{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-33",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-33)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-07",
    "fingerprint": "ewai:se:6f1f1a",
    "proof": "sha256:de8857dc9a4eb4ed0a94f1386562464a217a13e668b032e1a9e5bb729fa81bcf",
    "jurisdiction": "se",
    "lang": "en"
  },
  "brand_source": "Source: NovaCopilot",
  "object_type": "action_kit",
  "object_id": "action_kit:eu:gdpr--art-33",
  "schema_version": "1",
  "schema": "https://legal.exploreworldai.com/api/public/v1/schemas/action_kit",
  "url": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-33",
  "source": "NovaCopilot",
  "item": {
    "coverage": {
      "complete": 5,
      "total": 5,
      "label": "5 of 5 answers ready"
    },
    "subject": "eu:gdpr--art-33",
    "act": "gdpr",
    "article": "33",
    "actions": [
      {
        "obligation": "obligation:eu:gdpr-art-33-controller",
        "verification": "authority_filing",
        "sanctions": [
          "sanction:eu:gdpr-art-58-2",
          "sanction:eu:gdpr-art-83-4"
        ]
      },
      {
        "obligation": "obligation:eu:gdpr-art-33-processor",
        "verification": "authority_filing",
        "sanctions": [
          "sanction:eu:gdpr-art-58-2",
          "sanction:eu:gdpr-art-83-4"
        ]
      }
    ],
    "answers": [
      {
        "key": "what_to_do",
        "status": "ready",
        "sha256": "5b706620c5edaf2cc1d155982d5f06fc897858c56f2f7b1d6ee63dc3dbdc54b8"
      },
      {
        "key": "who",
        "status": "ready",
        "sha256": "f51b7e2a07b3e03a819690da87a76b98d389c16f9b638ff8922fc033f52df787"
      },
      {
        "key": "verification",
        "status": "ready",
        "sha256": "6dd849c15eb80d5d0a5bbeb2b0aa48b7a0f7e3c843b427c0442503f304466f75"
      },
      {
        "key": "documents",
        "status": "ready",
        "sha256": "42fbc8d356ecd1e4416c295289e5fdcf4028b61b491a4b813854e490d9d4a45f"
      },
      {
        "key": "if_not_met",
        "status": "ready",
        "sha256": "a3c765a8503bc55bd582a489c38057ba6e702d1ca3d7e0bb8b2901b1a490a2c7"
      }
    ],
    "answers_full": [
      {
        "key": "what_to_do",
        "status": "ready",
        "answer": "Notify a personal data breach to the supervisory authority. Notify the controller without undue delay after becoming aware of a breach.",
        "ids": [
          "obligation:eu:gdpr-art-33-controller",
          "obligation:eu:gdpr-art-33-processor"
        ],
        "question": "What must I do?",
        "sha256": "5b706620c5edaf2cc1d155982d5f06fc897858c56f2f7b1d6ee63dc3dbdc54b8"
      },
      {
        "key": "who",
        "status": "ready",
        "answer": "Responsible roles: controller, processor.",
        "ids": [
          "obligation:eu:gdpr-art-33-controller",
          "obligation:eu:gdpr-art-33-processor"
        ],
        "question": "Who is responsible?",
        "sha256": "f51b7e2a07b3e03a819690da87a76b98d389c16f9b638ff8922fc033f52df787"
      },
      {
        "key": "verification",
        "status": "ready",
        "answer": "Verified by: authority_filing. Filing or publication can be shown with date and recipient.",
        "ids": [
          "verification:authority_filing"
        ],
        "question": "How is this verified?",
        "sha256": "6dd849c15eb80d5d0a5bbeb2b0aa48b7a0f7e3c843b427c0442503f304466f75"
      },
      {
        "key": "documents",
        "status": "ready",
        "answer": "Keep: Filed report or declaration, Submission receipt or publication URL with date.",
        "ids": [
          "documentation_requirement:eu:gdpr--art-33"
        ],
        "question": "Which documents are required?",
        "sha256": "42fbc8d356ecd1e4416c295289e5fdcf4028b61b491a4b813854e490d9d4a45f"
      },
      {
        "key": "if_not_met",
        "status": "ready",
        "answer": "2 sanctions, up to 2 % of turnover; e.g. EUR 10 000 000.",
        "ids": [
          "sanction:eu:gdpr-art-58-2",
          "sanction:eu:gdpr-art-83-4"
        ],
        "question": "What happens if the requirement is not met?",
        "sha256": "a3c765a8503bc55bd582a489c38057ba6e702d1ca3d7e0bb8b2901b1a490a2c7"
      }
    ],
    "action_list": [
      {
        "obligation": "obligation:eu:gdpr-art-33-controller",
        "provision": "gdpr art. 33",
        "role": "controller",
        "action": "Notify a personal data breach to the supervisory authority.",
        "deadline": "72 hours",
        "recipient": "Competent supervisory authority",
        "verification": "authority_filing",
        "verification_method": "Filing or publication can be shown with date and recipient.",
        "evidence": [
          "Filed report or declaration",
          "Submission receipt or publication URL with date"
        ],
        "exceptions": [
          "exception:eu:gdpr-household",
          "exception:eu:gdpr-breach-unlikely-risk"
        ],
        "sanctions": [
          "sanction:eu:gdpr-art-58-2",
          "sanction:eu:gdpr-art-83-4"
        ],
        "related_rules": [
          "obligation:eu:ai-act-art-73-provider",
          "obligation:eu:nis2-art-23-essential-entity",
          "obligation:eu:dora-art-19-financial-entity",
          "obligation:eu:amlr-art-69-obliged-entity",
          "obligation:eu:csrd-art-19a-large-undertaking"
        ],
        "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
      },
      {
        "obligation": "obligation:eu:gdpr-art-33-processor",
        "provision": "gdpr art. 33",
        "role": "processor",
        "action": "Notify the controller without undue delay after becoming aware of a breach.",
        "deadline": null,
        "recipient": "The controller",
        "verification": "authority_filing",
        "verification_method": "Filing or publication can be shown with date and recipient.",
        "evidence": [
          "Filed report or declaration",
          "Submission receipt or publication URL with date"
        ],
        "exceptions": [
          "exception:eu:gdpr-household",
          "exception:eu:gdpr-breach-unlikely-risk"
        ],
        "sanctions": [
          "sanction:eu:gdpr-art-58-2",
          "sanction:eu:gdpr-art-83-4"
        ],
        "related_rules": [
          "obligation:eu:ai-act-art-73-provider",
          "obligation:eu:nis2-art-23-essential-entity",
          "obligation:eu:dora-art-19-financial-entity",
          "obligation:eu:amlr-art-69-obliged-entity",
          "obligation:eu:csrd-art-19a-large-undertaking"
        ],
        "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
      }
    ],
    "checklist": [
      {
        "step": 1,
        "role": "controller",
        "do": "Notify a personal data breach to the supervisory authority.",
        "verify": "Filing or publication can be shown with date and recipient.",
        "keep": [
          "Filed report or declaration",
          "Submission receipt or publication URL with date"
        ],
        "deadline": "72 hours",
        "if_not": [
          "sanction:eu:gdpr-art-58-2",
          "sanction:eu:gdpr-art-83-4"
        ],
        "done": false
      },
      {
        "step": 2,
        "role": "processor",
        "do": "Notify the controller without undue delay after becoming aware of a breach.",
        "verify": "Filing or publication can be shown with date and recipient.",
        "keep": [
          "Filed report or declaration",
          "Submission receipt or publication URL with date"
        ],
        "deadline": null,
        "if_not": [
          "sanction:eu:gdpr-art-58-2",
          "sanction:eu:gdpr-art-83-4"
        ],
        "done": false
      }
    ],
    "links": {
      "sme_kit": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-33",
      "act_kit": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr",
      "articles": [],
      "risk": [
        "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--controller",
        "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--processor"
      ],
      "timeline": [
        "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-33-controller",
        "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr-art-33-processor"
      ],
      "list": "https://legal.exploreworldai.com/api/public/v1/action-kits"
    },
    "method": "Rule to action: five fixed agent questions from deterministic registers. Verification and evidence come from fixed keyword rules on the duty text. No model writes anything.",
    "attribution": "Source: NovaCopilot",
    "hash": "7becade36d6e1ff7f85142520b6562ee70fc5a73ecfc6e16c73ff75f0fb7acf4"
  },
  "links": {
    "provisions": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr--art-33",
    "case_law": {
      "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr--art-33",
      "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr--art-33"
    },
    "evidence": {
      "provenance": null,
      "chain_verify": "https://legal.exploreworldai.com/api/public/v1/changes/verify",
      "object_changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes"
    },
    "compact": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-33?view=compact",
    "representations": {},
    "machine_languages": [
      "en",
      "sv"
    ],
    "ref": "eu:gdpr--art-33"
  },
  "watch": {
    "changes": "https://legal.exploreworldai.com/api/public/v1/changes",
    "whats_new": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu",
    "conditional": "Send If-None-Match with the ETag; unchanged objects return 304 without body.",
    "recheck_after_seconds": 86400
  },
  "hash": "sha256:de8857dc9a4eb4ed0a94f1386562464a217a13e668b032e1a9e5bb729fa81bcf",
  "version": "legal-2026-10-07",
  "expires": "2026-10-09T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-07+legal-2026-10-07+2026-10-07T16:38:30",
    "content_hash": "sha256:de8857dc9a4eb4ed0a94f1386562464a217a13e668b032e1a9e5bb729fa81bcf",
    "revalidate_after": "2026-10-08T02:17:11.514Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-33",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering"
}