{"object_type":"business_agent","schema_version":1,"id":"agent:eu:business:gdpr-breach-72h","question":"Must I report a data breach to the authority?","affected_business":["Controller","Processor","SME"],"decision":"Yes, unless the breach is unlikely to result in a risk to people's rights and freedoms.","obligation":"Controllers notify the supervisory authority; processors notify the controller; high-risk breaches are also communicated to the data subjects.","risk":{"risk_level":"high","risk_factors":["fine_cap_pct_turnover"]},"action":["Assess risk to the individuals","Notify the supervisory authority","Inform data subjects where risk is high","Record every breach internally"],"deadline":"Within 72 hours after becoming aware of the breach.","verification":{"sha256":"52d7b81710e09b4d329bd3ed58ed869274c3453b5925d0c36be0cc10e268440c","read_at":"2026-10-15","sources":["https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679","https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679","https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"],"source":"Source: NovaCopilot"},"related":[{"id":"eu:gdpr","type":"action_kit","url":"https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr"},{"id":"agent:eu:business:gdpr-access-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-access-request"},{"id":"agent:eu:business:gdpr-records","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-records"},{"id":"agent:us:business:ccpa-consumer-requests","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:ccpa-consumer-requests"},{"id":"agent:us:business:coppa-parental-consent","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:coppa-parental-consent"},{"id":"agent:us:business:hipaa-breach-notification","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:hipaa-breach-notification"},{"id":"agent:us:business:privacy-access-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-access-request"},{"id":"agent:us:business:privacy-consumer-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-consumer-request"},{"id":"agent:us:business:privacy-deletion","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-deletion"},{"id":"agent:us:business:privacy-notice","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-notice"}],"next_questions":["Does the California privacy law apply to my business?","Do I need parental consent to collect data from children?","What must a clinic do after a health data breach?","Does my small company need a GDPR processing register?","How fast must I answer a request for personal data?"],"version":"52d7b81710e09b4d","updated_at":"2026-10-15","first_published":"2026-10-14","changes_url":"https://legal.exploreworldai.com/api/public/v1/business-agent-changes","source":"NovaCopilot","versions":{"model":"1.0","agent_version":"6d34d61c5c41e122","risk_version":"a5ce36e019b9029b","decision_version":"5270dde3c422860c","package_version":"c873fc78a4eff3ab","change_score":0.25,"changed_dimensions":["package"],"changed_at":"2026-10-15","verified_at":"2026-10-15","next_check":"2026-10-22","is_current":true,"supersedes":[{"dimension":"package","version":"28ed696b6dcf85fb","until":"2026-10-15"}],"verify_url":"https://legal.exploreworldai.com/api/public/v1/versions/verify?id=agent%3Aeu%3Abusiness%3Agdpr-breach-72h","changes_url":"https://legal.exploreworldai.com/api/public/v1/living-versions","note":"change_score measures freshness only, never ranking.","impact":{"impact_version":"0faaa8cb75865347","judgment_count":21,"change_score":0,"changed_at":"2026-10-15","supersedes":[],"impact_api":"https://legal.exploreworldai.com/api/public/v1/impact-chain?agent=agent:eu:business:gdpr-breach-72h"}},"_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/business-agent","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"access_class":"decision","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-04T03:54:53.050Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent%3Aeu%3Abusiness%3Agdpr-breach-72h&view=compact","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1375}}