{
  "object_type": "business_agent",
  "schema_version": 1,
  "title": "GDPR record of processing activities",
  "core": {
    "id": "agent:eu:business:gdpr-records",
    "jurisdiction": "eu",
    "domain": "privacy",
    "question": "Does my small company need a GDPR processing register?",
    "affected_business": [
      "Controller",
      "Processor",
      "SME"
    ],
    "applies_when": "All controllers and processors; organisations under 250 employees only when processing is not occasional, is likely to result in a risk, or includes special categories or criminal data.",
    "decision": "In practice yes for most SMEs, since regular processing such as payroll is not occasional.",
    "obligation": "Keep a written record with purposes, categories, recipients, transfers, retention periods and security measures.",
    "action": [
      "List each processing activity",
      "Record the Article 30 content per activity",
      "Keep the record up to date",
      "Make it available to the authority on request"
    ],
    "deadline": "No fixed date; the record must be kept current and provided on request.",
    "sources": [
      {
        "provision": "GDPR Art. 30",
        "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"
      },
      {
        "provision": "GDPR Art. 83(4)",
        "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"
      }
    ],
    "read_at": "2026-10-15"
  },
  "sha256": "eb5ee97debcf93a1b1385541e13dd28155d143e4c6705c5ae26937fd09c23176",
  "fields": [
    "affected_business",
    "decision",
    "obligation",
    "risk",
    "action",
    "deadline",
    "verification"
  ],
  "affected_business": [
    "Controller",
    "Processor",
    "SME"
  ],
  "applies_when": "All controllers and processors; organisations under 250 employees only when processing is not occasional, is likely to result in a risk, or includes special categories or criminal data.",
  "decision": "In practice yes for most SMEs, since regular processing such as payroll is not occasional.",
  "obligation": "Keep a written record with purposes, categories, recipients, transfers, retention periods and security measures.",
  "risk": {
    "risk_level": "high",
    "risk_factors": [
      "fine_cap_pct_turnover"
    ]
  },
  "action": [
    "List each processing activity",
    "Record the Article 30 content per activity",
    "Keep the record up to date",
    "Make it available to the authority on request"
  ],
  "deadline": "No fixed date; the record must be kept current and provided on request.",
  "verification": {
    "sha256": "eb5ee97debcf93a1b1385541e13dd28155d143e4c6705c5ae26937fd09c23176",
    "read_at": "2026-10-15",
    "sources": [
      "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679",
      "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"
    ],
    "source": "Source: NovaCopilot"
  },
  "next_questions": [
    "Does the California privacy law apply to my business?",
    "Do I need parental consent to collect data from children?",
    "What must a clinic do after a health data breach?",
    "Must I report a data breach to the authority?",
    "How fast must I answer a request for personal data?"
  ],
  "related": [
    {
      "id": "eu:gdpr",
      "type": "action_kit",
      "url": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr"
    },
    {
      "id": "agent:eu:business:gdpr-access-request",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-access-request"
    },
    {
      "id": "agent:eu:business:gdpr-breach-72h",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-breach-72h"
    },
    {
      "id": "agent:us:business:ccpa-consumer-requests",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:ccpa-consumer-requests"
    },
    {
      "id": "agent:us:business:coppa-parental-consent",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:coppa-parental-consent"
    },
    {
      "id": "agent:us:business:hipaa-breach-notification",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:hipaa-breach-notification"
    },
    {
      "id": "agent:us:business:privacy-access-request",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-access-request"
    },
    {
      "id": "agent:us:business:privacy-consumer-request",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-consumer-request"
    },
    {
      "id": "agent:us:business:privacy-deletion",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-deletion"
    },
    {
      "id": "agent:us:business:privacy-notice",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-notice"
    }
  ],
  "related_count": 12,
  "page": "https://legal.exploreworldai.com/en/business-agents/eu-gdpr-records",
  "version": "eb5ee97debcf93a1",
  "updated_at": "2026-10-15",
  "first_published": "2026-10-14",
  "changes_url": "https://legal.exploreworldai.com/api/public/v1/business-agent-changes",
  "note": "Not legal advice. Verify each answer against the cited provision. Missing facts are not_in_register.",
  "attribution": "Source: NovaCopilot",
  "versions": {
    "model": "1.0",
    "agent_version": "bd10ce9182cb1ade",
    "risk_version": "a5ce36e019b9029b",
    "decision_version": "880f1ce975e9e088",
    "package_version": "b5e53dcb435e8bca",
    "change_score": 0.25,
    "changed_dimensions": [
      "package"
    ],
    "changed_at": "2026-10-15",
    "verified_at": "2026-10-15",
    "next_check": "2026-10-22",
    "is_current": true,
    "supersedes": [
      {
        "dimension": "package",
        "version": "3c2128d59115f291",
        "until": "2026-10-15"
      }
    ],
    "verify_url": "https://legal.exploreworldai.com/api/public/v1/versions/verify?id=agent%3Aeu%3Abusiness%3Agdpr-records",
    "changes_url": "https://legal.exploreworldai.com/api/public/v1/living-versions",
    "note": "change_score measures freshness only, never ranking.",
    "impact": {
      "impact_version": "2ded5b789d87c298",
      "judgment_count": 18,
      "change_score": 0,
      "changed_at": "2026-10-15",
      "supersedes": [],
      "impact_api": "https://legal.exploreworldai.com/api/public/v1/impact-chain?agent=agent:eu:business:gdpr-records"
    }
  },
  "_sweep_notice": {
    "mode": "citation",
    "reason": "corpus sweep without measurable return",
    "vendor": "Anthropic",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/business-agent",
    "full_text": "https://legal.exploreworldai.com/enterprise",
    "attribution": "cite the canonical URL when the answer uses this source"
  },
  "withheld": {
    "links_full": 12,
    "risk_model": 3
  },
  "access": {
    "status": "partner_key_required",
    "header": "x-partner-key",
    "contact": "https://legal.exploreworldai.com/kontakt",
    "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."
  },
  "access_class": "decision",
  "access_view": "public"
}