{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-security",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-security)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-11-04",
    "fingerprint": "ewai:shared:29050c",
    "proof": "sha256:07cc00a85eed027b73214a74665ad8a07f7866229c34b5696cb056ece47c6ecc",
    "jurisdiction": "shared",
    "lang": "en",
    "publisher": "NovaCopilot by ExploreWorld Legal",
    "terms": "https://legal.exploreworldai.com/om"
  },
  "brand_source": "Source: NovaCopilot",
  "surface": "agent-answer",
  "publisher": "NovaCopilot",
  "access_class": "public",
  "primary_source": {
    "publisher": "EUR-Lex, Publications Office of the European Union",
    "identifier": "CELEX 32016R0679",
    "official_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679",
    "authoritative": true,
    "note": "The official publication is authoritative. The legislator is responsible for the content; NovaCopilot is responsible for traceability, check history, receipts and hashes."
  },
  "evidence_grade": "A",
  "evidence_grade_label": "Checked",
  "freshness": {
    "last_checked": "2026-10-30",
    "check_interval_days": 7,
    "source_type": "eu_law"
  },
  "id": "gdpr-security",
  "question": "What security measures does GDPR require when we use a cloud provider?",
  "framework": "GDPR",
  "articles": [
    {
      "ref": "gdpr:32",
      "title": "Security of processing",
      "status": "verified"
    },
    {
      "ref": "gdpr:29",
      "title": "Processing under the authority of the controller or processor",
      "status": "verified"
    }
  ],
  "depth": "standard",
  "answer": {
    "type": "source_excerpt",
    "ref": "GDPR Article 32",
    "text": "(a)"
  },
  "sources": [
    {
      "ref": "GDPR Article 32",
      "official": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32016R0679",
      "verified_at": "2026-10-30",
      "register": "https://legal.exploreworldai.com/eu/rattsakter/gdpr-2016-679/artikel-32"
    },
    {
      "ref": "GDPR Article 29",
      "official": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32016R0679",
      "verified_at": "2026-10-30",
      "register": "https://legal.exploreworldai.com/eu/rattsakter/gdpr-2016-679/artikel-29"
    }
  ],
  "excerpts": [
    {
      "ref": "GDPR Article 32",
      "paragraphs": [
        "1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:",
        "(a)"
      ]
    },
    {
      "ref": "GDPR Article 29",
      "paragraphs": [
        "The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law."
      ]
    }
  ],
  "omitted": {
    "GDPR Article 32": 10
  },
  "next_depth": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-security?depth=deep",
  "answer_page": "https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-security",
  "source": "Source: NovaCopilot",
  "tokens": 481,
  "core_sha256": "fac582f642947fb7fac46a32e097b482e9d4cbf12ac74b5e7b99d3df29c3d241",
  "license_scope": "public_index",
  "rules_url": "https://legal.exploreworldai.com/novacopilot/datakalla",
  "return_links": {
    "article_basis": [
      {
        "ref": "gdpr:32",
        "url": "https://legal.exploreworldai.com/api/public/v1/article-basis?act=gdpr&article=32"
      },
      {
        "ref": "gdpr:29",
        "url": "https://legal.exploreworldai.com/api/public/v1/article-basis?act=gdpr&article=29"
      }
    ],
    "feeds": {
      "agent_answers": "https://legal.exploreworldai.com/feed/agentsvar.xml",
      "praxis_graph": "https://legal.exploreworldai.com/feed/praxisgraf.xml"
    },
    "formats": {
      "html": "https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-security",
      "json": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-security",
      "brief": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-security?depth=brief"
    },
    "canonical": "https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-security",
    "cite_as": "NovaCopilot, \"What security measures does GDPR require when we use a cloud provider?\", https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-security",
    "publisher": "NovaCopilot",
    "source": "Source: NovaCopilot",
    "refresh_note": "Re-fetch the canonical address; copies do not receive later verified changes."
  },
  "practice": [
    {
      "ref": "gdpr:32",
      "decision_count": 222,
      "fines": 157,
      "orders_or_reprimands": 65,
      "authority_count": 5,
      "basis": "https://legal.exploreworldai.com/api/public/v1/article-basis?act=gdpr&article=32"
    },
    {
      "ref": "gdpr:29",
      "decision_count": 16,
      "fines": 11,
      "orders_or_reprimands": 5,
      "authority_count": 3,
      "basis": "https://legal.exploreworldai.com/api/public/v1/article-basis?act=gdpr&article=29"
    }
  ],
  "hash": "sha256:07cc00a85eed027b73214a74665ad8a07f7866229c34b5696cb056ece47c6ecc",
  "version": "legal-2026-11-04",
  "expires": "2026-11-04T12:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-11-04+legal-2026-11-04+2026-11-04T09:27:42",
    "content_hash": "sha256:07cc00a85eed027b73214a74665ad8a07f7866229c34b5696cb056ece47c6ecc",
    "revalidate_after": "2026-11-04T11:00:38.312Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-security",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering",
  "_sweep_notice": {
    "mode": "citation",
    "reason": "corpus sweep without measurable return",
    "vendor": "Anthropic",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-security",
    "full_text": "https://legal.exploreworldai.com/enterprise",
    "attribution": "cite the canonical URL when the answer uses this source"
  },
  "access_view": "public"
}