async function scheduleReKYC(customerId: string, riskLevel: string) {
  const intervals = {
    high: 365,
    medium: 730,
    low: 3650,
  };
  
  const nextKYC = new Date();
  nextKYC.setDate(nextKYC.getDate() + intervals[riskLevel as keyof typeof intervals]);
  
  await db.customer.update({
    where: { id: customerId },
    data: { nextKYCDate: nextKYC },
  });
}

interface Consent {
  userId: string;
  purpose: string;
  dataCategories: string[];
  consentGiven: boolean;
  consentTimestamp: Date;
  withdrawable: boolean;
}

// Obtain consent before verification
async function obtainVerificationConsent(userId: string): Promise<boolean> {
  const consent = await db.consent.create({
    data: {
      userId,
      purpose: 'identity_verification',
      dataCategories: ['mobile', 'name', 'pan_last4'],
      consentGiven: true,
      consentTimestamp: new Date(),
      withdrawable: true,
    },
  });
  
  return consent.consentGiven;
}

// Check consent before API call
async function verifyWithConsent(userId: string, mobile: string) {
  const hasConsent = await checkConsent(userId, 'identity_verification');
  
  if (!hasConsent) {
    throw new ConsentRequiredError('User consent required for verification');
  }
  
  return client.upiByMobile(mobile, { sync: true });
}

// Right to access
async function handleAccessRequest(userId: string) {
  const userData = await collectAllUserData(userId);
  return {
    personalData: userData,
    processingPurposes: ['identity_verification', 'fraud_prevention'],
    retentionPeriod: '7 years for compliance records',
    dataSharing: ['None - data not shared with third parties'],
  };
}

// Right to correction
async function handleCorrectionRequest(
  userId: string, 
  corrections: Record<string, any>
) {
  // Verify identity before allowing corrections
  await verifyIdentity(userId);
  
  // Apply corrections
  await db.customer.update({
    where: { id: userId },
    data: corrections,
  });
  
  // Log the correction
  await logDataCorrection(userId, corrections);
}

// Right to erasure
async function handleErasureRequest(userId: string) {
  // Check if we can delete (may need to retain for compliance)
  const canDelete = await checkRetentionRequirements(userId);
  
  if (!canDelete) {
    return {
      status: 'partial',
      message: 'Some data retained for regulatory compliance',
      retainedUntil: calculateRetentionEnd(userId),
    };
  }
  
  await deleteAllUserData(userId);
  return { status: 'complete' };
}

// Never store full PAN from KYC results
function processKYCResult(result: any): SafeKYCData {
  const kyc = result.result?.kycByMobile || {};
  
  return {
    name: kyc.fullName,
    panLast4: kyc.pan ? kyc.pan.slice(-4) : null,
    // Do NOT store: kyc.pan (full PAN)
  };
}

// Log all access to cardholder data
async function logPCIAccess(event: {
  userId: string;
  action: string;
  dataType: string;
  success: boolean;
}) {
  await db.pciAuditLog.create({
    data: {
      ...event,
      timestamp: new Date(),
      ipAddress: getRequestIP(),
      userAgent: getRequestUserAgent(),
    },
  });
}

interface AuditLog {
  id: string;
  eventType: 'api_call' | 'data_access' | 'consent' | 'deletion';
  userId?: string;
  customerId?: string;
  action: string;
  details: Record<string, any>;
  ipAddress: string;
  userAgent: string;
  timestamp: Date;
  // Immutable - use append-only storage
}

// Use append-only storage for audit logs
async function writeAuditLog(log: Omit<AuditLog, 'id' | 'timestamp'>) {
  // Write to immutable storage (e.g., append-only database, blockchain, S3 with object lock)
  await appendOnlyStorage.write({
    ...log,
    id: generateUUID(),
    timestamp: new Date(),
  });
}

interface ComplianceReport {
  period: { start: Date; end: Date };
  totalVerifications: number;
  consentMetrics: {
    obtained: number;
    withdrawn: number;
    pending: number;
  };
  dataRequests: {
    access: number;
    correction: number;
    erasure: number;
  };
  securityMetrics: {
    unauthorizedAttempts: number;
    dataBreaches: number;
  };
}

async function generateQuarterlyReport(
  startDate: Date,
  endDate: Date
): Promise<ComplianceReport> {
  return {
    period: { start: startDate, end: endDate },
    totalVerifications: await countVerifications(startDate, endDate),
    consentMetrics: await getConsentMetrics(startDate, endDate),
    dataRequests: await getDataRequestMetrics(startDate, endDate),
    securityMetrics: await getSecurityMetrics(startDate, endDate),
  };
}