{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-32", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-32)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-15", "fingerprint": "ewai:eu:ed53ea", "proof": "sha256:21ef327c2fbd7bd9be6346c9b81a2323164dfdebde09cde874e62611736fb1a2", "jurisdiction": "eu", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "status": "ok", "agent_id": "agent:eu:gdpr:art-32", "schema_version": "1", "graph_version": "2026-10-10.2", "as_of": "2026-10-15", "article": { "key": "art-32", "number": "32", "title": { "sv": "Säkerhet i samband med behandlingen", "en": "Security of processing", "no": "Sikkerhet ved behandlingen", "de": "Sicherheit der Verarbeitung" }, "fine_tier": "83-4", "node": "article:eu:gdpr:art-32" }, "intelligence_version": "2026-10-10.2+4b65c516bd35", "input": { "industry": "general", "role": "controller", "country": "", "size": "not_reported", "employees": null, "turnover_eur": null, "controls": [] }, "requirements": [ { "id": "requirement:eu:gdpr:art-32-1-a", "provision": "Art. 32(1)(a)", "label": { "sv": "Pseudonymisering och kryptering", "en": "Pseudonymisation and encryption", "no": "Pseudonymisering og kryptering", "de": "Pseudonymisierung und Verschlüsselung" } }, { "id": "requirement:eu:gdpr:art-32-1-b", "provision": "Art. 32(1)(b)", "label": { "sv": "Konfidentialitet, integritet, tillgänglighet och motståndskraft", "en": "Confidentiality, integrity, availability and resilience", "no": "Konfidensialitet, integritet, tilgjengelighet og robusthet", "de": "Vertraulichkeit, Integrität, Verfügbarkeit und Belastbarkeit" } }, { "id": "requirement:eu:gdpr:art-32-1-c", "provision": "Art. 32(1)(c)", "label": { "sv": "Återställning efter incident", "en": "Restore availability after an incident", "no": "Gjenoppretting etter hendelse", "de": "Wiederherstellung nach einem Zwischenfall" } }, { "id": "requirement:eu:gdpr:art-32-1-d", "provision": "Art. 32(1)(d)", "label": { "sv": "Regelbunden testning och utvärdering", "en": "Regular testing and evaluation", "no": "Regelmessig testing og evaluering", "de": "Regelmäßige Überprüfung und Bewertung" } } ], "sanction": { "provision": "Art. 83(4)", "cap_fixed_eur": 10000000, "cap_turnover_pct": 2, "cap_for_entity_eur": "turnover_required" }, "counts": { "requirements": 4, "controls": 4, "evidence": 4, "authority_decisions": 222, "industry_decisions": 222, "scenarios": 4, "relationships": 1361, "fine": 157, "order_or_reprimand": 65 }, "scenarios": [ { "key": "ai-training-customer-data", "question": { "sv": "Får vi använda kunddata för att träna en AI-modell?", "en": "Can we use customer data to train an AI model?", "no": "Kan vi bruke kundedata til å trene en AI-modell?", "de": "Dürfen wir Kundendaten zum Training eines KI-Modells nutzen?" }, "url": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-32?scenario=ai-training-customer-data" }, { "key": "data-breach-response", "question": { "sv": "Vi har haft ett säkerhetsintrång, vad gäller nu?", "en": "We have had a security breach, what now?", "no": "Vi har hatt et sikkerhetsbrudd, hva nå?", "de": "Wir hatten eine Datenpanne, was nun?" }, "url": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-32?scenario=data-breach-response" }, { "key": "cloud-vendor-onboarding", "question": { "sv": "Vad måste vi kontrollera innan vi anlitar en molnleverantör?", "en": "What must we check before onboarding a cloud provider?", "no": "Hva må vi sjekke før vi tar i bruk en skyleverandør?", "de": "Was müssen wir vor der Beauftragung eines Cloud-Anbieters prüfen?" }, "url": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-32?scenario=cloud-vendor-onboarding" }, { "key": "security-testing-programme", "question": { "sv": "Hur ofta måste vi testa säkerheten?", "en": "How often must we test our security?", "no": "Hvor ofte må vi teste sikkerheten?", "de": "Wie oft müssen wir die Sicherheit testen?" }, "url": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-32?scenario=security-testing-programme" } ], "cross_regulation_readiness": [], "agent_hash": "5509cda514f8697d583908164daf7fd85eca632f652cd0d8e204d82d3e26ccd8", "hash": "sha256:21ef327c2fbd7bd9be6346c9b81a2323164dfdebde09cde874e62611736fb1a2", "endpoints": { "self": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-32", "board": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-32?view=board", "audit": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-32?view=audit", "index": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent" }, "provenance": { "primary_source": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "decisions": "published supervisory decisions in the NovaCopilot register", "method": "deterministic rules; editorial control mapping" }, "source": "Source: NovaCopilot", "version": "legal-2026-10-15", "expires": "2026-10-16T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-15+legal-2026-10-15+2026-10-15T15:06:19", "content_hash": "sha256:21ef327c2fbd7bd9be6346c9b81a2323164dfdebde09cde874e62611736fb1a2", "revalidate_after": "2026-10-15T16:53:00.741Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-32", "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering", "withheld": { "industry_model": 6, "authority_decisions": 222, "case_outcomes": 3, "control_mappings": 4, "evidence_requirements": 4, "risk_patterns": 7, "decision_intelligence": 3, "board_report": 3, "edges": 1361, "scenarios.evaluation": 12, "supervisory_authority": 2, "sanction_benchmark": 8, "industry_risk_profile": 6, "impact_model": 4, "decision_pathway": 6, "audit_evidence_pack": 3, "authority_benchmark": 5, "peer_comparison": 5, "recurring_trends": 4, "control_effectiveness": 4, "compliance_maturity": 2, "remediation_estimate": 5, "executive_summary": 5 }, "access": { "status": "partner_key_required", "header": "x-partner-key", "contact": "https://legal.exploreworldai.com/kontakt", "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot." }, "access_class": "decision", "access_view": "public" }