{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-14",
    "fingerprint": "ewai:eu:c8e8e1",
    "proof": "sha256:205e9d55bd0c2d895b8ff20f7e6e835b37970da467e5f79c56da83d218ed384d",
    "jurisdiction": "eu",
    "lang": "en",
    "publisher": "NovaCopilot by ExploreWorld Legal",
    "terms": "https://legal.exploreworldai.com/om"
  },
  "brand_source": "Source: NovaCopilot",
  "status": "ok",
  "agent_id": "agent:eu:gdpr:art-5",
  "schema_version": "1",
  "graph_version": "2026-10-10.2",
  "as_of": "2026-10-14",
  "article": {
    "key": "art-5",
    "number": "5",
    "title": {
      "sv": "Principer för behandling",
      "en": "Principles relating to processing",
      "no": "Prinsipper for behandling",
      "de": "Grundsätze der Verarbeitung"
    },
    "fine_tier": "83-5",
    "node": "article:eu:gdpr:art-5"
  },
  "intelligence_version": "2026-10-10.2+66e611076638",
  "input": {
    "industry": "general",
    "role": "controller",
    "country": "",
    "size": "not_reported",
    "employees": null,
    "turnover_eur": null,
    "controls": []
  },
  "requirements": [
    {
      "id": "requirement:eu:gdpr:art-5-1-a",
      "provision": "Art. 5(1)(a)",
      "label": {
        "sv": "Laglighet, korrekthet och öppenhet",
        "en": "Lawfulness, fairness and transparency",
        "no": "Lovlighet, rettferdighet og åpenhet",
        "de": "Rechtmäßigkeit, Treu und Glauben, Transparenz"
      }
    },
    {
      "id": "requirement:eu:gdpr:art-5-1-b",
      "provision": "Art. 5(1)(b)",
      "label": {
        "sv": "Ändamålsbegränsning",
        "en": "Purpose limitation",
        "no": "Formålsbegrensning",
        "de": "Zweckbindung"
      }
    },
    {
      "id": "requirement:eu:gdpr:art-5-1-c",
      "provision": "Art. 5(1)(c)",
      "label": {
        "sv": "Uppgiftsminimering",
        "en": "Data minimisation",
        "no": "Dataminimering",
        "de": "Datenminimierung"
      }
    },
    {
      "id": "requirement:eu:gdpr:art-5-1-d",
      "provision": "Art. 5(1)(d)",
      "label": {
        "sv": "Korrekthet",
        "en": "Accuracy",
        "no": "Riktighet",
        "de": "Richtigkeit"
      }
    },
    {
      "id": "requirement:eu:gdpr:art-5-1-e",
      "provision": "Art. 5(1)(e)",
      "label": {
        "sv": "Lagringsminimering",
        "en": "Storage limitation",
        "no": "Lagringsbegrensning",
        "de": "Speicherbegrenzung"
      }
    },
    {
      "id": "requirement:eu:gdpr:art-5-1-f",
      "provision": "Art. 5(1)(f)",
      "label": {
        "sv": "Integritet och konfidentialitet",
        "en": "Integrity and confidentiality",
        "no": "Integritet og konfidensialitet",
        "de": "Integrität und Vertraulichkeit"
      }
    },
    {
      "id": "requirement:eu:gdpr:art-5-2",
      "provision": "Art. 5(2)",
      "label": {
        "sv": "Ansvarsskyldighet",
        "en": "Accountability",
        "no": "Ansvarlighet",
        "de": "Rechenschaftspflicht"
      }
    }
  ],
  "sanction": {
    "provision": "Art. 83(5)",
    "cap_fixed_eur": 20000000,
    "cap_turnover_pct": 4,
    "cap_for_entity_eur": "turnover_required"
  },
  "counts": {
    "requirements": 7,
    "controls": 9,
    "evidence": 9,
    "authority_decisions": 372,
    "industry_decisions": 372,
    "scenarios": 10,
    "relationships": 4118,
    "fine": 246,
    "order_or_reprimand": 126
  },
  "scenarios": [
    {
      "key": "ai-training-customer-data",
      "question": {
        "sv": "Får vi använda kunddata för att träna en AI-modell?",
        "en": "Can we use customer data to train an AI model?",
        "no": "Kan vi bruke kundedata til å trene en AI-modell?",
        "de": "Dürfen wir Kundendaten zum Training eines KI-Modells nutzen?"
      },
      "url": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5?scenario=ai-training-customer-data"
    },
    {
      "key": "data-breach-response",
      "question": {
        "sv": "Vi har haft ett säkerhetsintrång, vad gäller nu?",
        "en": "We have had a security breach, what now?",
        "no": "Vi har hatt et sikkerhetsbrudd, hva nå?",
        "de": "Wir hatten eine Datenpanne, was nun?"
      },
      "url": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5?scenario=data-breach-response"
    },
    {
      "key": "email-marketing",
      "question": {
        "sv": "Får vi skicka marknadsföring via e-post till kunder?",
        "en": "Can we send marketing emails to customers?",
        "no": "Kan vi sende markedsføring på e-post til kunder?",
        "de": "Dürfen wir Kunden Werbe-E-Mails senden?"
      },
      "url": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5?scenario=email-marketing"
    },
    {
      "key": "employee-monitoring",
      "question": {
        "sv": "Får vi övervaka anställdas system och e-post?",
        "en": "Can we monitor employees' systems and email?",
        "no": "Kan vi overvåke ansattes systemer og e-post?",
        "de": "Dürfen wir Systeme und E-Mails von Mitarbeitern überwachen?"
      },
      "url": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5?scenario=employee-monitoring"
    },
    {
      "key": "cloud-vendor-onboarding",
      "question": {
        "sv": "Vad måste vi kontrollera innan vi anlitar en molnleverantör?",
        "en": "What must we check before onboarding a cloud provider?",
        "no": "Hva må vi sjekke før vi tar i bruk en skyleverandør?",
        "de": "Was müssen wir vor der Beauftragung eines Cloud-Anbieters prüfen?"
      },
      "url": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5?scenario=cloud-vendor-onboarding"
    },
    {
      "key": "data-retention",
      "question": {
        "sv": "Hur länge får vi spara personuppgifter?",
        "en": "How long may we keep personal data?",
        "no": "Hvor lenge kan vi lagre personopplysninger?",
        "de": "Wie lange dürfen wir personenbezogene Daten speichern?"
      },
      "url": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5?scenario=data-retention"
    },
    {
      "key": "customer-due-diligence",
      "question": {
        "sv": "Hur behandlar vi kunduppgifter vid kundkännedom (KYC)?",
        "en": "How do we process customer data for KYC checks?",
        "no": "Hvordan behandler vi kundedata ved kundekontroll (KYC)?",
        "de": "Wie verarbeiten wir Kundendaten bei der KYC-Prüfung?"
      },
      "url": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5?scenario=customer-due-diligence"
    },
    {
      "key": "web-analytics",
      "question": {
        "sv": "Får vi använda analysverktyg och kakor på webbplatsen?",
        "en": "Can we use analytics tools and cookies on our website?",
        "no": "Kan vi bruke analyseverktøy og informasjonskapsler?",
        "de": "Dürfen wir Analysetools und Cookies einsetzen?"
      },
      "url": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5?scenario=web-analytics"
    },
    {
      "key": "security-testing-programme",
      "question": {
        "sv": "Hur ofta måste vi testa säkerheten?",
        "en": "How often must we test our security?",
        "no": "Hvor ofte må vi teste sikkerheten?",
        "de": "Wie oft müssen wir die Sicherheit testen?"
      },
      "url": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5?scenario=security-testing-programme"
    },
    {
      "key": "contract-processing",
      "question": {
        "sv": "Får vi behandla kunduppgifter för att leverera avtalet?",
        "en": "Can we process customer data to deliver the contract?",
        "no": "Kan vi behandle kundedata for å levere avtalen?",
        "de": "Dürfen wir Kundendaten zur Vertragserfüllung verarbeiten?"
      },
      "url": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5?scenario=contract-processing"
    }
  ],
  "cross_regulation_readiness": [],
  "agent_hash": "51ce17af9926d776740ef67308679f46baca3c86154d90c3f8ba5c20260a3003",
  "hash": "sha256:205e9d55bd0c2d895b8ff20f7e6e835b37970da467e5f79c56da83d218ed384d",
  "endpoints": {
    "self": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5",
    "board": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5?view=board",
    "audit": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5?view=audit",
    "index": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent"
  },
  "provenance": {
    "primary_source": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
    "decisions": "published supervisory decisions in the NovaCopilot register",
    "method": "deterministic rules; editorial control mapping"
  },
  "source": "Source: NovaCopilot",
  "version": "legal-2026-10-14",
  "expires": "2026-10-16T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-14+legal-2026-10-14+2026-10-14T08:26:07",
    "content_hash": "sha256:205e9d55bd0c2d895b8ff20f7e6e835b37970da467e5f79c56da83d218ed384d",
    "revalidate_after": "2026-10-14T10:25:32.362Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/gdpr-agent/art-5",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering",
  "withheld": {
    "industry_model": 6,
    "authority_decisions": 372,
    "case_outcomes": 3,
    "control_mappings": 7,
    "evidence_requirements": 9,
    "risk_patterns": 7,
    "decision_intelligence": 3,
    "board_report": 3,
    "edges": 4118,
    "scenarios.evaluation": 30,
    "supervisory_authority": 2,
    "sanction_benchmark": 8,
    "industry_risk_profile": 6,
    "impact_model": 4,
    "decision_pathway": 6,
    "audit_evidence_pack": 3,
    "authority_benchmark": 5,
    "peer_comparison": 5,
    "recurring_trends": 4,
    "control_effectiveness": 9,
    "compliance_maturity": 2,
    "remediation_estimate": 5,
    "executive_summary": 5
  },
  "access": {
    "status": "partner_key_required",
    "header": "x-partner-key",
    "contact": "https://legal.exploreworldai.com/kontakt",
    "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."
  },
  "access_class": "decision",
  "access_view": "public"
}