{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Data protection impact assessment (GDPR art. 35): screening and full assessment - Belgium","description":"profile chooses the document: screening = the record of whether an art. 35 assessment is required (the three cases of art. 35(3) answered by the controller, a reasoned decision); assessment = the full assessment with the four items of art. 35(7), the art. 36 block and the conclusion. The template computes no risk level, score or decision: every level and the decision are the controller's own.","type":"object","required":["profile","date","project","controller","processing","signoff"],"additionalProperties":false,"properties":{"profile":{"type":"string","enum":["screening","assessment"]},"reference":{"type":"string","minLength":1,"description":"Internal reference."},"date":{"type":"string","format":"date","description":"Date of this record."},"version":{"type":"string","minLength":1},"project":{"type":"object","required":["name","summary"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":1},"owner":{"type":"string","minLength":1},"summary":{"type":"string","minLength":1}}},"controller":{"type":"object","required":["name","contact_email","dpo"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":1},"enterprise_number":{"type":"string","pattern":"^[01][0-9]{3}\\.[0-9]{3}\\.[0-9]{3}$"},"address":{"type":"string","minLength":1},"contact_email":{"type":"string","format":"email"},"representative":{"type":"object","required":["name"],"additionalProperties":false,"properties":{"name":{"type":"string","minLength":1},"contact":{"type":"string","minLength":1}}},"dpo":{"type":"object","required":["designated"],"additionalProperties":false,"properties":{"designated":{"type":"boolean","description":"Whether a data protection officer is designated."},"name":{"type":"string","minLength":1},"contact":{"type":"string","minLength":1}},"allOf":[{"if":{"properties":{"designated":{"const":true}},"required":["designated"]},"then":{"required":["name","contact"]}}]}}},"processing":{"type":"object","required":["nature","scope","context","purposes","data_subject_categories","data_categories","special_categories","new_technology"],"additionalProperties":false,"properties":{"nature":{"type":"string","minLength":1},"scope":{"type":"string","minLength":1},"context":{"type":"string","minLength":1},"purposes":{"type":"array","items":{"type":"string","minLength":1},"minItems":1},"data_subject_categories":{"type":"array","items":{"type":"string","minLength":1},"minItems":1},"data_categories":{"type":"array","items":{"type":"string","minLength":1},"minItems":1},"special_categories":{"type":"boolean","description":"Whether special categories of data (art. 9) or criminal-law data (art. 10) are processed."},"data_flows":{"type":"string","minLength":1},"new_technology":{"type":"boolean","description":"Whether a new technology is used."},"start_planned":{"type":"string","format":"date","description":"Planned start of the processing."}}},"screening":{"type":"object","required":["case_a","case_b","case_c","decision","decision_reasons"],"additionalProperties":false,"properties":{"case_a":{"type":"string","enum":["yes","no","unsure"],"description":"Art. 35(3)(a)."},"case_b":{"type":"string","enum":["yes","no","unsure"],"description":"Art. 35(3)(b)."},"case_c":{"type":"string","enum":["yes","no","unsure"],"description":"Art. 35(3)(c)."},"apd_list_item":{"type":"string","minLength":1,"description":"The item of the supervisory authority's list (art. 35(4)) the controller relies on, in its words."},"other_criteria":{"type":"array","items":{"type":"string","minLength":1},"description":"Other criteria the controller uses."},"dpo_advice":{"type":"string","minLength":1},"decision":{"type":"string","enum":["dpia_required","dpia_not_required","to_be_decided"],"description":"The controller's own decision; nothing is derived from the answers."},"decision_reasons":{"type":"string","minLength":1},"review_trigger":{"type":"string","minLength":1},"review_date":{"type":"string","format":"date"}}},"necessity":{"type":"object","required":["lawful_basis","proportionality","minimisation","retention","rights_measures"],"additionalProperties":false,"properties":{"lawful_basis":{"type":"string","enum":["consent","contract","legal_obligation","vital_interests","public_task","legitimate_interests"]},"legitimate_interest":{"type":"string","minLength":1,"description":"The legitimate interest pursued (art. 35(7)(a))."},"proportionality":{"type":"string","minLength":1},"minimisation":{"type":"string","minLength":1},"retention":{"type":"string","minLength":1},"rights_measures":{"type":"string","minLength":1}},"allOf":[{"if":{"properties":{"lawful_basis":{"const":"legitimate_interests"}},"required":["lawful_basis"]},"then":{"required":["legitimate_interest"]}}]},"risks":{"type":"array","minItems":1,"items":{"type":"object","required":["id","description","likelihood","severity"],"additionalProperties":false,"properties":{"id":{"type":"string","minLength":1},"description":{"type":"string","minLength":1},"likelihood":{"type":"string","enum":["low","medium","high"]},"severity":{"type":"string","enum":["low","medium","high"]},"impact":{"type":"string","minLength":1},"mitigations":{"type":"array","items":{"type":"string","minLength":1}},"residual_likelihood":{"type":"string","enum":["low","medium","high"]},"residual_severity":{"type":"string","enum":["low","medium","high"]}}}},"measures":{"type":"array","minItems":1,"items":{"type":"object","required":["measure"],"additionalProperties":false,"properties":{"measure":{"type":"string","minLength":1},"kind":{"type":"string","enum":["safeguard","security","compliance_mechanism","other"]},"owner":{"type":"string","minLength":1},"deadline":{"type":"string","format":"date"}}}},"consultations":{"type":"array","items":{"type":"object","required":["party","outcome"],"additionalProperties":false,"properties":{"party":{"type":"string","minLength":1},"date":{"type":"string","format":"date"},"outcome":{"type":"string","minLength":1}}}},"codes_of_conduct":{"type":"string","minLength":1},"dpo_advice":{"type":"string","minLength":1,"description":"The officer's advice (assessment profile)."},"conclusion":{"type":"object","required":["decision","rationale"],"additionalProperties":false,"properties":{"decision":{"type":"string","enum":["proceed","proceed_with_conditions","do_not_proceed","prior_consultation_required"]},"rationale":{"type":"string","minLength":1},"review_date":{"type":"string","format":"date"},"review_trigger":{"type":"string","minLength":1}}},"prior_consultation":{"type":"object","required":["required"],"additionalProperties":false,"properties":{"required":{"type":"boolean","description":"Whether the controller consults the supervisory authority (art. 36)."},"requested_on":{"type":"string","format":"date"},"authority_reply_on":{"type":"string","format":"date"},"outcome":{"type":"string","minLength":1}},"allOf":[{"if":{"properties":{"required":{"const":true}},"required":["required"]},"then":{"required":["requested_on"]}}]},"signoff":{"type":"object","required":["controller_signatory","controller_title","signed_on"],"additionalProperties":false,"properties":{"controller_signatory":{"type":"string","minLength":1},"controller_title":{"type":"string","minLength":1},"signed_on":{"type":"string","format":"date"},"dpo_signatory":{"type":"string","minLength":1},"dpo_signed_on":{"type":"string","format":"date"}}}},"allOf":[{"if":{"properties":{"profile":{"const":"screening"}},"required":["profile"]},"then":{"required":["screening"]}},{"if":{"properties":{"profile":{"const":"assessment"}},"required":["profile"]},"then":{"required":["necessity","risks","measures","conclusion","prior_consultation"]}}]}