Update app.js

app.js

@@ -212,33 +212,44 @@ const STEPS = [
           { title: "Normen (logging/encryption)", url: "https://www.helsedirektoratet.no/normen/logging-og-innsyn-i-logg-faktaark-15" }
         ],
       },
-      {
+       {
         k: "4e",
         label:
-          "Data comes from an external source (outside institutions: registries/health trusts).",
+          "Data comes from an external source, obtain data access agreements, processor/joint controller contracts, DSA/DUA signed",
         req: false,
-        children: [
-          {
-            k: "4e-1",
-            label:
-              "Obtain data access agreements; dispensation where applicable.",
-            req: false,
-            refs: [
-              { title: "HRL §19e; HPA §29", url: "https://lovdata.no/dokument/NL/lov/2014-06-20-43" }
-            ],
-          },
-          {
-            k: "4e-2",
-            label:
-              "Processor/joint controller contracts (GDPR 28(3), 26) and DSA/DUA signed (scope, duration, security, destruction/return).",
-            req: false,
-            refs: [
-              { title: "GDPR Art. 28(3)", url: "https://gdpr-info.eu/art-28-gdpr/" },
-              { title: "GDPR Art. 26", url: "https://gdpr-info.eu/art-26-gdpr/" }
-            ],
-          },
-        ],
+        refs: [
+            { title: "HRL §19e; HPA §29", url: "https://lovdata.no/dokument/NL/lov/2014-06-20-43" },
+            { title: "GDPR Art. 28(3)", url: "https://gdpr-info.eu/art-28-gdpr/" },
+            { title: "GDPR Art. 26", url: "https://gdpr-info.eu/art-26-gdpr/" }
+          ],
       },
+      // {
+      //   k: "4e",
+      //   label:
+      //     "Data comes from an external source (outside institutions: registries/health trusts).",
+      //   req: false,
+      //   children: [
+      //     {
+      //       k: "4e-1",
+      //       label:
+      //         "Obtain data access agreements; dispensation where applicable.",
+      //       req: false,
+      //       refs: [
+      //         { title: "HRL §19e; HPA §29", url: "https://lovdata.no/dokument/NL/lov/2014-06-20-43" }
+      //       ],
+      //     },
+      //     {
+      //       k: "4e-2",
+      //       label:
+      //         "Processor/joint controller contracts (GDPR 28(3), 26) and DSA/DUA signed (scope, duration, security, destruction/return).",
+      //       req: false,
+      //       refs: [
+      //         { title: "GDPR Art. 28(3)", url: "https://gdpr-info.eu/art-28-gdpr/" },
+      //         { title: "GDPR Art. 26", url: "https://gdpr-info.eu/art-26-gdpr/" }
+      //       ],
+      //     },
+      //   ],
+      // },
       {
         k: "4f",
         label: