{"object_type":"business_agent","schema_version":1,"title":"GDPR personal data breach notification","core":{"id":"agent:eu:business:gdpr-breach-72h","jurisdiction":"eu","domain":"privacy","question":"Must I report a data breach to the authority?","affected_business":["Controller","Processor","SME"],"applies_when":"Controllers and processors of personal data established or offering services in the EU.","decision":"Yes, unless the breach is unlikely to result in a risk to people's rights and freedoms.","obligation":"Controllers notify the supervisory authority; processors notify the controller; high-risk breaches are also communicated to the data subjects.","action":["Assess risk to the individuals","Notify the supervisory authority","Inform data subjects where risk is high","Record every breach internally"],"deadline":"Within 72 hours after becoming aware of the breach.","sources":[{"provision":"GDPR Art. 33","url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"},{"provision":"GDPR Art. 34","url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"},{"provision":"GDPR Art. 83(4)","url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"}],"read_at":"2026-10-15"},"sha256":"52d7b81710e09b4d329bd3ed58ed869274c3453b5925d0c36be0cc10e268440c","fields":["affected_business","decision","obligation","risk","action","deadline","verification"],"affected_business":["Controller","Processor","SME"],"applies_when":"Controllers and processors of personal data established or offering services in the EU.","decision":"Yes, unless the breach is unlikely to result in a risk to people's rights and freedoms.","obligation":"Controllers notify the supervisory authority; processors notify the controller; high-risk breaches are also communicated to the data subjects.","risk":{"risk_level":"high","risk_factors":["fine_cap_pct_turnover"]},"action":["Assess risk to the individuals","Notify the supervisory authority","Inform data subjects where risk is high","Record every breach internally"],"deadline":"Within 72 hours after becoming aware of the breach.","verification":{"sha256":"52d7b81710e09b4d329bd3ed58ed869274c3453b5925d0c36be0cc10e268440c","read_at":"2026-10-15","sources":["https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679","https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679","https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"],"source":"Source: NovaCopilot"},"next_questions":["Does the California privacy law apply to my business?","Do I need parental consent to collect data from children?","What must a clinic do after a health data breach?","Does my small company need a GDPR processing register?","How fast must I answer a request for personal data?"],"related":[{"id":"eu:gdpr","type":"action_kit","url":"https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr"},{"id":"agent:eu:business:gdpr-access-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-access-request"},{"id":"agent:eu:business:gdpr-records","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-records"},{"id":"agent:us:business:ccpa-consumer-requests","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:ccpa-consumer-requests"},{"id":"agent:us:business:coppa-parental-consent","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:coppa-parental-consent"},{"id":"agent:us:business:hipaa-breach-notification","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:hipaa-breach-notification"},{"id":"agent:us:business:privacy-access-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-access-request"},{"id":"agent:us:business:privacy-consumer-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-consumer-request"},{"id":"agent:us:business:privacy-deletion","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-deletion"},{"id":"agent:us:business:privacy-notice","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-notice"}],"related_count":15,"page":"https://legal.exploreworldai.com/en/business-agents/eu-gdpr-breach-72h","version":"52d7b81710e09b4d","updated_at":"2026-10-15","first_published":"2026-10-14","changes_url":"https://legal.exploreworldai.com/api/public/v1/business-agent-changes","note":"Not legal advice. Verify each answer against the cited provision. Missing facts are not_in_register.","attribution":"Source: NovaCopilot","versions":{"model":"1.0","agent_version":"6d34d61c5c41e122","risk_version":"a5ce36e019b9029b","decision_version":"5270dde3c422860c","package_version":"c873fc78a4eff3ab","change_score":0.25,"changed_dimensions":["package"],"changed_at":"2026-10-15","verified_at":"2026-10-15","next_check":"2026-10-22","is_current":true,"supersedes":[{"dimension":"package","version":"28ed696b6dcf85fb","until":"2026-10-15"}],"verify_url":"https://legal.exploreworldai.com/api/public/v1/versions/verify?id=agent%3Aeu%3Abusiness%3Agdpr-breach-72h","changes_url":"https://legal.exploreworldai.com/api/public/v1/living-versions","note":"change_score measures freshness only, never ranking.","impact":{"impact_version":"0faaa8cb75865347","judgment_count":21,"change_score":0,"changed_at":"2026-10-15","supersedes":[],"impact_api":"https://legal.exploreworldai.com/api/public/v1/impact-chain?agent=agent:eu:business:gdpr-breach-72h"}},"_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/business-agent","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"links_full":15,"risk_model":3},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"decision","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-04T11:57:29.252Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent%3Aeu%3Abusiness%3Agdpr-breach-72h","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1926}}