{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-by-design",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-by-design)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-11-04",
    "fingerprint": "ewai:shared:6f61ef",
    "proof": "sha256:e4bb8935a815def162093b47fbdbf942c6781d2c4367ea65dc25d922fd3f577b",
    "jurisdiction": "shared",
    "lang": "en",
    "publisher": "NovaCopilot by ExploreWorld Legal",
    "terms": "https://legal.exploreworldai.com/om"
  },
  "brand_source": "Source: NovaCopilot",
  "surface": "agent-answer",
  "publisher": "NovaCopilot",
  "access_class": "public",
  "primary_source": {
    "publisher": "EUR-Lex, Publications Office of the European Union",
    "identifier": "CELEX 32016R0679",
    "official_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679",
    "authoritative": true,
    "note": "The official publication is authoritative. The legislator is responsible for the content; NovaCopilot is responsible for traceability, check history, receipts and hashes."
  },
  "evidence_grade": "A",
  "evidence_grade_label": "Checked",
  "freshness": {
    "last_checked": "2026-10-30",
    "check_interval_days": 7,
    "source_type": "eu_law"
  },
  "id": "gdpr-by-design",
  "question": "What does data protection by design mean for our software or website under GDPR?",
  "framework": "GDPR",
  "articles": [
    {
      "ref": "gdpr:25",
      "title": "Data protection by design and by default",
      "status": "verified"
    }
  ],
  "depth": "standard",
  "answer": {
    "type": "source_excerpt",
    "ref": "GDPR Article 25",
    "text": "2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed."
  },
  "sources": [
    {
      "ref": "GDPR Article 25",
      "official": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32016R0679",
      "verified_at": "2026-10-30",
      "register": "https://legal.exploreworldai.com/eu/rattsakter/gdpr-2016-679/artikel-25"
    }
  ],
  "excerpts": [
    {
      "ref": "GDPR Article 25",
      "paragraphs": [
        "1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects."
      ]
    }
  ],
  "omitted": {
    "GDPR Article 25": 2
  },
  "next_depth": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-by-design?depth=deep",
  "answer_page": "https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-by-design",
  "source": "Source: NovaCopilot",
  "tokens": 458,
  "core_sha256": "80d8d9494bae88a34c7f478a8d1abe68eea220a25cdcef32bf41e2b9fbc75666",
  "license_scope": "public_index",
  "rules_url": "https://legal.exploreworldai.com/novacopilot/datakalla",
  "return_links": {
    "article_basis": [
      {
        "ref": "gdpr:25",
        "url": "https://legal.exploreworldai.com/api/public/v1/article-basis?act=gdpr&article=25"
      }
    ],
    "feeds": {
      "agent_answers": "https://legal.exploreworldai.com/feed/agentsvar.xml",
      "praxis_graph": "https://legal.exploreworldai.com/feed/praxisgraf.xml"
    },
    "formats": {
      "html": "https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-by-design",
      "json": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-by-design",
      "brief": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-by-design?depth=brief"
    },
    "canonical": "https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-by-design",
    "cite_as": "NovaCopilot, \"What does data protection by design mean for our software or website under GDPR?\", https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-by-design",
    "publisher": "NovaCopilot",
    "source": "Source: NovaCopilot",
    "refresh_note": "Re-fetch the canonical address; copies do not receive later verified changes."
  },
  "practice": [
    {
      "ref": "gdpr:25",
      "decision_count": 37,
      "fines": 20,
      "orders_or_reprimands": 17,
      "authority_count": 5,
      "basis": "https://legal.exploreworldai.com/api/public/v1/article-basis?act=gdpr&article=25"
    }
  ],
  "hash": "sha256:e4bb8935a815def162093b47fbdbf942c6781d2c4367ea65dc25d922fd3f577b",
  "version": "legal-2026-11-04",
  "expires": "2026-11-04T12:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-11-04+legal-2026-11-04+2026-11-04T09:27:42",
    "content_hash": "sha256:e4bb8935a815def162093b47fbdbf942c6781d2c4367ea65dc25d922fd3f577b",
    "revalidate_after": "2026-11-04T10:44:46.400Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-by-design",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering",
  "access_view": "public"
}