{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/duty-objects", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/duty-objects)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-12", "fingerprint": "ewai:eu:b103f9", "proof": "sha256:fefd32de32d1dceb1904646b12c9a68870985417294fa8b5cdb7c1057e3a064f", "jurisdiction": "eu", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "status": "ok", "enterprise_question": "What applies to us and what must we do?", "domain": "gdpr", "label": "GDPR", "question": "What must we do with personal data?", "acts": [ "eu:gdpr" ], "count": 35, "with_deadline": 12, "with_risk": 35, "reviewed_actions": 9, "objects": [ { "id": "duty:eu:gdpr-art-24-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "24", "obligation": "Implement and demonstrate measures that make processing compliant.", "responsible_role": { "legal_role": "controller", "owner_function": "Finance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "internal", "applies_from": "2018-05-25" }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "low", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": null, "max_turnover_pct": null, "sanctions": [ { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 24" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-24-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated record or log entry" } ], "source": { "title": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Implement technical and organisational measures appropriate to the nature, scope, context and purposes of processing and the risks.", "Be able to demonstrate compliance (accountability), for example through policies, records and audits.", "Review and update the measures where necessary." ], "status": "reviewed_action_kit" }, "hash": "sha256:abf963303313f140c53cc188dfe9f2056bd52162369e45f5dbe1653c231ce2ad", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Implement technical and organisational measures appropriate to the nature, scope, context and purposes of processing and the risks.", "Be able to demonstrate compliance (accountability), for example through policies, records and audits.", "Review and update the measures where necessary." ], "steps_status": "reviewed_action_kit", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-24-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-25-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "25", "obligation": "Apply data protection by design and by default.", "responsible_role": { "legal_role": "controller", "owner_function": "Product" }, "deadline": { "value": "At the time of determining the means and at the time of processing.", "note": null, "recipient": "internal", "applies_from": "2018-05-25" }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 25" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-25-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated internal record of the action" } ], "source": { "title": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Build data protection into design, for example pseudonymisation and data minimisation.", "Configure default settings so that only personal data necessary for each purpose are processed.", "Limit amount, extent of processing, storage period and accessibility by default." ], "status": "reviewed_action_kit" }, "hash": "sha256:6ee2e564252ecab36737d40c3243ebd45e6f46d8f4dc54a1d039cadf16de064b", "what_to_do": { "timing": { "kind": "deadline", "text": "At the time of determining the means and at the time of processing." }, "steps": [ "Build data protection into design, for example pseudonymisation and data minimisation.", "Configure default settings so that only personal data necessary for each purpose are processed.", "Limit amount, extent of processing, storage period and accessibility by default." ], "steps_status": "reviewed_action_kit", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-25-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-30-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "30", "obligation": "Keep records of processing activities.", "responsible_role": { "legal_role": "controller", "owner_function": "IT and security" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "internal", "applies_from": "2018-05-25" }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" }, { "provision": "GDPR art. 30.5", "condition": "Fewer than 250 employees, unless the processing is likely to result in a risk, is not occasional, or includes special categories or criminal data.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 30" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-30-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated record or log entry" } ], "source": { "title": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Keep a written, including electronic, record with the items in Art. 30(1): purposes, categories of data subjects and data, recipients, third-country transfers, retention periods and security measures.", "Make the record available to the supervisory authority on request.", "Check the exemption in Art. 30(5) for organisations with fewer than 250 employees; it does not apply where processing is not occasional, involves risk or special categories." ], "status": "reviewed_action_kit" }, "hash": "sha256:141cdbf5ac13f640f5a44f55912eba28debc2b8f5952aa863aec0376bdc48853", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Keep a written, including electronic, record with the items in Art. 30(1): purposes, categories of data subjects and data, recipients, third-country transfers, retention periods and security measures.", "Make the record available to the supervisory authority on request.", "Check the exemption in Art. 30(5) for organisations with fewer than 250 employees; it does not apply where processing is not occasional, involves risk or special categories." ], "steps_status": "reviewed_action_kit", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-30-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-32-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "32", "obligation": "Ensure a level of security appropriate to the risk.", "responsible_role": { "legal_role": "controller", "owner_function": "IT and security" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "internal", "applies_from": "2018-05-25" }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 32" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-32-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Published notice or disclosure" } ], "source": { "title": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Assess the risks of processing, especially accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.", "Apply measures such as pseudonymisation and encryption.", "Ensure ongoing confidentiality, integrity, availability and resilience, and the ability to restore access in a timely manner.", "Regularly test, assess and evaluate the effectiveness of the measures." ], "status": "reviewed_action_kit" }, "hash": "sha256:8d2b96cfe6df5e54bab02c3700bd922fce42e45f6ea0088a978260454d97ce08", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assess the risks of processing, especially accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.", "Apply measures such as pseudonymisation and encryption.", "Ensure ongoing confidentiality, integrity, availability and resilience, and the ability to restore access in a timely manner.", "Regularly test, assess and evaluate the effectiveness of the measures." ], "steps_status": "reviewed_action_kit", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-32-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-33-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "33", "obligation": "Notify a personal data breach to the supervisory authority.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "72 hours", "note": "Not later than 72 hours after becoming aware, where feasible.", "recipient": "Competent supervisory authority", "applies_from": "2018-05-25" }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" }, { "provision": "GDPR art. 33.1", "condition": "The personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 33" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-33-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Copy of notification with timestamp" } ], "source": { "title": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Assess whether the breach is likely to result in a risk to individuals; if not, notification is not required but the breach must still be documented.", "Notify the supervisory authority with the information in Art. 33(3); information may be provided in phases.", "Give reasons if notification is made after 72 hours.", "Document all breaches, effects and remedial action (Art. 33(5)) and notify data subjects without undue delay where the risk is high (Art. 34)." ], "status": "reviewed_action_kit" }, "hash": "sha256:cb0f1196634a7b5a238eb360072d0b79ccf65de6db79dfa4345d90b8d4682203", "what_to_do": { "timing": { "kind": "deadline", "text": "72 hours" }, "steps": [ "Assess whether the breach is likely to result in a risk to individuals; if not, notification is not required but the breach must still be documented.", "Notify the supervisory authority with the information in Art. 33(3); information may be provided in phases.", "Give reasons if notification is made after 72 hours.", "Document all breaches, effects and remedial action (Art. 33(5)) and notify data subjects without undue delay where the risk is high (Art. 34)." ], "steps_status": "reviewed_action_kit", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-33-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-35-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "35", "obligation": "Carry out a data protection impact assessment for high-risk processing.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "Prior to the processing.", "note": null, "recipient": "internal", "applies_from": "2018-05-25" }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 35" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-35-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Signed impact assessment" } ], "source": { "title": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Check whether processing is likely to result in high risk, including the cases in Art. 35(3) and the supervisory authority's list.", "Carry out the assessment with at least the content in Art. 35(7) and seek the advice of the data protection officer where designated.", "Consult the supervisory authority before processing if residual risk remains high (Art. 36).", "Review the assessment when the risk changes." ], "status": "reviewed_action_kit" }, "hash": "sha256:0bb215b6c51e99758851f60cda1d310a7006c742cada59fe186eda1f3f38345a", "what_to_do": { "timing": { "kind": "deadline", "text": "Prior to the processing." }, "steps": [ "Check whether processing is likely to result in high risk, including the cases in Art. 35(3) and the supervisory authority's list.", "Carry out the assessment with at least the content in Art. 35(7) and seek the advice of the data protection officer where designated.", "Consult the supervisory authority before processing if residual risk remains high (Art. 36).", "Review the assessment when the risk changes." ], "steps_status": "reviewed_action_kit", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-35-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-28-processor", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "28", "obligation": "Process only on documented instructions under a written contract.", "responsible_role": { "legal_role": "processor", "owner_function": "Legal and compliance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "internal", "applies_from": "2018-05-25" }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 28" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-28-processor", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Published notice or disclosure" } ], "source": { "title": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Process personal data only on documented instructions from the controller, and inform the controller if an instruction infringes data protection law.", "Ensure persons authorised to process data are bound by confidentiality.", "Engage sub-processors only with the controller's prior written authorisation and on equivalent terms.", "Assist the controller with data subject rights and Art. 32 to 36, delete or return data at the end of the service, and make information available for audits." ], "status": "reviewed_action_kit" }, "hash": "sha256:52e9618f4902d1b9d34760207d10803abe948be09bcffea08200ca25ffc3f963", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Process personal data only on documented instructions from the controller, and inform the controller if an instruction infringes data protection law.", "Ensure persons authorised to process data are bound by confidentiality.", "Engage sub-processors only with the controller's prior written authorisation and on equivalent terms.", "Assist the controller with data subject rights and Art. 32 to 36, delete or return data at the end of the service, and make information available for audits." ], "steps_status": "reviewed_action_kit", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-28-processor" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-32-processor", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "32", "obligation": "Ensure a level of security appropriate to the risk.", "responsible_role": { "legal_role": "processor", "owner_function": "IT and security" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "internal", "applies_from": "2018-05-25" }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 32" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-32-processor", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated internal record of the action" } ], "source": { "title": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Apply the same risk-based security measures as in Art. 32(1).", "Ensure that persons acting under your authority process data only on the controller's instructions.", "Regularly test the effectiveness of the measures." ], "status": "reviewed_action_kit" }, "hash": "sha256:ec948afa7f8e8aaf9ad4b6514836bcff44f77c4bbff0a711bc862f23400efa24", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Apply the same risk-based security measures as in Art. 32(1).", "Ensure that persons acting under your authority process data only on the controller's instructions.", "Regularly test the effectiveness of the measures." ], "steps_status": "reviewed_action_kit", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-32-processor" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-33-processor", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "33", "obligation": "Notify the controller without undue delay after becoming aware of a breach.", "responsible_role": { "legal_role": "processor", "owner_function": "Legal and compliance" }, "deadline": { "value": "Without undue delay after becoming aware.", "note": null, "recipient": "The controller", "applies_from": "2018-05-25" }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" }, { "provision": "GDPR art. 33.1", "condition": "The personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 33" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-33-processor", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Copy of notification with timestamp" } ], "source": { "title": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Notify the controller of the breach.", "Provide the information the controller needs to meet Art. 33 and 34.", "Follow any shorter time limit agreed in the processing contract." ], "status": "reviewed_action_kit" }, "hash": "sha256:bc6da42c985642efdabff9319d167b05a03c84a0935c33d5ea77090a2ca06b51", "what_to_do": { "timing": { "kind": "deadline", "text": "Without undue delay after becoming aware." }, "steps": [ "Notify the controller of the breach.", "Provide the information the controller needs to meet Art. 33 and 34.", "Follow any shorter time limit agreed in the processing contract." ], "steps_status": "reviewed_action_kit", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-33-processor" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-5-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "5", "obligation": "Process personal data in line with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and be able to demonstrate compliance (accountability).", "responsible_role": { "legal_role": "controller", "owner_function": "Finance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "internal", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 5" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-5-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Published notice or disclosure" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Process personal data in line with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and be able to demonstrate compliance (accountability)." ], "status": "derived_from_duty" }, "hash": "sha256:6d30161018cba3a1f70778be97ec976012a622844b4500cfd501ebd076da7a7f", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: controller (Finance).", "Carry out the duty: Process personal data in line with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and be able to demonstrate compliance (accountability).", "Document: Published notice or disclosure.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 5 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-5-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-6-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "6", "obligation": "Process personal data only where at least one legal basis in Article 6(1) applies.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "internal", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 6" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-6-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated internal record of the action" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Process personal data only where at least one legal basis in Article 6(1) applies." ], "status": "derived_from_duty" }, "hash": "sha256:26c273c4a2455c0c0334075ee8460bd92917cf61b24404f2da2640ee630c2d95", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Process personal data only where at least one legal basis in Article 6(1) applies.", "Document: Dated internal record of the action.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 6 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-6-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-12-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "12", "obligation": "Provide information on action taken on a data subject request under Articles 15 to 22 without undue delay and in any event within one month of receipt of the request.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "30 days", "note": "Within one month of receipt of the request; may be extended by two further months where necessary, taking into account the complexity and number of the requests, with the data subject informed within one month (Art. 12(3)).", "recipient": "Data subject", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 12" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-12-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Published notice or disclosure" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Provide information on action taken on a data subject request under Articles 15 to 22 without undue delay and in any event within one month of receipt of the request." ], "status": "derived_from_duty" }, "hash": "sha256:c83686b8751175cea2b8859a833e0b2cc7c666d25328694d9718eb9293e4987f", "what_to_do": { "timing": { "kind": "deadline", "text": "30 days" }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Provide information on action taken on a data subject request under Articles 15 to 22 without undue delay and in any event within one month of receipt of the request.", "Document: Published notice or disclosure.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 12 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-12-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-15-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "15", "obligation": "Give the data subject confirmation as to whether personal data concerning him or her are being processed, access to the personal data and the information listed in Article 15(1), and a copy of the data.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "Data subject", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 15" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-15-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Published notice or disclosure" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Give the data subject confirmation as to whether personal data concerning him or her are being processed, access to the personal data and the information listed in Article 15(1), and a copy of the data." ], "status": "derived_from_duty" }, "hash": "sha256:dcfd11a57fc2cbb31619ceecef118e08e132dd879666df5c0a82fb7f6940f0c1", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Give the data subject confirmation as to whether personal data concerning him or her are being processed, access to the personal data and the information listed in Article 15(1), and a copy of the data.", "Document: Published notice or disclosure.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 15 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-15-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-17-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "17", "obligation": "Erase personal data without undue delay where one of the grounds in Article 17(1) applies.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "Data subject", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 17" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-17-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated internal record of the action" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Erase personal data without undue delay where one of the grounds in Article 17(1) applies." ], "status": "derived_from_duty" }, "hash": "sha256:1848d4c73e5d60194c83ac03e0aecf3d27ffa0f14f7ae08ac8dfe07b527cc4a1", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Erase personal data without undue delay where one of the grounds in Article 17(1) applies.", "Document: Dated internal record of the action.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 17 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-17-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-7-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "7", "obligation": "Be able to demonstrate consent where processing is based on consent, present consent requests clearly distinguishable from other matters, and make withdrawal as easy as giving consent.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "internal", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 7" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-7-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated internal record of the action" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Be able to demonstrate consent where processing is based on consent, present consent requests clearly distinguishable from other matters, and make withdrawal as easy as giving consent." ], "status": "derived_from_duty" }, "hash": "sha256:d18763cd11b0ddf420c517529a5dba949df509d721120b593604723b95fcd6f4", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Be able to demonstrate consent where processing is based on consent, present consent requests clearly distinguishable from other matters, and make withdrawal as easy as giving consent.", "Document: Dated internal record of the action.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 7 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-7-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-8-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "8", "obligation": "Obtain consent from the holder of parental responsibility when offering information society services directly to a child below 16, or the lower national age of at least 13, and make reasonable efforts to verify it.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "internal", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 8" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-8-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Published notice or disclosure" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Obtain consent from the holder of parental responsibility when offering information society services directly to a child below 16, or the lower national age of at least 13, and make reasonable efforts to verify it." ], "status": "derived_from_duty" }, "hash": "sha256:efb16168fa9f7ec558bfbffafc6eeeaa17c47f7d2efbae87908dad837127b64e", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Obtain consent from the holder of parental responsibility when offering information society services directly to a child below 16, or the lower national age of at least 13, and make reasonable efforts to verify it.", "Document: Published notice or disclosure.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 8 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-8-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-9-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "9", "obligation": "Do not process special categories of personal data unless an exception in Article 9(2) applies.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "internal", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 9" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-9-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated internal record of the action" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Do not process special categories of personal data unless an exception in Article 9(2) applies." ], "status": "derived_from_duty" }, "hash": "sha256:64582db05b0005711674d00bc430ffbea5d8a14cf46cf1cd271f7f7d7a8cd33c", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Do not process special categories of personal data unless an exception in Article 9(2) applies.", "Document: Dated internal record of the action.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 9 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-9-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-13-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "13", "obligation": "Give the data subject the information listed in Article 13, including identity, purposes, legal basis, recipients, transfers, retention period and rights, when personal data are obtained from the data subject.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "At the time when the personal data are obtained.", "note": null, "recipient": "Data subject", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 13" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-13-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Published notice or disclosure" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Give the data subject the information listed in Article 13, including identity, purposes, legal basis, recipients, transfers, retention period and rights, when personal data are obtained from the data subject." ], "status": "derived_from_duty" }, "hash": "sha256:e2f1c988f43931ea77396ccc00a85e2450f110fe1304d054604c75c0832730b3", "what_to_do": { "timing": { "kind": "deadline", "text": "At the time when the personal data are obtained." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Give the data subject the information listed in Article 13, including identity, purposes, legal basis, recipients, transfers, retention period and rights, when personal data are obtained from the data subject.", "Document: Published notice or disclosure.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 13 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-13-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-14-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "14", "obligation": "Give the data subject the information listed in Article 14 where personal data have not been obtained from the data subject, including the source of the data.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "30 days", "note": "Within a reasonable period and at the latest within one month after obtaining the data; at the latest at the first communication or first disclosure to another recipient, if earlier (Art. 14(3)).", "recipient": "Data subject", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 14" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-14-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Published notice or disclosure" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Give the data subject the information listed in Article 14 where personal data have not been obtained from the data subject, including the source of the data." ], "status": "derived_from_duty" }, "hash": "sha256:382f1672ae4901c79baf15d4112c51288a982cade97bad2859af6dba17e10eb6", "what_to_do": { "timing": { "kind": "deadline", "text": "30 days" }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Give the data subject the information listed in Article 14 where personal data have not been obtained from the data subject, including the source of the data.", "Document: Published notice or disclosure.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 14 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-14-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-16-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "16", "obligation": "Rectify inaccurate personal data and complete incomplete data on the data subject's request.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "Without undue delay; response within the one-month period in Article 12(3).", "note": null, "recipient": "Data subject", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 16" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-16-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated internal record of the action" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Rectify inaccurate personal data and complete incomplete data on the data subject's request." ], "status": "derived_from_duty" }, "hash": "sha256:e4a753c252a19c191f1b77eea2c199891498dd3614bfbac0799bee3a91f0b13d", "what_to_do": { "timing": { "kind": "deadline", "text": "Without undue delay; response within the one-month period in Article 12(3)." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Rectify inaccurate personal data and complete incomplete data on the data subject's request.", "Document: Dated internal record of the action.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 16 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-16-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-18-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "18", "obligation": "Restrict processing where the data subject contests accuracy, the processing is unlawful, the data are needed for legal claims or an objection is pending.", "responsible_role": { "legal_role": "controller", "owner_function": "IT and security" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "Data subject", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 18" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-18-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated internal record of the action" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Restrict processing where the data subject contests accuracy, the processing is unlawful, the data are needed for legal claims or an objection is pending." ], "status": "derived_from_duty" }, "hash": "sha256:4e1a2562eded6fb59caf62d9bf171d21193ecba25b1548fcf89fc16e55a0647b", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: controller (IT and security).", "Carry out the duty: Restrict processing where the data subject contests accuracy, the processing is unlawful, the data are needed for legal claims or an objection is pending.", "Document: Dated internal record of the action.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 18 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-18-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-19-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "19", "obligation": "Communicate any rectification, erasure or restriction to each recipient to whom the data have been disclosed, unless impossible or involving disproportionate effort.", "responsible_role": { "legal_role": "controller", "owner_function": "IT and security" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "Recipients of the data", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 19" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-19-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Published notice or disclosure" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Communicate any rectification, erasure or restriction to each recipient to whom the data have been disclosed, unless impossible or involving disproportionate effort." ], "status": "derived_from_duty" }, "hash": "sha256:40b5d8deb85e1863c7079b920fcab6c534543b578fd8557d1b4094f07d5c4039", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: controller (IT and security).", "Carry out the duty: Communicate any rectification, erasure or restriction to each recipient to whom the data have been disclosed, unless impossible or involving disproportionate effort.", "Document: Published notice or disclosure.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 19 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-19-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-20-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "20", "obligation": "Provide personal data processed by automated means on the basis of consent or contract in a structured, commonly used and machine-readable format, and transmit it to another controller where technically feasible.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "Within one month of the request (Art. 12(3)).", "note": null, "recipient": "Data subject or another controller", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 20" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-20-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Signed contract clause" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Provide personal data processed by automated means on the basis of consent or contract in a structured, commonly used and machine-readable format, and transmit it to another controller where technically feasible." ], "status": "derived_from_duty" }, "hash": "sha256:ecb57d6773dd10de843c6100cd3acc1374c36ccb0f583d5484e9f65e8ebdc51c", "what_to_do": { "timing": { "kind": "deadline", "text": "Within one month of the request (Art. 12(3))." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Provide personal data processed by automated means on the basis of consent or contract in a structured, commonly used and machine-readable format, and transmit it to another controller where technically feasible.", "Document: Signed contract clause.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 20 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-20-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-21-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "21", "obligation": "Stop processing based on Article 6(1)(e) or (f) on objection unless compelling legitimate grounds override, and always stop processing for direct marketing on objection.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "The right to object must be explicitly brought to the data subject's attention at the latest at the first communication.", "note": null, "recipient": "Data subject", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 21" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-21-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated internal record of the action" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Stop processing based on Article 6(1)(e) or (f) on objection unless compelling legitimate grounds override, and always stop processing for direct marketing on objection." ], "status": "derived_from_duty" }, "hash": "sha256:7f1a83a6582122ef21e674c53cde534f970fa04a555cf876481e364c6ca31447", "what_to_do": { "timing": { "kind": "deadline", "text": "The right to object must be explicitly brought to the data subject's attention at the latest at the first communication." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Stop processing based on Article 6(1)(e) or (f) on objection unless compelling legitimate grounds override, and always stop processing for direct marketing on objection.", "Document: Dated internal record of the action.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 21 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-21-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-22-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "22", "obligation": "Do not subject a data subject to a decision based solely on automated processing with legal or similarly significant effects unless an exception applies, and then provide human intervention, the right to express a view and to contest the decision.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "Data subject", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 22" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-22-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated internal record of the action" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Do not subject a data subject to a decision based solely on automated processing with legal or similarly significant effects unless an exception applies, and then provide human intervention, the right to express a view and to contest the decision." ], "status": "derived_from_duty" }, "hash": "sha256:fcec299f80365e104168e0df42d08bc0f1ca4ecbd84f1ac7102724ba6725e573", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Do not subject a data subject to a decision based solely on automated processing with legal or similarly significant effects unless an exception applies, and then provide human intervention, the right to express a view and to contest the decision.", "Document: Dated internal record of the action.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 22 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-22-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-26-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "26", "obligation": "Determine joint controllers' respective responsibilities in a transparent arrangement and make its essence available to the data subject.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "internal", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 26" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-26-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Published notice or disclosure" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Determine joint controllers' respective responsibilities in a transparent arrangement and make its essence available to the data subject." ], "status": "derived_from_duty" }, "hash": "sha256:aa1b48ac1194cb5098c16e3896861fc87ba138eed54528c4d0bfdcbf056e31ad", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Determine joint controllers' respective responsibilities in a transparent arrangement and make its essence available to the data subject.", "Document: Published notice or disclosure.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 26 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-26-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-27-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "27", "obligation": "Designate in writing a representative in the Union when not established in the Union but subject to Article 3(2), unless the processing is occasional and low risk.", "responsible_role": { "legal_role": "controller", "owner_function": "Product" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "Representative in a member state", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 27" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-27-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated internal record of the action" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Designate in writing a representative in the Union when not established in the Union but subject to Article 3(2), unless the processing is occasional and low risk." ], "status": "derived_from_duty" }, "hash": "sha256:89e2c82e21e6dffaac0d735a733ad7e7cd7bea97307f06909385e1bad546360c", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: controller (Product).", "Carry out the duty: Designate in writing a representative in the Union when not established in the Union but subject to Article 3(2), unless the processing is occasional and low risk.", "Document: Dated internal record of the action.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 27 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-27-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-31-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "31", "obligation": "Cooperate with the supervisory authority in the performance of its tasks on request.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "Supervisory authority", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 31" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-31-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated internal record of the action" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Cooperate with the supervisory authority in the performance of its tasks on request." ], "status": "derived_from_duty" }, "hash": "sha256:d295845e04ecaa5ecb83e194e2a96cae3d57fa01cd581c4ceb0f16033f74f5c6", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Cooperate with the supervisory authority in the performance of its tasks on request.", "Document: Dated internal record of the action.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 31 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-31-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-34-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "34", "obligation": "Communicate a personal data breach likely to result in a high risk to the rights and freedoms of natural persons to the data subjects in clear and plain language.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "Without undue delay; not required where Article 34(3) applies (encryption, subsequent measures or disproportionate effort with public communication).", "note": null, "recipient": "Data subjects", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" }, { "provision": "GDPR art. 34.3", "condition": "The data was protected (e.g. encrypted), later measures remove the high risk, or individual notice would involve disproportionate effort (then public communication).", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 34" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-34-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated internal record of the action" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Communicate a personal data breach likely to result in a high risk to the rights and freedoms of natural persons to the data subjects in clear and plain language." ], "status": "derived_from_duty" }, "hash": "sha256:43300c98f7a7eb51394845cc2866723e53953a0214b28ec3f228edb8dfb527ad", "what_to_do": { "timing": { "kind": "deadline", "text": "Without undue delay; not required where Article 34(3) applies (encryption, subsequent measures or disproportionate effort with public communication)." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Communicate a personal data breach likely to result in a high risk to the rights and freedoms of natural persons to the data subjects in clear and plain language.", "Document: Dated internal record of the action.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 34 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-34-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-36-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "36", "obligation": "Consult the supervisory authority before processing where a data protection impact assessment indicates high risk in the absence of mitigating measures.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "Before processing. The authority gives written advice within eight weeks, extendable by six weeks (Art. 36(2)).", "note": null, "recipient": "Supervisory authority", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 36" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-36-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Signed impact assessment" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Consult the supervisory authority before processing where a data protection impact assessment indicates high risk in the absence of mitigating measures." ], "status": "derived_from_duty" }, "hash": "sha256:da081d1f4c9b762eda15c60d3c58f2e8fea5b2933d561b8516edbdbfc9870f6f", "what_to_do": { "timing": { "kind": "deadline", "text": "Before processing. The authority gives written advice within eight weeks, extendable by six weeks (Art. 36(2))." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Consult the supervisory authority before processing where a data protection impact assessment indicates high risk in the absence of mitigating measures.", "Document: Signed impact assessment.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 36 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-36-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-37-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "37", "obligation": "Designate a data protection officer where the core activities are public authority processing, large-scale regular and systematic monitoring, or large-scale special category or criminal data, and publish the contact details.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "Supervisory authority (contact details)", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 37" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-37-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Published notice or disclosure" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Designate a data protection officer where the core activities are public authority processing, large-scale regular and systematic monitoring, or large-scale special category or criminal data, and publish the contact details." ], "status": "derived_from_duty" }, "hash": "sha256:da7948faefeebee170fbcb6c0b1e9b03f62480f600638e555d2a59022d0fb1f0", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Designate a data protection officer where the core activities are public authority processing, large-scale regular and systematic monitoring, or large-scale special category or criminal data, and publish the contact details.", "Document: Published notice or disclosure.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 37 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-37-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-44-controller", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "44", "obligation": "Transfer personal data to a third country or international organisation only under an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a derogation in Article 49.", "responsible_role": { "legal_role": "controller", "owner_function": "Legal and compliance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "internal", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 44" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-44-controller", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Signed contract clause" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Transfer personal data to a third country or international organisation only under an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a derogation in Article 49." ], "status": "derived_from_duty" }, "hash": "sha256:8c8bce3b6986313a8a466d02ad5eb530f870ae2dff18afad86ecb7b7e02e2c0c", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: controller (Legal and compliance).", "Carry out the duty: Transfer personal data to a third country or international organisation only under an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a derogation in Article 49.", "Document: Signed contract clause.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 44 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-44-controller" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-28-2-processor", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "28(2)", "obligation": "Do not engage another processor without prior specific or general written authorisation of the controller, and inform the controller of intended changes so it can object.", "responsible_role": { "legal_role": "processor", "owner_function": "Legal and compliance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "The controller", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 28(2)" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-28-2-processor", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Published notice or disclosure" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Do not engage another processor without prior specific or general written authorisation of the controller, and inform the controller of intended changes so it can object." ], "status": "derived_from_duty" }, "hash": "sha256:8f05e0eed911cdb141728591b3c5c84483c9485a488f18f705c75ae5cbd8740b", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: processor (Legal and compliance).", "Carry out the duty: Do not engage another processor without prior specific or general written authorisation of the controller, and inform the controller of intended changes so it can object.", "Document: Published notice or disclosure.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 28(2) before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-28-2-processor" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-30-processor", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "30", "obligation": "Maintain a written record of all categories of processing activities carried out on behalf of each controller.", "responsible_role": { "legal_role": "processor", "owner_function": "Legal and compliance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "internal", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" }, { "provision": "GDPR art. 30.5", "condition": "Fewer than 250 employees, unless the processing is likely to result in a risk, is not occasional, or includes special categories or criminal data.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 30" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-30-processor", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated record or log entry" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Maintain a written record of all categories of processing activities carried out on behalf of each controller." ], "status": "derived_from_duty" }, "hash": "sha256:c7f906f1d0cbb5675453bfb5702d8c4f04505bb6b2a537bedbc23157fb52cae9", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: processor (Legal and compliance).", "Carry out the duty: Maintain a written record of all categories of processing activities carried out on behalf of each controller.", "Document: Dated record or log entry.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 30 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-30-processor" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" }, { "id": "duty:eu:gdpr-art-44-processor", "schema_version": 1, "domain": "gdpr", "jurisdiction": "eu", "act": "gdpr", "provision": "44", "obligation": "Transfer personal data to a third country or international organisation only under Chapter V safeguards.", "responsible_role": { "legal_role": "processor", "owner_function": "Legal and compliance" }, "deadline": { "value": "not_in_register", "note": null, "recipient": "internal", "applies_from": null }, "exceptions": [ { "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" } ], "risk": { "level": "high", "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low", "max_amount": "EUR 20 000 000", "max_turnover_pct": 4, "sanctions": [ { "id": "sanction:eu:gdpr-art-83-5", "authority": "Competent supervisory authority" }, { "id": "sanction:eu:gdpr-art-58-2", "authority": "Competent supervisory authority" } ] }, "evidence_chain": [ { "step": 1, "kind": "primary_source", "ref": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "step": 2, "kind": "provision", "ref": "gdpr 44" }, { "step": 3, "kind": "obligation", "ref": "obligation:eu:gdpr-art-44-processor", "method": "Paraphrased from the provision text" }, { "step": 4, "kind": "evidence_to_keep", "ref": "Dated internal record of the action" } ], "source": { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "recommended_action": { "do": [ "Transfer personal data to a third country or international organisation only under Chapter V safeguards." ], "status": "derived_from_duty" }, "hash": "sha256:1beae1bb1e63d6870bbe9b4b58ca7ae5290c30b6ba37018c46ae1bf715327d39", "what_to_do": { "timing": { "kind": "ongoing", "text": "Applies on an ongoing basis while the conditions in the provision are met." }, "steps": [ "Assign responsibility: processor (Legal and compliance).", "Carry out the duty: Transfer personal data to a third country or international organisation only under Chapter V safeguards.", "Document: Dated internal record of the action.", "Check the wording of Regulation (EU) 2016/679 (GDPR) 44 before deciding." ], "steps_status": "derived_from_provision", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "gaps": [ "statutory_deadline", "reviewed_action_kit" ], "links": { "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr", "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr", "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr", "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-44-processor" }, "read_at": "2026-08-31", "source_label": "Source: NovaCopilot" } ], "source": "NovaCopilot", "hash": "sha256:fefd32de32d1dceb1904646b12c9a68870985417294fa8b5cdb7c1057e3a064f", "version": "legal-2026-10-12", "expires": "2026-10-13T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-12+legal-2026-10-12+2026-10-12T06:12:17", "content_hash": "sha256:fefd32de32d1dceb1904646b12c9a68870985417294fa8b5cdb7c1057e3a064f", "revalidate_after": "2026-10-12T07:43:57.175Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/duty-objects", "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering" }