(review_request)
 
        return review_request
 
    def _assign_reviewer(self) -> str:
        """Assign human reviewer for decision review."""
        # Round-robin or load-balanced assignment
        return self.human_reviewers[0] if self.human_reviewers else 'unassigned'

class PrivacyByDesignAI:
    """Implement privacy by design principles in AI systems."""
 
    techniques = {
        'differential_privacy': {
            'description': 'Add calibrated noise to protect individual records',
            'use_cases': ['Model training', 'Query responses', 'Data publishing'],
            'trade_offs': 'Privacy vs accuracy/utility'
        },
        'federated_learning': {
            'description': 'Train models on decentralized data',
            'use_cases': ['Mobile AI', 'Healthcare', 'Multi-org collaboration'],
            'trade_offs': 'Communication overhead, model convergence'
        },
        'secure_multi_party_computation': {
            'description': 'Compute on encrypted data from multiple parties',
            'use_cases': ['Collaborative analytics', 'Private inference'],
            'trade_offs': 'Computational overhead'
        },
        'homomorphic_encryption': {
            'description': 'Perform computations on encrypted data',
            'use_cases': ['Cloud ML', 'Private inference'],
            'trade_offs': 'Significant computational cost'
        },
        'data_anonymization': {
            'description': 'Remove or transform identifying information',
            'use_cases': ['Training data preparation', 'Data sharing'],
            'trade_offs': 'Re-identification risk, data utility loss'
        },
        'synthetic_data': {
            'description': 'Generate artificial data preserving statistical properties',
            'use_cases': ['Testing', 'Development', 'Training'],
            'trade_offs': 'May not capture all real-world patterns'
        }
    }
 
    def implement_data_minimization(self, dataset: dict) -> dict:
        """Apply data minimization principles."""
 
        minimization_steps = []
 
        # 1. Feature selection - keep only necessary features
        necessary_features = self._identify_necessary_features(dataset)
        minimization_steps.append({
            'step': 'feature_selection',
            'original_features': len(dataset['features']),
            'retained_features': len(necessary_features),
            'removed_features': [
                f for f in dataset['features']
                if f not in necessary_features
            ]
        })
 
        # 2. Generalization - reduce precision where possible
        generalized = self._apply_generalization(dataset, necessary_features)
        minimization_steps.append({
            'step': 'generalization',
            'fields_generalized': generalized['fields']
        })
 
        # 3. Pseudonymization - replace identifiers
        pseudonymized = self._apply_pseudonymization(dataset)
        minimization_steps.append({
            'step': 'pseudonymization',
            'identifiers_replaced': pseudonymized['replaced_fields']
        })
 
        return {
            'original_dataset': dataset['id'],
            'minimized_dataset': pseudonymized['dataset'],
            'steps_applied': minimization_steps,
            'data_utility_assessment': self._assess_utility(
                dataset, pseudonymized['dataset']
            )
        }
 
    def implement_purpose_limitation(self, model: dict,
                                    purposes: List[str]) -> dict:
        """Implement purpose limitation controls."""
 
        controls = {
            'model_id': model['id'],
            'approved_purposes': purposes,
            'implementation': []
        }
 
        # 1. Purpose-bound model wrapper
        controls['implementation'].append({
            'control': 'purpose_validation',
            'description': 'Validate purpose before inference',
            'code_example': '''
                def inference_with_purpose_check(input, stated_purpose):
                    if stated_purpose not in approved_purposes:
                        raise PurposeLimitationError()
                    return model.predict(input)
            '''
        })
 
        # 2. Audit logging
        controls['implementation'].append({
            'control': 'purpose_logging',
            'description': 'Log stated purpose with each use',
            'fields_logged': ['timestamp', 'user', 'purpose', 'input_hash']
        })
 
        # 3. Purpose-specific output filtering
        controls['implementation'].append({
            'control': 'output_filtering',
            'description': 'Filter outputs based on purpose',
            'example': 'HR purpose excludes salary predictions'
        })
 
        return controls

class AIDPIAFramework:
    """Framework for conducting DPIAs for AI systems."""
 
    def __init__(self):
        self.dpia_template = self._create_template()
 
    def _create_template(self) -> dict:
        """Create AI-specific DPIA template."""
 
        return {
            'sections': {
                '1_processing_description': {
                    'title': 'Description of AI Processing',
                    'questions': [
                        'What is the purpose of the AI system?',
                        'What personal data does the AI process?',
                        'What is the source of the training data?',
                        'What decisions does the AI make or support?',
                        'Who are the data subjects affected?',
                        'What is the legal basis for processing?'
                    ]
                },
                '2_necessity_proportionality': {
                    'title': 'Necessity and Proportionality',
                    'questions': [
                        'Is AI processing necessary for the purpose?',
                        'Could the purpose be achieved with less data?',
                        'Are there less intrusive alternatives?',
                        'Is the scope of processing proportionate?'
                    ]
                },
                '3_risk_assessment': {
                    'title': 'AI-Specific Risk Assessment',
                    'risk_categories': [
                        {
                            'category': 'Accuracy and Reliability',
                            'risks': [
                                'Model errors affecting individuals',
                                'Bias leading to discrimination',
                                'Model drift over time'
                            ]
                        },
                        {
                            'category': 'Transparency and Explainability',
                            'risks': [
                                'Inability to explain decisions',
                                'Lack of meaningful information for subjects',
                                'Hidden profiling'
                            ]
                        },
                        {
                            'category': 'Data Subject Rights',
                            'risks': [
                                'Difficulty fulfilling access requests',
                                'Challenges with erasure from models',
                                'Limited ability to contest decisions'
                            ]
                        },
                        {
                            'category': 'Security',
                            'risks': [
                                'Training data extraction',
                                'Model theft',
                                'Adversarial manipulation'
                            ]
                        }
                    ]
                },
                '4_mitigation_measures': {
                    'title': 'Risk Mitigation Measures',
                    'measure_types': [
                        'Technical measures',
                        'Organizational measures',
                        'Transparency measures',
                        'Data subject rights measures'
                    ]
                },
                '5_consultation': {
                    'title': 'Consultation Requirements',
                    'questions': [
                        'Have data subjects or representatives been consulted?',
                        'Is supervisory authority consultation required?',
                        'What expert advice has been obtained?'
                    ]
                }
            }
        }
 
    def conduct_dpia(self, ai_system: dict) -> dict:
        """Conduct DPIA for AI system."""
 
        dpia = {
            'dpia_id': str(uuid.uuid4()),
            'ai_system': ai_system['name'],
            'assessment_date': datetime.utcnow().isoformat(),
            'assessor': ai_system.get('assessor'),
            'sections': {}
        }
 
        # Assess each section
        for section_id, section in self.dpia_template['sections'].items():
            if section_id == '3_risk_assessment':
                dpia['sections'][section_id] = self._assess_risks(ai_system, section)
            else:
                dpia['sections'][section_id] = self._gather_section_info(
                    ai_system, section
                )
 
        # Generate recommendations
        dpia['recommendations'] = self._generate_recommendations(dpia)
 
        # Determine if residual risk is acceptable
        dpia['residual_risk_acceptable'] = self._assess_residual_risk(dpia)
 
        # Determine if supervisory authority consultation needed
        dpia['consultation_required'] = not dpia['residual_risk_acceptable']
 
        return dpia

class GDPRAIComplianceMonitor:
    """Ongoing compliance monitoring for AI systems."""
 
    def __init__(self, config: dict):
        self.checks = self._define_compliance_checks()
 
    def run_compliance_assessment(self, ai_system: dict) -> dict:
        """Run compliance assessment for AI system."""
 
        assessment = {
            'system_id': ai_system['id'],
            'assessment_date': datetime.utcnow().isoformat(),
            'checks': [],
            'overall_compliance': True
        }
 
        for check in self.checks:
            result = check['function'](ai_system)
            assessment['checks'].append({
                'check_id': check['id'],
                'name': check['name'],
                'passed': result['passed'],
                'details': result.get('details'),
                'remediation': result.get('remediation') if not result['passed'] else None
            })
 
            if not result['passed']:
                assessment['overall_compliance'] = False
 
        return assessment
 
    def _define_compliance_checks(self) -> List[dict]:
        """Define compliance checks."""
 
        return [
            {
                'id': 'GDPR-AI-001',
                'name': 'Legal basis documented',
                'function': self._check_legal_basis
            },
            {
                'id': 'GDPR-AI-002',
                'name': 'Privacy notice updated for AI',
                'function': self._check_privacy_notice
            },
            {
                'id': 'GDPR-AI-003',
                'name': 'Data subject rights processes',
                'function': self._check_rights_processes
            },
            {
                'id': 'GDPR-AI-004',
                'name': 'Article 22 safeguards',
                'function': self._check_article_22
            },
            {
                'id': 'GDPR-AI-005',
                'name': 'DPIA completed',
                'function': self._check_dpia
            },
            {
                'id': 'GDPR-AI-006',
                'name': 'Data minimization applied',
                'function': self._check_minimization
            },
            {
                'id': 'GDPR-AI-007',
                'name': 'Security measures adequate',
                'function': self._check_security
            },
            {
                'id': 'GDPR-AI-008',
                'name': 'Retention periods defined',
                'function': self._check_retention
            }
        ]