{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/intelligence/article/eu:gdpr/32/agent-control",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/intelligence/article/eu:gdpr/32/agent-control)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-28",
    "fingerprint": "ewai:eu:f1349d",
    "proof": "sha256:59fd9b1087b29d77151bd3d7d081040d467f715c7e85c22a3a80f49313c49071",
    "jurisdiction": "eu",
    "lang": "en"
  },
  "brand_source": "Source: NovaCopilot",
  "id": "article:eu:gdpr:32",
  "regulation": "eu:gdpr",
  "article": "32",
  "view": "agent-control",
  "version": "article-depth-1.0.0",
  "status": "in_register",
  "controls": [
    {
      "id": "control:eu:gdpr:access-control",
      "label": "Access control",
      "category": "not_in_register",
      "registered_control_key": "access-control",
      "maturity": "defined",
      "maturity_scope": "registered_definition_not_customer_assessment",
      "review_frequency": "quarterly access review",
      "owner": "CISO",
      "evidence_strength": "moderate",
      "evidence_strength_scope": "named_evidence_types_not_verified_customer_evidence",
      "implementation_examples": [
        "evidence:eu:gdpr:access-review-log"
      ],
      "required_evidence": [
        "evidence:eu:gdpr:access-review-log"
      ],
      "requirements": [
        "requirement:eu:gdpr:art-32-1-b"
      ],
      "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
    },
    {
      "id": "control:eu:gdpr:backup-restore",
      "label": "Backup and restore",
      "category": "not_in_register",
      "registered_control_key": "backup-restore",
      "maturity": "defined",
      "maturity_scope": "registered_definition_not_customer_assessment",
      "review_frequency": "restore test yearly",
      "owner": "IT operations",
      "evidence_strength": "moderate",
      "evidence_strength_scope": "named_evidence_types_not_verified_customer_evidence",
      "implementation_examples": [
        "evidence:eu:gdpr:restore-test-report"
      ],
      "required_evidence": [
        "evidence:eu:gdpr:restore-test-report"
      ],
      "requirements": [
        "requirement:eu:gdpr:art-32-1-c"
      ],
      "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
    },
    {
      "id": "control:eu:gdpr:encryption",
      "label": "Encryption",
      "category": "not_in_register",
      "registered_control_key": "encryption",
      "maturity": "defined",
      "maturity_scope": "registered_definition_not_customer_assessment",
      "review_frequency": "continuous, reviewed yearly",
      "owner": "CISO",
      "evidence_strength": "moderate",
      "evidence_strength_scope": "named_evidence_types_not_verified_customer_evidence",
      "implementation_examples": [
        "evidence:eu:gdpr:encryption-policy"
      ],
      "required_evidence": [
        "evidence:eu:gdpr:encryption-policy"
      ],
      "requirements": [
        "requirement:eu:gdpr:art-32-1-a"
      ],
      "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
    },
    {
      "id": "control:eu:gdpr:security-testing",
      "label": "Security testing",
      "category": "not_in_register",
      "registered_control_key": "security-testing",
      "maturity": "defined",
      "maturity_scope": "registered_definition_not_customer_assessment",
      "review_frequency": "yearly and after major change",
      "owner": "CISO",
      "evidence_strength": "moderate",
      "evidence_strength_scope": "named_evidence_types_not_verified_customer_evidence",
      "implementation_examples": [
        "evidence:eu:gdpr:penetration-test-report"
      ],
      "required_evidence": [
        "evidence:eu:gdpr:penetration-test-report"
      ],
      "requirements": [
        "requirement:eu:gdpr:art-32-1-d"
      ],
      "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
    }
  ],
  "actions": [
    {
      "requirement": "obligation:eu:gdpr-art-32-controller",
      "do": [
        "Assess the risks of processing, especially accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.",
        "Apply measures such as pseudonymisation and encryption.",
        "Ensure ongoing confidentiality, integrity, availability and resilience, and the ability to restore access in a timely manner.",
        "Regularly test, assess and evaluate the effectiveness of the measures."
      ],
      "status": "reviewed_action_kit"
    },
    {
      "requirement": "obligation:eu:gdpr-art-32-processor",
      "do": [
        "Apply the same risk-based security measures as in Art. 32(1).",
        "Ensure that persons acting under your authority process data only on the controller's instructions.",
        "Regularly test the effectiveness of the measures."
      ],
      "status": "reviewed_action_kit"
    }
  ],
  "trust_score": 71,
  "source_references": [
    "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
  ],
  "views": "https://legal.exploreworldai.com/api/public/v1/intelligence/article/eu:gdpr/32/full",
  "source": "Source: NovaCopilot",
  "outcomes_generated_at": "2026-10-26",
  "hash": "sha256:59fd9b1087b29d77151bd3d7d081040d467f715c7e85c22a3a80f49313c49071",
  "citation_version": "legal-2026-10-28",
  "expires": "2026-10-29T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-28+legal-2026-10-28+2026-10-28T09:07:38",
    "content_hash": "sha256:59fd9b1087b29d77151bd3d7d081040d467f715c7e85c22a3a80f49313c49071",
    "revalidate_after": "2026-10-28T10:58:30.832Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/intelligence/article/eu:gdpr/32/agent-control",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering",
  "withheld": {
    "partner": 3
  },
  "access": {
    "status": "partner_key_required",
    "header": "x-partner-key",
    "contact": "https://legal.exploreworldai.com/kontakt",
    "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."
  },
  "access_class": "public",
  "access_view": "public"
}