{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/engines/package",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/engines/package)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-07",
    "fingerprint": "ewai:eu:6e5359",
    "proof": "sha256:f92107ea00ea29ac1666932e37a931854adcfc8ad099348a9909130c9490bd51",
    "jurisdiction": "eu",
    "lang": "en",
    "publisher": "NovaCopilot by ExploreWorld Legal",
    "terms": "https://legal.exploreworldai.com/om"
  },
  "brand_source": "Source: NovaCopilot",
  "status": "ok",
  "gate": {
    "pass": true,
    "source": true,
    "date": true,
    "evidence": true,
    "missing": []
  },
  "engine": "Agent Packages",
  "id": "package:eu:q-processor-documentation",
  "risk_answer": {
    "question": "What is the risk?",
    "risk_level": "high",
    "consequence": "administrative_fine up to EUR 10 000 000 or 2 % of turnover (Competent supervisory authority); corrective_order (Competent supervisory authority)",
    "current_amounts": [
      {
        "sanction": "sanction:eu:gdpr-art-83-4",
        "authority": "Competent supervisory authority",
        "statute_amount": "EUR 10 000 000",
        "current": "Same as statute text (EU amounts are not inflation-adjusted)",
        "status": "fixed_in_statute",
        "source_url": "https://eur-lex.europa.eu"
      },
      {
        "sanction": "sanction:eu:gdpr-art-58-2",
        "authority": "Competent supervisory authority",
        "statute_amount": null,
        "current": "Same as statute text (EU amounts are not inflation-adjusted)",
        "status": "fixed_in_statute",
        "source_url": "https://eur-lex.europa.eu"
      }
    ],
    "applies_to_me": {
      "in_scope_if": "You process personal data as controller or processor established in the EU, or you offer goods or services to, or monitor, people in the EU (Art. 3).",
      "thresholds": [
        {
          "test": "Employees",
          "value": "Fewer than 250",
          "effect": "lighter_regime"
        }
      ],
      "status": "verified",
      "url": "https://legal.exploreworldai.com/api/public/v1/applicability?act=gdpr"
    },
    "leading_case": "eu:c-798-24",
    "read_at": "2026-10-07",
    "links": {
      "enforcement": "https://legal.exploreworldai.com/api/public/v1/engines/outcome?id=eu:gdpr",
      "risk_chain": "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr",
      "package": "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:q-processor-documentation"
    }
  },
  "decision_object": {
    "risk": {
      "level": "high",
      "see": "risk_answer"
    },
    "outcome": {
      "url": "https://legal.exploreworldai.com/api/public/v1/engines/outcome?id=eu%3Agdpr"
    },
    "exception": {
      "count": 1,
      "url": "https://legal.exploreworldai.com/api/public/v1/engines/exception?id=eu%3Agdpr-art-28-processor"
    },
    "timeline": {
      "in_application": true,
      "next_milestone": null,
      "url": "https://legal.exploreworldai.com/api/public/v1/engines/timeline?id=eu%3Agdpr"
    },
    "conflict": {
      "url": "https://legal.exploreworldai.com/api/public/v1/engines/conflict?id=eu%3Ac-798-24"
    },
    "citation_graph": {
      "url": "https://legal.exploreworldai.com/api/public/v1/engines/citation?id=eu%3Ac-798-24"
    },
    "source": {
      "title": "GDPR: Regulation (EU) 2016/679",
      "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
    },
    "token_estimate": 229,
    "tokens_saved": 22571
  },
  "question": "Which documentation requirements apply to data processors and controllers under GDPR?",
  "answer": "A processor may only act on documented instructions under a written contract, and the controller must keep records of processing activities, demonstrate compliance and carry out impact assessments for high-risk processing. Both must document security measures appropriate to the risk (GDPR art. 24, 28, 30, 32 and 35).",
  "obligation": "obligation:eu:gdpr-art-28-processor",
  "exceptions": [
    {
      "id": "exception:eu:gdpr-household",
      "provision": "GDPR art. 2.2 c",
      "condition": "Processing by a natural person in the course of a purely personal or household activity.",
      "effect": "not_applicable"
    }
  ],
  "deadline": null,
  "timeline": {
    "in_application": true,
    "next_milestone": null,
    "relative_deadlines": [
      "72 hours",
      "30 days"
    ]
  },
  "source": {
    "title": "GDPR: Regulation (EU) 2016/679",
    "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
  },
  "contract": "frozen_core_v1",
  "frozen_fields": [
    "question",
    "answer",
    "obligation",
    "exceptions",
    "deadline",
    "timeline",
    "source"
  ],
  "complete_kit": {
    "kit_type": "flagship_question",
    "obligations": [
      {
        "id": "obligation:eu:gdpr-art-28-processor",
        "role": "processor",
        "provision": "GDPR: Regulation (EU) 2016/679",
        "duty": "Process only on documented instructions under a written contract.",
        "deadline": null,
        "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
      },
      {
        "id": "obligation:eu:gdpr-art-30-controller",
        "role": "controller",
        "provision": "GDPR: Regulation (EU) 2016/679",
        "duty": "Keep records of processing activities.",
        "deadline": null,
        "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
      },
      {
        "id": "obligation:eu:gdpr-art-24-controller",
        "role": "controller",
        "provision": "GDPR: Regulation (EU) 2016/679",
        "duty": "Implement and demonstrate measures that make processing compliant.",
        "deadline": null,
        "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
      },
      {
        "id": "obligation:eu:gdpr-art-32-processor",
        "role": "processor",
        "provision": "GDPR: Regulation (EU) 2016/679",
        "duty": "Ensure a level of security appropriate to the risk.",
        "deadline": null,
        "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
      },
      {
        "id": "obligation:eu:gdpr-art-35-controller",
        "role": "controller",
        "provision": "GDPR: Regulation (EU) 2016/679",
        "duty": "Carry out a data protection impact assessment for high-risk processing.",
        "deadline": null,
        "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
      }
    ],
    "sanctions": [
      {
        "id": "sanction:eu:gdpr-art-83-4",
        "type": "administrative_fine",
        "authority": "Competent supervisory authority",
        "max_amount": "EUR 10 000 000",
        "max_turnover_pct": 2,
        "provision": "Regulation (EU) 2016/679 (GDPR)",
        "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
      },
      {
        "id": "sanction:eu:gdpr-art-58-2",
        "type": "corrective_order",
        "authority": "Competent supervisory authority",
        "max_amount": null,
        "max_turnover_pct": null,
        "provision": "Regulation (EU) 2016/679 (GDPR)",
        "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
      }
    ],
    "exceptions": [
      {
        "id": "exception:eu:gdpr-household",
        "provision": "GDPR art. 2.2 c",
        "condition": "Processing by a natural person in the course of a purely personal or household activity.",
        "effect": "not_applicable"
      },
      {
        "id": "exception:eu:gdpr-household",
        "provision": "GDPR art. 2.2 c",
        "condition": "Processing by a natural person in the course of a purely personal or household activity.",
        "effect": "not_applicable"
      },
      {
        "id": "exception:eu:gdpr-records-under-250",
        "provision": "GDPR art. 30.5",
        "condition": "Fewer than 250 employees, unless the processing is likely to result in a risk, is not occasional, or includes special categories or criminal data.",
        "effect": "not_applicable"
      },
      {
        "id": "exception:eu:gdpr-household",
        "provision": "GDPR art. 2.2 c",
        "condition": "Processing by a natural person in the course of a purely personal or household activity.",
        "effect": "not_applicable"
      },
      {
        "id": "exception:eu:gdpr-household",
        "provision": "GDPR art. 2.2 c",
        "condition": "Processing by a natural person in the course of a purely personal or household activity.",
        "effect": "not_applicable"
      },
      {
        "id": "exception:eu:gdpr-household",
        "provision": "GDPR art. 2.2 c",
        "condition": "Processing by a natural person in the course of a purely personal or household activity.",
        "effect": "not_applicable"
      }
    ],
    "checklist": [
      "1. Process only on documented instructions under a written contract (GDPR: Regulation (EU) 2016/679).",
      "2. Keep records of processing activities (GDPR: Regulation (EU) 2016/679).",
      "3. Implement and demonstrate measures that make processing compliant (GDPR: Regulation (EU) 2016/679).",
      "4. Ensure a level of security appropriate to the risk (GDPR: Regulation (EU) 2016/679).",
      "5. Carry out a data protection impact assessment for high-risk processing (GDPR: Regulation (EU) 2016/679)."
    ],
    "leading_cases": [
      "eu:c-798-24",
      "eu:c-474-24",
      "eu:c-199-24-62024cj0199"
    ],
    "sme_kit": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr",
    "fetches_saved": 11,
    "note": "Everything needed to answer is embedded. Follow links only to verify."
  },
  "risk_level": "high",
  "risk_reason": "Breach of GDPR: Regulation (EU) 2016/679: Process only on documented instructions under a written contract.",
  "risk_consequence": "administrative_fine up to EUR 10 000 000 or 2 % of turnover (Competent supervisory authority); corrective_order (Competent supervisory authority)",
  "risk_source": {
    "provision": "Regulation (EU) 2016/679 (GDPR)",
    "authority": "Competent supervisory authority",
    "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
  },
  "verification_state": "partially_verified",
  "verified_at": "2026-08-31",
  "verified_sources": [
    "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
    "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"
  ],
  "note": "Exception wording is drawn from the provision but not yet checked verbatim against the official text.",
  "related_packages": [
    "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-24-controller",
    "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-25-controller",
    "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-30-controller",
    "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-32-controller",
    "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-33-controller",
    "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-35-controller",
    "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-32-processor",
    "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-33-processor"
  ],
  "related_obligations": [
    "obligation:eu:gdpr-art-24-controller",
    "obligation:eu:gdpr-art-25-controller",
    "obligation:eu:gdpr-art-30-controller",
    "obligation:eu:gdpr-art-32-controller",
    "obligation:eu:gdpr-art-33-controller",
    "obligation:eu:gdpr-art-35-controller",
    "obligation:eu:gdpr-art-32-processor",
    "obligation:eu:gdpr-art-33-processor"
  ],
  "related_exemptions": [
    "exception:eu:gdpr-household"
  ],
  "related_cases": [
    "eu:c-798-24",
    "eu:c-474-24",
    "eu:c-199-24-62024cj0199"
  ],
  "related_authorities": [
    "Competent supervisory authority"
  ],
  "related_statistics": [
    "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr",
    "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr"
  ],
  "last_changed": "2026-10-06",
  "change_type": "new_package",
  "change_reason": "Unchanged since first publication.",
  "previous_hash": null,
  "precedent_strength": "leading",
  "leading_cases": [
    "eu:c-798-24",
    "eu:c-474-24",
    "eu:c-199-24-62024cj0199"
  ],
  "contradicting_cases": [],
  "basis": "37 judgments in the register for gdpr.",
  "token_estimate": 229,
  "retrieval_equivalent_tokens_saved": 22571,
  "estimated_source_documents": 8,
  "method": "token_estimate = characters/4 of the frozen core. Retrieval equivalent: provision 1200, judgment 6000, sanction 600 tokens each.",
  "usable_without_further_analysis": true,
  "gaps": [],
  "generative_output": false,
  "links": {
    "obligation": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-28-processor",
    "compliance_effect": "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-28-processor",
    "exceptions": "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-28-processor",
    "timeline": "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr",
    "risk_chain": "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--processor",
    "changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes?type=package",
    "index": "https://legal.exploreworldai.com/api/public/v1/agent-packages"
  },
  "hash": "sha256:f92107ea00ea29ac1666932e37a931854adcfc8ad099348a9909130c9490bd51",
  "change": {
    "last_changed": "2026-10-06",
    "change_type": "new_package",
    "hash_before": null,
    "hash_after": "dc72f97f6be7cb0ec351e8fc334dc33c1306e1f3cec38271de10607bc2aad6a3",
    "history": "https://legal.exploreworldai.com/api/public/v1/objects/changes?type=package"
  },
  "version": "legal-2026-10-07",
  "expires": "2026-10-10T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-07+legal-2026-10-07+2026-10-07T14:29:26",
    "content_hash": "sha256:f92107ea00ea29ac1666932e37a931854adcfc8ad099348a9909130c9490bd51",
    "revalidate_after": "2026-10-07T15:51:38.573Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/engines/package",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering"
}