[
{
"control_id": "A.5.1",
"control_name": "Policies for information security",
"regulation": "DGA",
"articles": ["5", "12"],
"coverage": "full",
"notes": "Security policies for data intermediation services"
},
{
"control_id": "A.5.31",
"control_name": "Legal, statutory, regulatory and contractual requirements",
"regulation": "DGA",
"articles": ["1", "2"],
"coverage": "full",
"notes": "Framework for data sharing and governance"
},
{
"control_id": "A.5.33",
"control_name": "Protection of records",
"regulation": "DGA",
"articles": ["5", "11"],
"coverage": "full",
"notes": "Data governance and cataloguing requirements"
},
{
"control_id": "A.5.34",
"control_name": "Privacy and protection of PII",
"regulation": "DGA",
"articles": ["5", "12"],
"coverage": "full",
"notes": "Personal data protection in data sharing"
},
{
"control_id": "A.8.3",
"control_name": "Information access restriction",
"regulation": "DGA",
"articles": ["5", "6"],
"coverage": "full",
"notes": "Access controls for protected data re-use"
},
{
"control_id": "A.8.11",
"control_name": "Data masking",
"regulation": "DGA",
"articles": ["5"],
"coverage": "full",
"notes": "Anonymization and pseudonymization for data sharing"
}
]
