@tantainnovative/ndpr-toolkit/dist/chunk-WJSUVPYX.mjs

Nigeria Data Protection Toolkit — enterprise-grade compliance components for the Nigeria Data Protection Act (NDPA) 2023

var t=e=>typeof e=="string"&&e.trim().length>0,m=e=>typeof e=="number"&&Number.isFinite(e)&&e>=0,C=e=>Array.isArray(e)&&e.length>0,R=e=>!!e&&t(e.name)&&t(e.email);function M(e,n={}){var p,N,D,S,y;let s=(p=n.asOf)!=null?p:Date.now(),k=(N=n.deadlineHours)!=null?N:72,d=e.discoveredAt+k*36e5,o=n.notification,f=!!o,u=o==null?void 0:o.sentAt,c=(f?u:s)>d,h={deadline:d,hoursSinceDiscovery:Math.round((s-e.discoveredAt)/36e5),notified:f,notifiedAt:u,withinDeadline:!c,hoursRemaining:Math.round((d-s)/36e5),overdue:c,requiresDelayJustification:c},b=[{id:"circumstances",label:"Description of the circumstances of the breach",section:"GAID 2025 Art. 33(5)(a)",satisfied:t(e.description)},{id:"occurrence",label:"Date or time period of the breach",section:"GAID 2025 Art. 33(5)(b)",satisfied:m(e.occurredAt)},{id:"personalInfo",label:"Description of the personal data involved",section:"GAID 2025 Art. 33(5)(c)",satisfied:C(e.dataTypes)},{id:"riskOfHarm",label:"Assessment of the risk of harm to data subjects",section:"GAID 2025 Art. 33(5)(d)",satisfied:t(e.likelyConsequences)},{id:"numberAtRisk",label:"Estimated number of data subjects at risk of significant harm",section:"GAID 2025 Art. 33(5)(e)",satisfied:m(e.estimatedAffectedSubjects)},{id:"mitigation",label:"Steps taken to reduce the risk of harm",section:"GAID 2025 Art. 33(5)(f)",satisfied:t(e.mitigationMeasures)},{id:"notifySteps",label:"Steps taken to notify affected data subjects",section:"GAID 2025 Art. 33(5)(g)",satisfied:t(e.initialActions)},{id:"contactPoint",label:"Name and contact details of a contact point",section:"GAID 2025 Art. 33(5)(h)",satisfied:R(e.dpoContact)},{id:"dataSubjectCategories",label:"Categories of data subjects concerned",section:"NDPA 2023 S. 40(2)",satisfied:C(e.dataSubjectCategories)},{id:"recordCount",label:"Approximate number of personal data records concerned",section:"NDPA 2023 S. 40(2)",satisfied:m(e.approximateRecordCount)}],l=(y=(S=n.highRisk)!=null?S:(D=n.assessment)==null?void 0:D.highRisksToRightsAndFreedoms)!=null?y:false,A=l?[{id:"dsNature",label:"Nature and context of the breach in plain language",section:"NDPA 2023 S. 40(3)",satisfied:t(e.description)},{id:"dsConsequences",label:"Likely consequences of the breach",section:"NDPA 2023 S. 40(3)",satisfied:t(e.likelyConsequences)},{id:"dsMeasures",label:"Safeguards and measures data subjects can take",section:"NDPA 2023 S. 40(3)",satisfied:t(e.mitigationMeasures)},{id:"dsContact",label:"Contact point for data subjects",section:"NDPA 2023 S. 40(3)",satisfied:R(e.dpoContact)}]:[],r=[...b,...A],B=r.filter(i=>i.satisfied).length,j=Math.round(B/r.length*100),g=r.filter(i=>!i.satisfied).map(i=>i.label),I=g.length===0,a=[];for(let i of r.filter(P=>!P.satisfied))a.push(`Add: ${i.label} (${i.section}).`);return c?a.push("The 72-hour notification deadline has passed \u2014 notify the NDPC now and state the reasons for the delay; phased reporting is permitted where complete details are not yet available (NDPA S. 40(2))."):f||a.push(`${Math.max(0,h.hoursRemaining)} hour(s) remain to notify the NDPC within the 72-hour window (NDPA S. 40(2)).`),l&&a.push("High risk to data subjects \u2014 communicate the breach to affected data subjects immediately, in plain and clear language (NDPA S. 40(3))."),{complete:I,completeness:j,notificationToCommission:b,dataSubjectCommunication:A,dataSubjectCommunicationRequired:l,timing:h,missing:g,recommendations:a,asOf:s}}export{M as a};