{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/agent/gdpr-2016-679/artikel-33",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-08-25",
    "proof": "sha256:2d51de6f6ec9c332268003f1aba46800d1abeea81e3f3fc40b97e9562009dbe2",
    "jurisdiction": "eu"
  },
  "id": "gdpr-2016-679-33",
  "script": {
    "kind": "operative",
    "fields": [
      {
        "name": "breach",
        "kind": "boolean",
        "label": "En personuppgiftsincident har inträffat",
        "labelEn": "A personal data breach has occurred"
      },
      {
        "name": "risk_to_rights",
        "kind": "boolean",
        "label": "Incidenten kan medföra en risk för rättigheter och friheter",
        "labelEn": "The breach may result in a risk to rights and freedoms"
      },
      {
        "name": "hours_since_aware",
        "kind": "number",
        "label": "Timmar sedan incidenten upptäcktes",
        "labelEn": "Hours since becoming aware"
      }
    ],
    "rules": [
      {
        "id": "33-none",
        "when": {
          "op": "equals",
          "field": "breach",
          "value": false
        },
        "outcome": {
          "code": "no-breach",
          "title": "Ingen incident",
          "titleEn": "No breach",
          "obligation": "Anmälningsplikten aktualiseras inte.",
          "obligationEn": "The duty to notify is not triggered.",
          "refs": [
            "1"
          ]
        }
      },
      {
        "id": "33-no-risk",
        "when": {
          "op": "equals",
          "field": "risk_to_rights",
          "value": false
        },
        "outcome": {
          "code": "documented-only",
          "title": "Anmälan krävs inte, dokumentation krävs",
          "titleEn": "No notification required, documentation required",
          "obligation": "Är det osannolikt att incidenten medför en risk behöver den inte anmälas, men den ska dokumenteras enligt artikel 33.5.",
          "obligationEn": "Where the breach is unlikely to result in a risk it need not be notified, but it shall be documented under Article 33(5).",
          "refs": [
            "1",
            "5"
          ]
        }
      },
      {
        "id": "33-late",
        "when": {
          "op": "gte",
          "field": "hours_since_aware",
          "value": 72
        },
        "outcome": {
          "code": "late-notification",
          "title": "72-timmarsfristen är passerad",
          "titleEn": "The 72 hour deadline has passed",
          "obligation": "Anmälan ska ändå göras, med en motivering till förseningen enligt artikel 33.1.",
          "obligationEn": "The notification shall still be made, accompanied by the reasons for the delay under Article 33(1).",
          "refs": [
            "1"
          ]
        }
      },
      {
        "id": "33-notify",
        "when": {
          "op": "equals",
          "field": "risk_to_rights",
          "value": true
        },
        "outcome": {
          "code": "notify",
          "title": "Anmälan till tillsynsmyndigheten krävs",
          "titleEn": "Notification to the supervisory authority is required",
          "obligation": "Anmälan ska göras utan onödigt dröjsmål och senast 72 timmar efter upptäckten, med innehållet i artikel 33.3.",
          "obligationEn": "The notification shall be made without undue delay and within 72 hours of becoming aware, with the content in Article 33(3).",
          "refs": [
            "1",
            "3"
          ]
        }
      }
    ],
    "fallback": {
      "code": "abstain",
      "title": "Artikeln ger inget utfall på den indata som lämnats",
      "titleEn": "The article yields no outcome for the facts supplied",
      "obligation": "Ingen av artikelns rekvisit är uppfyllda med de uppgifter som lämnats. Lämna fler uppgifter eller läs artikeltexten i sin helhet.",
      "obligationEn": "None of the article's conditions are met with the facts supplied. Supply more facts or read the article in full.",
      "refs": []
    }
  },
  "hash": "sha256:2d51de6f6ec9c332268003f1aba46800d1abeea81e3f3fc40b97e9562009dbe2",
  "version": "legal-2026-08-25",
  "expires": "2026-08-31T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-08-25+legal-2026-08-25+2026-08-25T10:00:00",
    "content_hash": "sha256:2d51de6f6ec9c332268003f1aba46800d1abeea81e3f3fc40b97e9562009dbe2",
    "revalidate_after": "2026-08-30T07:06:43.868Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; live-fetch-per-answer; attribution-required; no-derived-index",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/agent/gdpr-2016-679/artikel-33",
  "disclaimer": "Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.",
  "usageInfo": "https://legal.exploreworldai.com/citering"
}