# Purpose-Based Access Control — Configuration Template

## Purpose Registry

| Purpose ID | Name | Parent | Legal Basis | Data Categories | Retention | Consent Required |
|-----------|------|--------|------------|-----------------|-----------|-----------------|
| | | | | | | Yes / No |

## Role-Purpose Mapping

| Role | Allowed Purposes | Data Categories Accessible |
|------|-----------------|--------------------------|
| | | |

## Access Audit Log

| Timestamp | Requester | Resource | Purpose | Decision | Reason |
|-----------|-----------|----------|---------|----------|--------|
| | | | | PERMIT/DENY | |

## Sign-Off

| Role | Name | Date |
|------|------|------|
| Privacy Engineer | | |
| IAM Administrator | | |
| CPO/DPO | | |