{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-645-19","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-645-19)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-25","fingerprint":"ewai:se:9aab4c","proof":"sha256:2e406ef6cc811965deec8f38254718084fefeeead34114e9f986d9a88bd9f1e8","jurisdiction":"se","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","object_type":"case_kit","object_id":"case_kit:eu:c-645-19","schema_version":"1","schema":"https://legal.exploreworldai.com/api/public/v1/schemas/case_kit","url":"https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-645-19","source":"NovaCopilot","item":{"coverage":{"complete":8,"total":8,"label":"8 of 8 components ready","components":{"citation_graph":true,"precedent":true,"outcome":true,"provision_link":true,"obligation":true,"sanction":true,"risk":true,"conflict":true},"reasons":{}},"case_id":"eu:c-645-19","acts":["gdpr"],"components":[{"type":"citation_graph","status":"ready","ids":["citation_graph:eu:c-645-19"],"sha256":"f191c5d0e99737c0e7cda087beddb151957e2672202de998431800d23f1acee0"},{"type":"precedent","status":"ready","ids":["precedent:eu:c-645-19"],"sha256":"e9ff5591574f664834d7f604c72ba8ec389e61b44b904f3c564a1eaf530f26bd"},{"type":"outcome","status":"ready","ids":["outcome:eu:gdpr"],"sha256":"4c5b516536ba9254cec9e2adb036af8131e483613c7aa0a62394e91c7a463658"},{"type":"provision_link","status":"ready","ids":["provision_link:eu:gdpr"],"sha256":"5245ce7adfb409b673f8b7e028e6d0065cd7f35bc83672d9a11d21c4b3319be9"},{"type":"obligation","status":"ready","ids":["obligation:eu:gdpr-art-12-controller","obligation:eu:gdpr-art-13-controller","obligation:eu:gdpr-art-14-controller","obligation:eu:gdpr-art-15-controller","obligation:eu:gdpr-art-16-controller","obligation:eu:gdpr-art-17-controller","obligation:eu:gdpr-art-18-controller","obligation:eu:gdpr-art-19-controller","obligation:eu:gdpr-art-20-controller","obligation:eu:gdpr-art-21-controller","obligation:eu:gdpr-art-22-controller","obligation:eu:gdpr-art-24-controller","obligation:eu:gdpr-art-25-controller","obligation:eu:gdpr-art-26-controller","obligation:eu:gdpr-art-27-controller","obligation:eu:gdpr-art-28-2-processor","obligation:eu:gdpr-art-28-processor","obligation:eu:gdpr-art-30-controller","obligation:eu:gdpr-art-30-processor","obligation:eu:gdpr-art-31-controller","obligation:eu:gdpr-art-32-controller","obligation:eu:gdpr-art-32-processor","obligation:eu:gdpr-art-33-controller","obligation:eu:gdpr-art-33-processor","obligation:eu:gdpr-art-34-controller","obligation:eu:gdpr-art-35-controller","obligation:eu:gdpr-art-36-controller","obligation:eu:gdpr-art-37-controller","obligation:eu:gdpr-art-44-controller","obligation:eu:gdpr-art-44-processor"],"sha256":"621d5155288450bb4980935d03cff3a5992871a778949f6fc2133ab221dbcf08"},{"type":"sanction","status":"ready","ids":["sanction:eu:gdpr-art-58-2","sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-83-6"],"sha256":"a021a03bc0c9d637e0be8ce153ea72f65877d96335511dfb9e1e25de9da4fc90"},{"type":"risk","status":"ready","ids":["risk_chain:eu:gdpr"],"sha256":"1b8a1620834a42ef51a8e26c02b26aa6502e8bc05e894bf77801c91bf733e190"},{"type":"conflict","status":"ready","ids":["conflict:eu:c-645-19"],"sha256":"a8d67050dc3f2618e3ca4f176a0c416b37f107b9bf540bb4a462c6ce03fdfe2c"}],"parts":[{"type":"citation_graph","status":"ready","summary":"Cites 8, cited by 14; strength high.","reason":null,"urls":["https://legal.exploreworldai.com/api/public/v1/obj/citation_graph/eu:c-645-19"]},{"type":"precedent","status":"ready","summary":"Holdings and weight derived from the judgment text.","reason":null,"urls":["https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-645-19","https://legal.exploreworldai.com/api/public/v1/obj/weight/eu:c-645-19"]},{"type":"outcome","status":"ready","summary":"Sample of 39 judgments under gdpr.","reason":null,"urls":["https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr","https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr"]},{"type":"provision_link","status":"ready","summary":"Provision relations for gdpr.","reason":null,"urls":["https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr"]},{"type":"obligation","status":"ready","summary":"35 obligations triggered by the applied provisions.","reason":null,"urls":["https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-12-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-13-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-14-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-15-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-16-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-17-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-18-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-19-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-20-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-21-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-22-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-24-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-25-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-26-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-27-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-28-2-processor","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-28-processor","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-30-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-30-processor","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-31-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-32-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-32-processor","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-33-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-33-processor","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-34-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-35-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-36-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-37-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-44-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-44-processor"]},{"type":"sanction","status":"ready","summary":"4 sanctions linked to those obligations.","reason":null,"urls":["https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-58-2","https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-4","https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-5","https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-6"]},{"type":"risk","status":"ready","summary":"Risk level high, up to 4 % of turnover.","reason":null,"urls":["https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr"]},{"type":"conflict","status":"ready","summary":"Later or earlier judgments that depart from, limit or distinguish this case; empty means none found.","reason":null,"urls":["https://legal.exploreworldai.com/api/public/v1/obj/conflict/eu:c-645-19"]}],"gaps":[],"method":"Each component is loaded from its existing deterministic object. Coverage counts ready components; gaps carry fixed reason codes. No model writes anything.","links":{"case":"https://legal.exploreworldai.com/api/public/v1/obj/citation_graph/eu:c-645-19","relations":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu%3Ac-645-19","changes":"https://legal.exploreworldai.com/api/public/v1/case-kits/changes"},"hash":"f59fe845738cf5786f4b9312363291591eb823e10c04ae0476e9894e3ebccd78","extended":{"coverage":{"complete":4,"total":4,"label":"4 of 4 extended components ready","all_components":{"complete":12,"of":12}},"parts":[{"type":"outcome_pattern","status":"ready","summary":"Trend stable over 3 years, 39 judgments.","reason":null,"urls":["https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr"],"sha256":"c0a9f580026efd06fb83377d056247157abd2efd6bc8c5b5ba5e00c54d4a7a39"},{"type":"timeline","status":"ready","summary":"1 dates and deadlines.","reason":null,"urls":["https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr"],"sha256":"8972eac436e3bf1adebc40a0767034fd5a6c9c48ea5bbb5a407b37c93d0f7cab"},{"type":"role_duties","status":"ready","summary":"2 roles, 35 duties.","reason":null,"urls":[],"sha256":"404fcb5fde12b0b8c7ce3fd35e591a26be792914c6de703f8c905ca517b3ca8b"},{"type":"compliance_checklist","status":"ready","summary":"35 checks across 2 roles.","reason":null,"urls":[],"sha256":"28d9390e5e925af62325d2b3e76846eddaffc0c151269ce0f95426e6adc742ee"}],"role_duties":[{"role":"controller","obligations":[{"id":"obligation:eu:gdpr-art-24-controller","act":"gdpr","article":"24","must_do":"Implement and demonstrate measures that make processing compliant.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-24-controller"},{"id":"obligation:eu:gdpr-art-25-controller","act":"gdpr","article":"25","must_do":"Apply data protection by design and by default.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-25-controller"},{"id":"obligation:eu:gdpr-art-30-controller","act":"gdpr","article":"30","must_do":"Keep records of processing activities.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-30-controller"},{"id":"obligation:eu:gdpr-art-32-controller","act":"gdpr","article":"32","must_do":"Ensure a level of security appropriate to the risk.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-32-controller"},{"id":"obligation:eu:gdpr-art-33-controller","act":"gdpr","article":"33","must_do":"Notify a personal data breach to the supervisory authority.","deadline":"72 hours","url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-33-controller"},{"id":"obligation:eu:gdpr-art-35-controller","act":"gdpr","article":"35","must_do":"Carry out a data protection impact assessment for high-risk processing.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-35-controller"},{"id":"obligation:eu:gdpr-art-5-controller","act":"gdpr","article":"5","must_do":"Process personal data in line with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and be able to demonstrate compliance (accountability).","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-5-controller"},{"id":"obligation:eu:gdpr-art-6-controller","act":"gdpr","article":"6","must_do":"Process personal data only where at least one legal basis in Article 6(1) applies.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-6-controller"},{"id":"obligation:eu:gdpr-art-12-controller","act":"gdpr","article":"12","must_do":"Provide information on action taken on a data subject request under Articles 15 to 22 without undue delay and in any event within one month of receipt of the request.","deadline":"30 days","url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-12-controller"},{"id":"obligation:eu:gdpr-art-15-controller","act":"gdpr","article":"15","must_do":"Give the data subject confirmation as to whether personal data concerning him or her are being processed, access to the personal data and the information listed in Article 15(1), and a copy of the data.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-15-controller"},{"id":"obligation:eu:gdpr-art-17-controller","act":"gdpr","article":"17","must_do":"Erase personal data without undue delay where one of the grounds in Article 17(1) applies.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-17-controller"},{"id":"obligation:eu:gdpr-art-7-controller","act":"gdpr","article":"7","must_do":"Be able to demonstrate consent where processing is based on consent, present consent requests clearly distinguishable from other matters, and make withdrawal as easy as giving consent.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-7-controller"},{"id":"obligation:eu:gdpr-art-8-controller","act":"gdpr","article":"8","must_do":"Obtain consent from the holder of parental responsibility when offering information society services directly to a child below 16, or the lower national age of at least 13, and make reasonable efforts to verify it.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-8-controller"},{"id":"obligation:eu:gdpr-art-9-controller","act":"gdpr","article":"9","must_do":"Do not process special categories of personal data unless an exception in Article 9(2) applies.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-9-controller"},{"id":"obligation:eu:gdpr-art-13-controller","act":"gdpr","article":"13","must_do":"Give the data subject the information listed in Article 13, including identity, purposes, legal basis, recipients, transfers, retention period and rights, when personal data are obtained from the data subject.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-13-controller"},{"id":"obligation:eu:gdpr-art-14-controller","act":"gdpr","article":"14","must_do":"Give the data subject the information listed in Article 14 where personal data have not been obtained from the data subject, including the source of the data.","deadline":"30 days","url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-14-controller"},{"id":"obligation:eu:gdpr-art-16-controller","act":"gdpr","article":"16","must_do":"Rectify inaccurate personal data and complete incomplete data on the data subject's request.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-16-controller"},{"id":"obligation:eu:gdpr-art-18-controller","act":"gdpr","article":"18","must_do":"Restrict processing where the data subject contests accuracy, the processing is unlawful, the data are needed for legal claims or an objection is pending.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-18-controller"},{"id":"obligation:eu:gdpr-art-19-controller","act":"gdpr","article":"19","must_do":"Communicate any rectification, erasure or restriction to each recipient to whom the data have been disclosed, unless impossible or involving disproportionate effort.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-19-controller"},{"id":"obligation:eu:gdpr-art-20-controller","act":"gdpr","article":"20","must_do":"Provide personal data processed by automated means on the basis of consent or contract in a structured, commonly used and machine-readable format, and transmit it to another controller where technically feasible.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-20-controller"},{"id":"obligation:eu:gdpr-art-21-controller","act":"gdpr","article":"21","must_do":"Stop processing based on Article 6(1)(e) or (f) on objection unless compelling legitimate grounds override, and always stop processing for direct marketing on objection.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-21-controller"},{"id":"obligation:eu:gdpr-art-22-controller","act":"gdpr","article":"22","must_do":"Do not subject a data subject to a decision based solely on automated processing with legal or similarly significant effects unless an exception applies, and then provide human intervention, the right to express a view and to contest the decision.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-22-controller"},{"id":"obligation:eu:gdpr-art-26-controller","act":"gdpr","article":"26","must_do":"Determine joint controllers' respective responsibilities in a transparent arrangement and make its essence available to the data subject.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-26-controller"},{"id":"obligation:eu:gdpr-art-27-controller","act":"gdpr","article":"27","must_do":"Designate in writing a representative in the Union when not established in the Union but subject to Article 3(2), unless the processing is occasional and low risk.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-27-controller"},{"id":"obligation:eu:gdpr-art-31-controller","act":"gdpr","article":"31","must_do":"Cooperate with the supervisory authority in the performance of its tasks on request.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-31-controller"},{"id":"obligation:eu:gdpr-art-34-controller","act":"gdpr","article":"34","must_do":"Communicate a personal data breach likely to result in a high risk to the rights and freedoms of natural persons to the data subjects in clear and plain language.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-34-controller"},{"id":"obligation:eu:gdpr-art-36-controller","act":"gdpr","article":"36","must_do":"Consult the supervisory authority before processing where a data protection impact assessment indicates high risk in the absence of mitigating measures.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-36-controller"},{"id":"obligation:eu:gdpr-art-37-controller","act":"gdpr","article":"37","must_do":"Designate a data protection officer where the core activities are public authority processing, large-scale regular and systematic monitoring, or large-scale special category or criminal data, and publish the contact details.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-37-controller"},{"id":"obligation:eu:gdpr-art-44-controller","act":"gdpr","article":"44","must_do":"Transfer personal data to a third country or international organisation only under an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a derogation in Article 49.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-44-controller"}]},{"role":"processor","obligations":[{"id":"obligation:eu:gdpr-art-28-processor","act":"gdpr","article":"28","must_do":"Process only on documented instructions under a written contract.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-28-processor"},{"id":"obligation:eu:gdpr-art-32-processor","act":"gdpr","article":"32","must_do":"Ensure a level of security appropriate to the risk.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-32-processor"},{"id":"obligation:eu:gdpr-art-33-processor","act":"gdpr","article":"33","must_do":"Notify the controller without undue delay after becoming aware of a breach.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-33-processor"},{"id":"obligation:eu:gdpr-art-28-2-processor","act":"gdpr","article":"28(2)","must_do":"Do not engage another processor without prior specific or general written authorisation of the controller, and inform the controller of intended changes so it can object.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-28-2-processor"},{"id":"obligation:eu:gdpr-art-30-processor","act":"gdpr","article":"30","must_do":"Maintain a written record of all categories of processing activities carried out on behalf of each controller.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-30-processor"},{"id":"obligation:eu:gdpr-art-44-processor","act":"gdpr","article":"44","must_do":"Transfer personal data to a third country or international organisation only under Chapter V safeguards.","deadline":null,"url":"https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-44-processor"}]}],"compliance_checklist":[{"role":"controller","steps":[{"step":1,"check":"Implement and demonstrate measures that make processing compliant.","provision":"gdpr 24","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-58-2"],"done":false},{"step":2,"check":"Apply data protection by design and by default.","provision":"gdpr 25","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":3,"check":"Keep records of processing activities.","provision":"gdpr 30","deadline":null,"exceptions":2,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":4,"check":"Ensure a level of security appropriate to the risk.","provision":"gdpr 32","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":5,"check":"Notify a personal data breach to the supervisory authority.","provision":"gdpr 33","deadline":"72 hours","exceptions":2,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":6,"check":"Carry out a data protection impact assessment for high-risk processing.","provision":"gdpr 35","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":7,"check":"Process personal data in line with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and be able to demonstrate compliance (accountability).","provision":"gdpr 5","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false},{"step":8,"check":"Process personal data only where at least one legal basis in Article 6(1) applies.","provision":"gdpr 6","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false},{"step":9,"check":"Provide information on action taken on a data subject request under Articles 15 to 22 without undue delay and in any event within one month of receipt of the request.","provision":"gdpr 12","deadline":"30 days","exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false},{"step":10,"check":"Give the data subject confirmation as to whether personal data concerning him or her are being processed, access to the personal data and the information listed in Article 15(1), and a copy of the data.","provision":"gdpr 15","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false},{"step":11,"check":"Erase personal data without undue delay where one of the grounds in Article 17(1) applies.","provision":"gdpr 17","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false},{"step":12,"check":"Be able to demonstrate consent where processing is based on consent, present consent requests clearly distinguishable from other matters, and make withdrawal as easy as giving consent.","provision":"gdpr 7","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false},{"step":13,"check":"Obtain consent from the holder of parental responsibility when offering information society services directly to a child below 16, or the lower national age of at least 13, and make reasonable efforts to verify it.","provision":"gdpr 8","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":14,"check":"Do not process special categories of personal data unless an exception in Article 9(2) applies.","provision":"gdpr 9","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false},{"step":15,"check":"Give the data subject the information listed in Article 13, including identity, purposes, legal basis, recipients, transfers, retention period and rights, when personal data are obtained from the data subject.","provision":"gdpr 13","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false},{"step":16,"check":"Give the data subject the information listed in Article 14 where personal data have not been obtained from the data subject, including the source of the data.","provision":"gdpr 14","deadline":"30 days","exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false},{"step":17,"check":"Rectify inaccurate personal data and complete incomplete data on the data subject's request.","provision":"gdpr 16","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false},{"step":18,"check":"Restrict processing where the data subject contests accuracy, the processing is unlawful, the data are needed for legal claims or an objection is pending.","provision":"gdpr 18","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false},{"step":19,"check":"Communicate any rectification, erasure or restriction to each recipient to whom the data have been disclosed, unless impossible or involving disproportionate effort.","provision":"gdpr 19","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false},{"step":20,"check":"Provide personal data processed by automated means on the basis of consent or contract in a structured, commonly used and machine-readable format, and transmit it to another controller where technically feasible.","provision":"gdpr 20","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false},{"step":21,"check":"Stop processing based on Article 6(1)(e) or (f) on objection unless compelling legitimate grounds override, and always stop processing for direct marketing on objection.","provision":"gdpr 21","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false},{"step":22,"check":"Do not subject a data subject to a decision based solely on automated processing with legal or similarly significant effects unless an exception applies, and then provide human intervention, the right to express a view and to contest the decision.","provision":"gdpr 22","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false},{"step":23,"check":"Determine joint controllers' respective responsibilities in a transparent arrangement and make its essence available to the data subject.","provision":"gdpr 26","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":24,"check":"Designate in writing a representative in the Union when not established in the Union but subject to Article 3(2), unless the processing is occasional and low risk.","provision":"gdpr 27","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":25,"check":"Cooperate with the supervisory authority in the performance of its tasks on request.","provision":"gdpr 31","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":26,"check":"Communicate a personal data breach likely to result in a high risk to the rights and freedoms of natural persons to the data subjects in clear and plain language.","provision":"gdpr 34","deadline":null,"exceptions":2,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":27,"check":"Consult the supervisory authority before processing where a data protection impact assessment indicates high risk in the absence of mitigating measures.","provision":"gdpr 36","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":28,"check":"Designate a data protection officer where the core activities are public authority processing, large-scale regular and systematic monitoring, or large-scale special category or criminal data, and publish the contact details.","provision":"gdpr 37","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":29,"check":"Transfer personal data to a third country or international organisation only under an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a derogation in Article 49.","provision":"gdpr 44","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false}]},{"role":"processor","steps":[{"step":1,"check":"Process only on documented instructions under a written contract.","provision":"gdpr 28","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":2,"check":"Ensure a level of security appropriate to the risk.","provision":"gdpr 32","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":3,"check":"Notify the controller without undue delay after becoming aware of a breach.","provision":"gdpr 33","deadline":null,"exceptions":2,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":4,"check":"Do not engage another processor without prior specific or general written authorisation of the controller, and inform the controller of intended changes so it can object.","provision":"gdpr 28(2)","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":5,"check":"Maintain a written record of all categories of processing activities carried out on behalf of each controller.","provision":"gdpr 30","deadline":null,"exceptions":2,"if_not":["sanction:eu:gdpr-art-83-4","sanction:eu:gdpr-art-58-2"],"done":false},{"step":6,"check":"Transfer personal data to a third country or international organisation only under Chapter V safeguards.","provision":"gdpr 44","deadline":null,"exceptions":1,"if_not":["sanction:eu:gdpr-art-83-5","sanction:eu:gdpr-art-58-2"],"done":false}]}],"answers":[{"question":"What applies?","answer_from":["provision_link","obligation"],"urls":["https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-12-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-13-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-14-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-15-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-16-controller"],"answerable":true},{"question":"Which obligations exist?","answer_from":["obligation","role_duties"],"urls":["https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-12-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-13-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-14-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-15-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-16-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-17-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-18-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-19-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-20-controller","https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-21-controller"],"answerable":true},{"question":"Which sanctions can be triggered?","answer_from":["sanction"],"urls":["https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-58-2","https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-4","https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-5","https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-6"],"answerable":true},{"question":"What is the risk?","answer_from":["risk"],"urls":["https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr"],"answerable":true},{"question":"Which precedent supports this?","answer_from":["precedent","citation_graph"],"urls":["https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-645-19","https://legal.exploreworldai.com/api/public/v1/obj/weight/eu:c-645-19","https://legal.exploreworldai.com/api/public/v1/obj/citation_graph/eu:c-645-19"],"answerable":true},{"question":"How do courts usually rule?","answer_from":["outcome","outcome_pattern","conflict"],"urls":["https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr","https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr","https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr","https://legal.exploreworldai.com/api/public/v1/obj/conflict/eu:c-645-19"],"answerable":true},{"question":"What must a given role do to comply?","answer_from":["role_duties","compliance_checklist","timeline"],"urls":["https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr"],"answerable":true}],"note":"Additive fields outside hash. Core components and hash are unchanged."}},"links":{"provisions":"https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:c-645-19","case_law":{"outcome":"https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:c-645-19","outcome_pattern":"https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:c-645-19"},"evidence":{"provenance":null,"chain_verify":"https://legal.exploreworldai.com/api/public/v1/changes/verify","object_changes":"https://legal.exploreworldai.com/api/public/v1/objects/changes"},"compact":"https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-645-19?view=compact","representations":{},"machine_languages":["en","sv"],"ref":"eu:c-645-19"},"watch":{"risk":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu%3Ac-645-19","relations":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu%3Ac-645-19","risk_changes":"https://legal.exploreworldai.com/api/public/v1/risk-changes","provenance":"https://legal.exploreworldai.com/api/public/v1/obj/provenance/eu:c-645-19"},"metadata":{"schema":"novacopilot_object_metadata/1","canonical_url":"https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-645-19","source":"Source: NovaCopilot","official_source":null,"short_answer":null,"short_answer_status":"not_in_register","hash":"f59fe845738cf5786f4b9312363291591eb823e10c04ae0476e9894e3ebccd78","schema_version":"1","last_verified_at":null,"verification_status":"not_verified_yet","integrity_check_scope":"stored_content_only"},"hash":"sha256:2e406ef6cc811965deec8f38254718084fefeeead34114e9f986d9a88bd9f1e8","version":"legal-2026-10-25","expires":"2026-10-26T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-25+legal-2026-10-25+2026-10-25T12:13:04","content_hash":"sha256:2e406ef6cc811965deec8f38254718084fefeeead34114e9f986d9a88bd9f1e8","revalidate_after":"2026-10-25T14:39:00.736Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-645-19","disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-645-19","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"}}