{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-27", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-27)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-09", "fingerprint": "ewai:se:59a4cb", "proof": "sha256:514f254854a3794ee45743cc520e38ee0fd6d9d5699b3e7299aad680505aa9e0", "jurisdiction": "se", "lang": "en" }, "brand_source": "Source: NovaCopilot", "object_type": "action_kit", "object_id": "action_kit:eu:gdpr--art-27", "schema_version": "1", "schema": "https://legal.exploreworldai.com/api/public/v1/schemas/action_kit", "url": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-27", "source": "NovaCopilot", "item": { "coverage": { "complete": 5, "total": 5, "label": "5 of 5 answers ready" }, "subject": "eu:gdpr--art-27", "act": "gdpr", "article": "27", "actions": [ { "obligation": "obligation:eu:gdpr-art-27-controller", "verification": "design", "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ] } ], "answers": [ { "key": "what_to_do", "status": "ready", "sha256": "a45d39058f3e58216970407a699fe7c50db229daf3a65dca5ff441206101283f" }, { "key": "who", "status": "ready", "sha256": "4b4e3afe34e00669c013fadd996efc71a6103c9debff7b0fa13afa59fc7fb237" }, { "key": "verification", "status": "ready", "sha256": "7df60f9208cb6cfac68918a75a7ee982928879c13b61e3b1d394a9cdd3bdbfe7" }, { "key": "documents", "status": "ready", "sha256": "ea8c5ea7760377c73eef605d3db820877d9376f204c25d8bcb52ee31d5288cfb" }, { "key": "if_not_met", "status": "ready", "sha256": "a3c765a8503bc55bd582a489c38057ba6e702d1ca3d7e0bb8b2901b1a490a2c7" } ], "answers_full": [ { "key": "what_to_do", "status": "ready", "answer": "Designate in writing a representative in the Union when not established in the Union but subject to Article 3(2), unless the processing is occasional and low risk.", "ids": [ "obligation:eu:gdpr-art-27-controller" ], "question": "What must I do?", "sha256": "a45d39058f3e58216970407a699fe7c50db229daf3a65dca5ff441206101283f" }, { "key": "who", "status": "ready", "answer": "Responsible roles: controller.", "ids": [ "obligation:eu:gdpr-art-27-controller" ], "question": "Who is responsible?", "sha256": "4b4e3afe34e00669c013fadd996efc71a6103c9debff7b0fa13afa59fc7fb237" }, { "key": "verification", "status": "ready", "answer": "Verified by: design. Internal review maps each requirement to an implemented measure.", "ids": [ "verification:design" ], "question": "How is this verified?", "sha256": "7df60f9208cb6cfac68918a75a7ee982928879c13b61e3b1d394a9cdd3bdbfe7" }, { "key": "documents", "status": "ready", "answer": "Keep: Requirement-to-measure mapping, Internal review note.", "ids": [ "documentation_requirement:eu:gdpr--art-27" ], "question": "Which documents are required?", "sha256": "ea8c5ea7760377c73eef605d3db820877d9376f204c25d8bcb52ee31d5288cfb" }, { "key": "if_not_met", "status": "ready", "answer": "2 sanctions, up to 2 % of turnover; e.g. EUR 10 000 000.", "ids": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "question": "What happens if the requirement is not met?", "sha256": "a3c765a8503bc55bd582a489c38057ba6e702d1ca3d7e0bb8b2901b1a490a2c7" } ], "action_list": [ { "obligation": "obligation:eu:gdpr-art-27-controller", "provision": "gdpr art. 27", "role": "controller", "action": "Designate in writing a representative in the Union when not established in the Union but subject to Article 3(2), unless the processing is occasional and low risk.", "deadline": null, "recipient": "Representative in a member state", "verification": "design", "verification_method": "Internal review maps each requirement to an implemented measure.", "evidence": [ "Requirement-to-measure mapping", "Internal review note" ], "exceptions": [ "exception:eu:gdpr-household" ], "sanctions": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "related_rules": [ "obligation:eu:nis2-art-21-essential-entity", "obligation:eu:ai-act-art-4-provider-or-deployer", "obligation:eu:ai-act-art-50-provider", "obligation:eu:ai-act-art-13-provider", "obligation:eu:ai-act-art-14-provider" ], "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" } ], "checklist": [ { "step": 1, "role": "controller", "do": "Designate in writing a representative in the Union when not established in the Union but subject to Article 3(2), unless the processing is occasional and low risk.", "verify": "Internal review maps each requirement to an implemented measure.", "keep": [ "Requirement-to-measure mapping", "Internal review note" ], "deadline": null, "if_not": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "done": false } ], "links": { "sme_kit": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-27", "act_kit": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr", "articles": [], "risk": [ "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--controller" ], "timeline": [ "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-27-controller" ], "list": "https://legal.exploreworldai.com/api/public/v1/action-kits" }, "method": "Rule to action: five fixed agent questions from deterministic registers. Verification and evidence come from fixed keyword rules on the duty text. No model writes anything.", "attribution": "Source: NovaCopilot", "hash": "c2cce1ff56ca92fd30a29bb12d0b86a58265ef55934f3496038f057ca66a3fa8" }, "links": { "provisions": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr--art-27", "case_law": { "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr--art-27", "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr--art-27" }, "evidence": { "provenance": null, "chain_verify": "https://legal.exploreworldai.com/api/public/v1/changes/verify", "object_changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes" }, "compact": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-27?view=compact", "representations": {}, "machine_languages": [ "en", "sv" ], "ref": "eu:gdpr--art-27" }, "watch": { "changes": "https://legal.exploreworldai.com/api/public/v1/changes", "whats_new": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu", "conditional": "Send If-None-Match with the ETag; unchanged objects return 304 without body.", "recheck_after_seconds": 86400 }, "hash": "sha256:514f254854a3794ee45743cc520e38ee0fd6d9d5699b3e7299aad680505aa9e0", "version": "legal-2026-10-09", "expires": "2026-10-10T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-09+legal-2026-10-09+2026-10-09T19:05:12", "content_hash": "sha256:514f254854a3794ee45743cc520e38ee0fd6d9d5699b3e7299aad680505aa9e0", "revalidate_after": "2026-10-09T20:17:29.464Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-27", "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering" }