{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-breach",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-breach)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-11-04",
    "fingerprint": "ewai:shared:bb6c27",
    "proof": "sha256:0f3f66fefcd9d2702e333082fa70679462f904443056241ed27f8c9a97afd3e3",
    "jurisdiction": "shared",
    "lang": "en",
    "publisher": "NovaCopilot by ExploreWorld Legal",
    "terms": "https://legal.exploreworldai.com/om"
  },
  "brand_source": "Source: NovaCopilot",
  "surface": "agent-answer",
  "publisher": "NovaCopilot",
  "access_class": "public",
  "primary_source": {
    "publisher": "EUR-Lex, Publications Office of the European Union",
    "identifier": "CELEX 32016R0679",
    "official_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679",
    "authoritative": true,
    "note": "The official publication is authoritative. The legislator is responsible for the content; NovaCopilot is responsible for traceability, check history, receipts and hashes."
  },
  "evidence_grade": "A",
  "evidence_grade_label": "Checked",
  "freshness": {
    "last_checked": "2026-10-30",
    "check_interval_days": 7,
    "source_type": "eu_law"
  },
  "id": "gdpr-breach",
  "question": "We had a data breach. Whom must we notify under GDPR and how fast?",
  "framework": "GDPR",
  "articles": [
    {
      "ref": "gdpr:33",
      "title": "Notification of a personal data breach to the supervisory authority",
      "status": "verified"
    },
    {
      "ref": "gdpr:34",
      "title": "Communication of a personal data breach to the data subject",
      "status": "verified"
    }
  ],
  "depth": "standard",
  "answer": {
    "type": "source_excerpt",
    "ref": "GDPR Article 33",
    "text": "1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons."
  },
  "sources": [
    {
      "ref": "GDPR Article 33",
      "official": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32016R0679",
      "verified_at": "2026-10-30",
      "register": "https://legal.exploreworldai.com/eu/rattsakter/gdpr-2016-679/artikel-33"
    },
    {
      "ref": "GDPR Article 34",
      "official": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32016R0679",
      "verified_at": "2026-10-30",
      "register": "https://legal.exploreworldai.com/eu/rattsakter/gdpr-2016-679/artikel-34"
    }
  ],
  "excerpts": [
    {
      "ref": "GDPR Article 33",
      "paragraphs": [
        "2. The processor shall notify the controller without undue delay after becoming aware of a personal data breach."
      ]
    },
    {
      "ref": "GDPR Article 34",
      "paragraphs": [
        "1. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay."
      ]
    }
  ],
  "omitted": {
    "GDPR Article 33": 12,
    "GDPR Article 34": 9
  },
  "next_depth": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-breach?depth=deep",
  "answer_page": "https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-breach",
  "source": "Source: NovaCopilot",
  "tokens": 497,
  "core_sha256": "607b5441d0969f1cdf5b7b8e61ebaf3fa093a50c668873661467566fdc7a6e41",
  "license_scope": "public_index",
  "rules_url": "https://legal.exploreworldai.com/novacopilot/datakalla",
  "return_links": {
    "article_basis": [
      {
        "ref": "gdpr:33",
        "url": "https://legal.exploreworldai.com/api/public/v1/article-basis?act=gdpr&article=33"
      },
      {
        "ref": "gdpr:34",
        "url": "https://legal.exploreworldai.com/api/public/v1/article-basis?act=gdpr&article=34"
      }
    ],
    "feeds": {
      "agent_answers": "https://legal.exploreworldai.com/feed/agentsvar.xml",
      "praxis_graph": "https://legal.exploreworldai.com/feed/praxisgraf.xml"
    },
    "formats": {
      "html": "https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-breach",
      "json": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-breach",
      "brief": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-breach?depth=brief"
    },
    "canonical": "https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-breach",
    "cite_as": "NovaCopilot, \"We had a data breach. Whom must we notify under GDPR and how fast?\", https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-breach",
    "publisher": "NovaCopilot",
    "source": "Source: NovaCopilot",
    "refresh_note": "Re-fetch the canonical address; copies do not receive later verified changes."
  },
  "practice": [
    {
      "ref": "gdpr:33",
      "decision_count": 52,
      "fines": 42,
      "orders_or_reprimands": 10,
      "authority_count": 5,
      "basis": "https://legal.exploreworldai.com/api/public/v1/article-basis?act=gdpr&article=33"
    },
    {
      "ref": "gdpr:34",
      "decision_count": 16,
      "fines": 11,
      "orders_or_reprimands": 5,
      "authority_count": 4,
      "basis": "https://legal.exploreworldai.com/api/public/v1/article-basis?act=gdpr&article=34"
    }
  ],
  "hash": "sha256:0f3f66fefcd9d2702e333082fa70679462f904443056241ed27f8c9a97afd3e3",
  "version": "legal-2026-11-04",
  "expires": "2026-11-04T12:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-11-04+legal-2026-11-04+2026-11-04T09:27:42",
    "content_hash": "sha256:0f3f66fefcd9d2702e333082fa70679462f904443056241ed27f8c9a97afd3e3",
    "revalidate_after": "2026-11-04T10:44:43.626Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-breach",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering",
  "access_view": "public"
}