{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Data Classification Policy","description":"Policy defining the organisation's classification levels plus a register mapping each data type to its level, owner and handling rules. Supports ISO/IEC 27001 A.5.12 and the GDPR data-minimisation principle.","type":"object","required":["entity","version","effective_date","classification_levels","data_registry","review_cycle","policy_owner"],"additionalProperties":false,"properties":{"entity":{"type":"string"},"version":{"type":"string"},"effective_date":{"type":"string","format":"date"},"next_review":{"type":"string","format":"date"},"classification_levels":{"type":"array","minItems":2,"items":{"type":"object","required":["level_name","description","example_data_types","handling_rules","retention_default","allowed_storage","allowed_transmission"],"additionalProperties":false,"properties":{"level_name":{"type":"string"},"description":{"type":"string"},"example_data_types":{"type":"array","items":{"type":"string"}},"handling_rules":{"type":"string"},"retention_default":{"type":"string"},"allowed_storage":{"type":"string"},"allowed_transmission":{"type":"string"}}}},"data_registry":{"type":"array","minItems":1,"items":{"type":"object","required":["data_type","classification_level","business_owner","systems","retention"],"additionalProperties":false,"properties":{"data_type":{"type":"string"},"classification_level":{"type":"string"},"business_owner":{"type":"string"},"systems":{"type":"array","items":{"type":"string"}},"retention":{"type":"string"},"special_controls":{"type":"string"}}}},"review_cycle":{"type":"string"},"policy_owner":{"type":"object","required":["name","title"],"additionalProperties":false,"properties":{"name":{"type":"string"},"title":{"type":"string"}}}}}