{"object_type":"business_agent","schema_version":1,"id":"agent:eu:business:gdpr-records","question":"Does my small company need a GDPR processing register?","affected_business":["Controller","Processor","SME"],"decision":"In practice yes for most SMEs, since regular processing such as payroll is not occasional.","obligation":"Keep a written record with purposes, categories, recipients, transfers, retention periods and security measures.","risk":{"risk_level":"high","risk_factors":["fine_cap_pct_turnover"]},"action":["List each processing activity","Record the Article 30 content per activity","Keep the record up to date","Make it available to the authority on request"],"deadline":"No fixed date; the record must be kept current and provided on request.","verification":{"sha256":"eb5ee97debcf93a1b1385541e13dd28155d143e4c6705c5ae26937fd09c23176","read_at":"2026-10-15","sources":["https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679","https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"],"source":"Source: NovaCopilot"},"related":[{"id":"eu:gdpr","type":"action_kit","url":"https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr"},{"id":"agent:eu:business:gdpr-access-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-access-request"},{"id":"agent:eu:business:gdpr-breach-72h","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-breach-72h"},{"id":"agent:us:business:ccpa-consumer-requests","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:ccpa-consumer-requests"},{"id":"agent:us:business:coppa-parental-consent","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:coppa-parental-consent"},{"id":"agent:us:business:hipaa-breach-notification","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:hipaa-breach-notification"},{"id":"agent:us:business:privacy-access-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-access-request"},{"id":"agent:us:business:privacy-consumer-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-consumer-request"},{"id":"agent:us:business:privacy-deletion","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-deletion"},{"id":"agent:us:business:privacy-notice","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-notice"}],"next_questions":["Does the California privacy law apply to my business?","Do I need parental consent to collect data from children?","What must a clinic do after a health data breach?","Must I report a data breach to the authority?","How fast must I answer a request for personal data?"],"version":"eb5ee97debcf93a1","updated_at":"2026-10-15","first_published":"2026-10-14","changes_url":"https://legal.exploreworldai.com/api/public/v1/business-agent-changes","source":"NovaCopilot","versions":{"model":"1.0","agent_version":"bd10ce9182cb1ade","risk_version":"a5ce36e019b9029b","decision_version":"880f1ce975e9e088","package_version":"b5e53dcb435e8bca","change_score":0.25,"changed_dimensions":["package"],"changed_at":"2026-10-15","verified_at":"2026-10-15","next_check":"2026-10-22","is_current":true,"supersedes":[{"dimension":"package","version":"3c2128d59115f291","until":"2026-10-15"}],"verify_url":"https://legal.exploreworldai.com/api/public/v1/versions/verify?id=agent%3Aeu%3Abusiness%3Agdpr-records","changes_url":"https://legal.exploreworldai.com/api/public/v1/living-versions","note":"change_score measures freshness only, never ranking.","impact":{"impact_version":"2ded5b789d87c298","judgment_count":18,"change_score":0,"changed_at":"2026-10-15","supersedes":[],"impact_api":"https://legal.exploreworldai.com/api/public/v1/impact-chain?agent=agent:eu:business:gdpr-records"}},"access_class":"decision","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-03T23:25:54.853Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent%3Aeu%3Abusiness%3Agdpr-records&view=compact","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1267}}