{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/agent/gdpr-2016-679/artikel-32",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-08-25",
    "proof": "sha256:e974027b0cbb8c049fbadb6b4199bcf58f170350894c5ee6cde3b30529afb546",
    "jurisdiction": "eu"
  },
  "id": "gdpr-2016-679-32",
  "script": {
    "kind": "operative",
    "fields": [
      {
        "name": "encryption_or_pseudonymisation",
        "kind": "boolean",
        "label": "Kryptering eller pseudonymisering används",
        "labelEn": "Encryption or pseudonymisation is used"
      },
      {
        "name": "restore_tested",
        "kind": "boolean",
        "label": "Återställning är testad",
        "labelEn": "Restoration is tested"
      },
      {
        "name": "risk_assessed",
        "kind": "boolean",
        "label": "Risken är bedömd",
        "labelEn": "The risk is assessed"
      }
    ],
    "rules": [
      {
        "id": "32-no-risk-assessment",
        "when": {
          "op": "not",
          "of": {
            "op": "equals",
            "field": "risk_assessed",
            "value": true
          }
        },
        "outcome": {
          "code": "risk-unassessed",
          "title": "Säkerhetsnivån kan inte bestämmas",
          "titleEn": "The level of security cannot be determined",
          "obligation": "Åtgärderna ska vara lämpliga i förhållande till risken, vilket förutsätter att risken är bedömd.",
          "obligationEn": "The measures shall be appropriate to the risk, which presupposes that the risk has been assessed.",
          "refs": [
            "1",
            "2"
          ]
        }
      },
      {
        "id": "32-gap",
        "when": {
          "op": "any",
          "of": [
            {
              "op": "equals",
              "field": "encryption_or_pseudonymisation",
              "value": false
            },
            {
              "op": "equals",
              "field": "restore_tested",
              "value": false
            }
          ]
        },
        "outcome": {
          "code": "measure-gap",
          "title": "En åtgärd i artikel 32.1 saknas",
          "titleEn": "A measure in Article 32(1) is missing",
          "obligation": "Artikeln räknar upp pseudonymisering och kryptering, fortlöpande konfidentialitet och tillgänglighet, återställningsförmåga och regelbunden utvärdering.",
          "obligationEn": "The article lists pseudonymisation and encryption, ongoing confidentiality and availability, the ability to restore, and regular testing.",
          "refs": [
            "1"
          ]
        }
      },
      {
        "id": "32-ok",
        "when": {
          "op": "equals",
          "field": "risk_assessed",
          "value": true
        },
        "outcome": {
          "code": "measures-stated",
          "title": "Åtgärderna är angivna som lämpliga",
          "titleEn": "The measures are stated as appropriate",
          "obligation": "Nivån ska omprövas löpande, och efterlevnaden ska kunna visas för tillsynsmyndigheten.",
          "obligationEn": "The level shall be reviewed on an ongoing basis and compliance shall be demonstrable to the supervisory authority.",
          "refs": [
            "1",
            "2"
          ]
        }
      }
    ],
    "fallback": {
      "code": "abstain",
      "title": "Artikeln ger inget utfall på den indata som lämnats",
      "titleEn": "The article yields no outcome for the facts supplied",
      "obligation": "Ingen av artikelns rekvisit är uppfyllda med de uppgifter som lämnats. Lämna fler uppgifter eller läs artikeltexten i sin helhet.",
      "obligationEn": "None of the article's conditions are met with the facts supplied. Supply more facts or read the article in full.",
      "refs": []
    }
  },
  "hash": "sha256:e974027b0cbb8c049fbadb6b4199bcf58f170350894c5ee6cde3b30529afb546",
  "version": "legal-2026-08-25",
  "expires": "2026-08-31T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-08-25+legal-2026-08-25+2026-08-25T10:00:00",
    "content_hash": "sha256:e974027b0cbb8c049fbadb6b4199bcf58f170350894c5ee6cde3b30529afb546",
    "revalidate_after": "2026-08-30T07:06:46.424Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; live-fetch-per-answer; attribution-required; no-derived-index",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/agent/gdpr-2016-679/artikel-32",
  "disclaimer": "Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.",
  "usageInfo": "https://legal.exploreworldai.com/citering"
}