{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-07", "fingerprint": "ewai:se:d7907c", "proof": "sha256:b1e3cd60cfa71dd68e9d260f113bd7ada098d366295c4f137c09168aa16073cc", "jurisdiction": "se", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "brand": { "product": "NovaCopilot", "platform": "ExploreWorldAI", "infrastructure": "ExploreWorld Legal", "infrastructure_url": "legal.exploreworldai.com", "legal_entity": "Valkiv Ventures AB", "permanent_url": "https://legal.exploreworldai.com/novacopilot", "source": "Source: NovaCopilot", "powered_by": "Powered by NovaCopilot", "license": "https://legal.exploreworldai.com/licensvillkor", "contact": "stig@valkiv.com" }, "object_type": "action_kit", "object_id": "action_kit:eu:gdpr", "schema_version": "1", "schema": "https://legal.exploreworldai.com/api/public/v1/schemas/action_kit", "url": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr", "judgment": { "id": "eu:gdpr", "text": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:gdpr" }, "siblings": { "risk": "https://legal.exploreworldai.com/api/public/v1/obj/risk/eu:gdpr", "relation": "https://legal.exploreworldai.com/api/public/v1/obj/relation/eu:gdpr", "change": "https://legal.exploreworldai.com/api/public/v1/obj/change/eu:gdpr", "agent": "https://legal.exploreworldai.com/api/public/v1/obj/agent/eu:gdpr", "provenance": "https://legal.exploreworldai.com/api/public/v1/obj/provenance/eu:gdpr", "status": "https://legal.exploreworldai.com/api/public/v1/obj/status/eu:gdpr", "precedent": "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:gdpr", "edge": "https://legal.exploreworldai.com/api/public/v1/obj/edge/eu:gdpr", "element": "https://legal.exploreworldai.com/api/public/v1/obj/element/eu:gdpr", "decision": "https://legal.exploreworldai.com/api/public/v1/obj/decision/eu:gdpr", "obligation": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr", "sanction": "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr", "weight": "https://legal.exploreworldai.com/api/public/v1/obj/weight/eu:gdpr", "conflict": "https://legal.exploreworldai.com/api/public/v1/obj/conflict/eu:gdpr", "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr", "provision_link": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr", "brief": "https://legal.exploreworldai.com/api/public/v1/obj/brief/eu:gdpr", "citation_graph": "https://legal.exploreworldai.com/api/public/v1/obj/citation_graph/eu:gdpr", "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr", "risk_chain": "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr", "compliance_effect": "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr", "answer_node": "https://legal.exploreworldai.com/api/public/v1/obj/answer_node/eu:gdpr", "exception": "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr", "timeline": "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr", "package": "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr", "case_kit": "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:gdpr", "documentation_requirement": "https://legal.exploreworldai.com/api/public/v1/obj/documentation_requirement/eu:gdpr", "sme_kit": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr" }, "source": "NovaCopilot", "precedent_graph": "https://legal.exploreworldai.com/api/public/v1/precedent-graph/eu:gdpr", "item": { "coverage": { "complete": 5, "total": 5, "label": "5 of 5 answers ready" }, "subject": "eu:gdpr", "act": "gdpr", "article": null, "actions": [ { "obligation": "obligation:eu:gdpr-art-24-controller", "verification": "design", "sanctions": [ "sanction:eu:gdpr-art-58-2" ] }, { "obligation": "obligation:eu:gdpr-art-25-controller", "verification": "design", "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ] }, { "obligation": "obligation:eu:gdpr-art-30-controller", "verification": "register", "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ] }, { "obligation": "obligation:eu:gdpr-art-32-controller", "verification": "internal_review", "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ] }, { "obligation": "obligation:eu:gdpr-art-33-controller", "verification": "authority_filing", "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ] }, { "obligation": "obligation:eu:gdpr-art-35-controller", "verification": "assessment", "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ] }, { "obligation": "obligation:eu:gdpr-art-28-processor", "verification": "contract", "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ] }, { "obligation": "obligation:eu:gdpr-art-32-processor", "verification": "internal_review", "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ] }, { "obligation": "obligation:eu:gdpr-art-33-processor", "verification": "authority_filing", "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ] }, { "obligation": "obligation:eu:gdpr-art-5-controller", "verification": "internal_review", "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-5" ] }, { "obligation": "obligation:eu:gdpr-art-6-controller", "verification": "internal_review", "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-5" ] }, { "obligation": "obligation:eu:gdpr-art-12-controller", "verification": "internal_review", "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-5" ] }, { "obligation": "obligation:eu:gdpr-art-15-controller", "verification": "internal_review", "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-5" ] }, { "obligation": "obligation:eu:gdpr-art-17-controller", "verification": "internal_review", "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-5" ] } ], "answers": [ { "key": "what_to_do", "status": "ready", "sha256": "65d3669a421419abb9f451bc8cf6029e72b847ce0e3da8a3bc6c5cef84e6b7d0" }, { "key": "who", "status": "ready", "sha256": "9a5a96374c26ac8c0247c0c6416bc93cc17878d14bc0b04c5bfbde78f798f3d0" }, { "key": "verification", "status": "ready", "sha256": "4f1938f91dc68b118f3af2ae98498077953df64676132aed95e65d677f0f10aa" }, { "key": "documents", "status": "ready", "sha256": "0496fdec8ddbef5a527f09c5bae80a514652c74dda0ca37f7a2ec53dcfa93230" }, { "key": "if_not_met", "status": "ready", "sha256": "d52861f5fde0e2c75315c8601f35223334dfbce8f80e7e805941550e104cf367" } ], "answers_full": [ { "key": "what_to_do", "status": "ready", "answer": "Implement and demonstrate measures that make processing compliant. Apply data protection by design and by default. Keep records of processing activities. (+11 more)", "ids": [ "obligation:eu:gdpr-art-24-controller", "obligation:eu:gdpr-art-25-controller", "obligation:eu:gdpr-art-30-controller", "obligation:eu:gdpr-art-32-controller", "obligation:eu:gdpr-art-33-controller", "obligation:eu:gdpr-art-35-controller", "obligation:eu:gdpr-art-28-processor", "obligation:eu:gdpr-art-32-processor", "obligation:eu:gdpr-art-33-processor", "obligation:eu:gdpr-art-5-controller", "obligation:eu:gdpr-art-6-controller", "obligation:eu:gdpr-art-12-controller", "obligation:eu:gdpr-art-15-controller", "obligation:eu:gdpr-art-17-controller" ], "question": "What must I do?", "sha256": "65d3669a421419abb9f451bc8cf6029e72b847ce0e3da8a3bc6c5cef84e6b7d0" }, { "key": "who", "status": "ready", "answer": "Responsible roles: controller, processor.", "ids": [ "obligation:eu:gdpr-art-24-controller", "obligation:eu:gdpr-art-25-controller", "obligation:eu:gdpr-art-30-controller", "obligation:eu:gdpr-art-32-controller", "obligation:eu:gdpr-art-33-controller", "obligation:eu:gdpr-art-35-controller", "obligation:eu:gdpr-art-28-processor", "obligation:eu:gdpr-art-32-processor", "obligation:eu:gdpr-art-33-processor", "obligation:eu:gdpr-art-5-controller", "obligation:eu:gdpr-art-6-controller", "obligation:eu:gdpr-art-12-controller", "obligation:eu:gdpr-art-15-controller", "obligation:eu:gdpr-art-17-controller" ], "question": "Who is responsible?", "sha256": "9a5a96374c26ac8c0247c0c6416bc93cc17878d14bc0b04c5bfbde78f798f3d0" }, { "key": "verification", "status": "ready", "answer": "Verified by: design, register, internal_review, authority_filing, assessment, contract. Internal review maps each requirement to an implemented measure.", "ids": [ "verification:design", "verification:register", "verification:internal_review", "verification:authority_filing", "verification:assessment", "verification:contract" ], "question": "How is this verified?", "sha256": "4f1938f91dc68b118f3af2ae98498077953df64676132aed95e65d677f0f10aa" }, { "key": "documents", "status": "ready", "answer": "Keep: Requirement-to-measure mapping, Internal review note, Register extract, Retention schedule, Dated internal compliance note, Filed report or declaration, Submission receipt or publication URL with date, Dated assessment document, Method description, Update log, Signed contract with clauses, Clause checklist.", "ids": [ "documentation_requirement:eu:gdpr" ], "question": "Which documents are required?", "sha256": "0496fdec8ddbef5a527f09c5bae80a514652c74dda0ca37f7a2ec53dcfa93230" }, { "key": "if_not_met", "status": "ready", "answer": "4 sanctions, up to 4 % of turnover; e.g. EUR 10 000 000.", "ids": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-83-6" ], "question": "What happens if the requirement is not met?", "sha256": "d52861f5fde0e2c75315c8601f35223334dfbce8f80e7e805941550e104cf367" } ], "action_list": [ { "obligation": "obligation:eu:gdpr-art-24-controller", "provision": "gdpr art. 24", "role": "controller", "action": "Implement and demonstrate measures that make processing compliant.", "deadline": null, "recipient": null, "verification": "design", "verification_method": "Internal review maps each requirement to an implemented measure.", "evidence": [ "Requirement-to-measure mapping", "Internal review note" ], "exceptions": [ "exception:eu:gdpr-household" ], "sanctions": [ "sanction:eu:gdpr-art-58-2" ], "related_rules": [ "obligation:eu:nis2-art-21-essential-entity" ], "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "obligation": "obligation:eu:gdpr-art-25-controller", "provision": "gdpr art. 25", "role": "controller", "action": "Apply data protection by design and by default.", "deadline": null, "recipient": null, "verification": "design", "verification_method": "Internal review maps each requirement to an implemented measure.", "evidence": [ "Requirement-to-measure mapping", "Internal review note" ], "exceptions": [ "exception:eu:gdpr-household" ], "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "related_rules": [ "obligation:eu:nis2-art-21-essential-entity" ], "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "obligation": "obligation:eu:gdpr-art-30-controller", "provision": "gdpr art. 30", "role": "controller", "action": "Keep records of processing activities.", "deadline": null, "recipient": null, "verification": "register", "verification_method": "A complete, current register or archive can be produced on request.", "evidence": [ "Register extract", "Retention schedule" ], "exceptions": [ "exception:eu:gdpr-household", "exception:eu:gdpr-records-under-250" ], "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "related_rules": [ "obligation:eu:ai-act-art-11-provider", "obligation:eu:ai-act-art-12-provider", "obligation:eu:ai-act-art-53-gpai-provider", "obligation:eu:dora-art-28-financial-entity", "obligation:eu:amlr-art-10-obliged-entity" ], "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "obligation": "obligation:eu:gdpr-art-32-controller", "provision": "gdpr art. 32", "role": "controller", "action": "Ensure a level of security appropriate to the risk.", "deadline": null, "recipient": null, "verification": "internal_review", "verification_method": "Internal review against the duty text.", "evidence": [ "Dated internal compliance note" ], "exceptions": [ "exception:eu:gdpr-household" ], "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "related_rules": [ "obligation:eu:ai-act-art-16-provider", "obligation:eu:ai-act-art-9-provider", "obligation:eu:ai-act-art-17-provider", "obligation:eu:ai-act-art-72-provider", "obligation:eu:ai-act-art-26-deployer" ], "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "obligation": "obligation:eu:gdpr-art-33-controller", "provision": "gdpr art. 33", "role": "controller", "action": "Notify a personal data breach to the supervisory authority.", "deadline": "72 hours", "recipient": "Competent supervisory authority", "verification": "authority_filing", "verification_method": "Filing or publication can be shown with date and recipient.", "evidence": [ "Filed report or declaration", "Submission receipt or publication URL with date" ], "exceptions": [ "exception:eu:gdpr-household", "exception:eu:gdpr-breach-unlikely-risk" ], "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "related_rules": [ "obligation:eu:ai-act-art-73-provider", "obligation:eu:nis2-art-23-essential-entity", "obligation:eu:dora-art-19-financial-entity", "obligation:eu:amlr-art-69-obliged-entity", "obligation:eu:csrd-art-19a-large-undertaking" ], "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "obligation": "obligation:eu:gdpr-art-35-controller", "provision": "gdpr art. 35", "role": "controller", "action": "Carry out a data protection impact assessment for high-risk processing.", "deadline": null, "recipient": null, "verification": "assessment", "verification_method": "A dated assessment with method, scope and outcome exists and is updated.", "evidence": [ "Dated assessment document", "Method description", "Update log" ], "exceptions": [ "exception:eu:gdpr-household" ], "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "related_rules": [ "obligation:eu:ai-act-art-27-deployer", "obligation:eu:csddd-art-8-company", "obligation:eu:csddd-art-15-company" ], "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "obligation": "obligation:eu:gdpr-art-28-processor", "provision": "gdpr art. 28", "role": "processor", "action": "Process only on documented instructions under a written contract.", "deadline": null, "recipient": null, "verification": "contract", "verification_method": "Required clauses are present in signed agreements or published terms.", "evidence": [ "Signed contract with clauses", "Clause checklist" ], "exceptions": [ "exception:eu:gdpr-household" ], "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "related_rules": [ "obligation:eu:dora-art-30-financial-entity", "obligation:eu:accessibility-art-13-service-provider" ], "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "obligation": "obligation:eu:gdpr-art-32-processor", "provision": "gdpr art. 32", "role": "processor", "action": "Ensure a level of security appropriate to the risk.", "deadline": null, "recipient": null, "verification": "internal_review", "verification_method": "Internal review against the duty text.", "evidence": [ "Dated internal compliance note" ], "exceptions": [ "exception:eu:gdpr-household" ], "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "related_rules": [ "obligation:eu:ai-act-art-16-provider", "obligation:eu:ai-act-art-9-provider", "obligation:eu:ai-act-art-17-provider", "obligation:eu:ai-act-art-72-provider", "obligation:eu:ai-act-art-26-deployer" ], "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "obligation": "obligation:eu:gdpr-art-33-processor", "provision": "gdpr art. 33", "role": "processor", "action": "Notify the controller without undue delay after becoming aware of a breach.", "deadline": null, "recipient": "The controller", "verification": "authority_filing", "verification_method": "Filing or publication can be shown with date and recipient.", "evidence": [ "Filed report or declaration", "Submission receipt or publication URL with date" ], "exceptions": [ "exception:eu:gdpr-household", "exception:eu:gdpr-breach-unlikely-risk" ], "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "related_rules": [ "obligation:eu:ai-act-art-73-provider", "obligation:eu:nis2-art-23-essential-entity", "obligation:eu:dora-art-19-financial-entity", "obligation:eu:amlr-art-69-obliged-entity", "obligation:eu:csrd-art-19a-large-undertaking" ], "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "obligation": "obligation:eu:gdpr-art-5-controller", "provision": "gdpr art. 5", "role": "controller", "action": "Process personal data in line with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and be able to demonstrate compliance (accountability).", "deadline": null, "recipient": null, "verification": "internal_review", "verification_method": "Internal review against the duty text.", "evidence": [ "Dated internal compliance note" ], "exceptions": [ "exception:eu:gdpr-household" ], "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-5" ], "related_rules": [ "obligation:eu:ai-act-art-16-provider", "obligation:eu:ai-act-art-9-provider", "obligation:eu:ai-act-art-17-provider", "obligation:eu:ai-act-art-72-provider", "obligation:eu:ai-act-art-26-deployer" ], "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "obligation": "obligation:eu:gdpr-art-6-controller", "provision": "gdpr art. 6", "role": "controller", "action": "Process personal data only where at least one legal basis in Article 6(1) applies.", "deadline": null, "recipient": null, "verification": "internal_review", "verification_method": "Internal review against the duty text.", "evidence": [ "Dated internal compliance note" ], "exceptions": [ "exception:eu:gdpr-household" ], "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-5" ], "related_rules": [ "obligation:eu:ai-act-art-16-provider", "obligation:eu:ai-act-art-9-provider", "obligation:eu:ai-act-art-17-provider", "obligation:eu:ai-act-art-72-provider", "obligation:eu:ai-act-art-26-deployer" ], "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "obligation": "obligation:eu:gdpr-art-12-controller", "provision": "gdpr art. 12", "role": "controller", "action": "Provide information on action taken on a data subject request under Articles 15 to 22 without undue delay and in any event within one month of receipt of the request.", "deadline": "30 days", "recipient": "Data subject", "verification": "internal_review", "verification_method": "Internal review against the duty text.", "evidence": [ "Dated internal compliance note" ], "exceptions": [ "exception:eu:gdpr-household" ], "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-5" ], "related_rules": [ "obligation:eu:ai-act-art-16-provider", "obligation:eu:ai-act-art-9-provider", "obligation:eu:ai-act-art-17-provider", "obligation:eu:ai-act-art-72-provider", "obligation:eu:ai-act-art-26-deployer" ], "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "obligation": "obligation:eu:gdpr-art-15-controller", "provision": "gdpr art. 15", "role": "controller", "action": "Give the data subject confirmation as to whether personal data concerning him or her are being processed, access to the personal data and the information listed in Article 15(1), and a copy of the data.", "deadline": null, "recipient": "Data subject", "verification": "internal_review", "verification_method": "Internal review against the duty text.", "evidence": [ "Dated internal compliance note" ], "exceptions": [ "exception:eu:gdpr-household" ], "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-5" ], "related_rules": [ "obligation:eu:ai-act-art-16-provider", "obligation:eu:ai-act-art-9-provider", "obligation:eu:ai-act-art-17-provider", "obligation:eu:ai-act-art-72-provider", "obligation:eu:ai-act-art-26-deployer" ], "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "obligation": "obligation:eu:gdpr-art-17-controller", "provision": "gdpr art. 17", "role": "controller", "action": "Erase personal data without undue delay where one of the grounds in Article 17(1) applies.", "deadline": null, "recipient": "Data subject", "verification": "internal_review", "verification_method": "Internal review against the duty text.", "evidence": [ "Dated internal compliance note" ], "exceptions": [ "exception:eu:gdpr-household" ], "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-5" ], "related_rules": [ "obligation:eu:ai-act-art-16-provider", "obligation:eu:ai-act-art-9-provider", "obligation:eu:ai-act-art-17-provider", "obligation:eu:ai-act-art-72-provider", "obligation:eu:ai-act-art-26-deployer" ], "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" } ], "checklist": [ { "step": 1, "role": "controller", "do": "Implement and demonstrate measures that make processing compliant.", "verify": "Internal review maps each requirement to an implemented measure.", "keep": [ "Requirement-to-measure mapping", "Internal review note" ], "deadline": null, "if_not": [ "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 2, "role": "controller", "do": "Apply data protection by design and by default.", "verify": "Internal review maps each requirement to an implemented measure.", "keep": [ "Requirement-to-measure mapping", "Internal review note" ], "deadline": null, "if_not": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "done": false }, { "step": 3, "role": "controller", "do": "Keep records of processing activities.", "verify": "A complete, current register or archive can be produced on request.", "keep": [ "Register extract", "Retention schedule" ], "deadline": null, "if_not": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "done": false }, { "step": 4, "role": "controller", "do": "Ensure a level of security appropriate to the risk.", "verify": "Internal review against the duty text.", "keep": [ "Dated internal compliance note" ], "deadline": null, "if_not": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "done": false }, { "step": 5, "role": "controller", "do": "Notify a personal data breach to the supervisory authority.", "verify": "Filing or publication can be shown with date and recipient.", "keep": [ "Filed report or declaration", "Submission receipt or publication URL with date" ], "deadline": "72 hours", "if_not": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "done": false }, { "step": 6, "role": "controller", "do": "Carry out a data protection impact assessment for high-risk processing.", "verify": "A dated assessment with method, scope and outcome exists and is updated.", "keep": [ "Dated assessment document", "Method description", "Update log" ], "deadline": null, "if_not": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "done": false }, { "step": 7, "role": "processor", "do": "Process only on documented instructions under a written contract.", "verify": "Required clauses are present in signed agreements or published terms.", "keep": [ "Signed contract with clauses", "Clause checklist" ], "deadline": null, "if_not": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "done": false }, { "step": 8, "role": "processor", "do": "Ensure a level of security appropriate to the risk.", "verify": "Internal review against the duty text.", "keep": [ "Dated internal compliance note" ], "deadline": null, "if_not": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "done": false }, { "step": 9, "role": "processor", "do": "Notify the controller without undue delay after becoming aware of a breach.", "verify": "Filing or publication can be shown with date and recipient.", "keep": [ "Filed report or declaration", "Submission receipt or publication URL with date" ], "deadline": null, "if_not": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "done": false }, { "step": 10, "role": "controller", "do": "Process personal data in line with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and be able to demonstrate compliance (accountability).", "verify": "Internal review against the duty text.", "keep": [ "Dated internal compliance note" ], "deadline": null, "if_not": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-5" ], "done": false }, { "step": 11, "role": "controller", "do": "Process personal data only where at least one legal basis in Article 6(1) applies.", "verify": "Internal review against the duty text.", "keep": [ "Dated internal compliance note" ], "deadline": null, "if_not": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-5" ], "done": false }, { "step": 12, "role": "controller", "do": "Provide information on action taken on a data subject request under Articles 15 to 22 without undue delay and in any event within one month of receipt of the request.", "verify": "Internal review against the duty text.", "keep": [ "Dated internal compliance note" ], "deadline": "30 days", "if_not": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-5" ], "done": false }, { "step": 13, "role": "controller", "do": "Give the data subject confirmation as to whether personal data concerning him or her are being processed, access to the personal data and the information listed in Article 15(1), and a copy of the data.", "verify": "Internal review against the duty text.", "keep": [ "Dated internal compliance note" ], "deadline": null, "if_not": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-5" ], "done": false }, { "step": 14, "role": "controller", "do": "Erase personal data without undue delay where one of the grounds in Article 17(1) applies.", "verify": "Internal review against the duty text.", "keep": [ "Dated internal compliance note" ], "deadline": null, "if_not": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-5" ], "done": false } ], "links": { "sme_kit": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr", "act_kit": null, "articles": [ "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-24", "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-25", "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-30", "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-32", "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-33", "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-35", "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-28", "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-5", "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-6", "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-12", "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-15", "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-17" ], "risk": [ "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--controller", "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--processor" ], "timeline": [ "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-24-controller", "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-25-controller", "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-30-controller", "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-32-controller", "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-33-controller", "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-35-controller", "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-28-processor", "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-32-processor", "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-33-processor", "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-5-controller", "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-6-controller", "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-12-controller", "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-15-controller", "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-17-controller" ], "list": "https://legal.exploreworldai.com/api/public/v1/action-kits" }, "method": "Rule to action: five fixed agent questions from deterministic registers. Verification and evidence come from fixed keyword rules on the duty text. No model writes anything.", "attribution": "Source: NovaCopilot", "hash": "94c8cc2568cb0eeabc004e6918e567dddc551f4cea4a1beaea4555b1c9c6ce13" }, "links": { "provisions": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr", "case_law": { "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr", "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr" }, "evidence": { "provenance": null, "chain_verify": "https://legal.exploreworldai.com/api/public/v1/changes/verify", "object_changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes" }, "compact": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr?view=compact", "representations": {}, "machine_languages": [ "en", "sv" ], "ref": "eu:gdpr" }, "watch": { "changes": "https://legal.exploreworldai.com/api/public/v1/changes", "whats_new": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu", "conditional": "Send If-None-Match with the ETag; unchanged objects return 304 without body.", "recheck_after_seconds": 86400 }, "hash": "sha256:b1e3cd60cfa71dd68e9d260f113bd7ada098d366295c4f137c09168aa16073cc", "version": "legal-2026-10-07", "expires": "2026-10-08T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-07+legal-2026-10-07+2026-10-07T06:29:13", "content_hash": "sha256:b1e3cd60cfa71dd68e9d260f113bd7ada098d366295c4f137c09168aa16073cc", "revalidate_after": "2026-10-07T07:45:42.639Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr", "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering" }