{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:q-breach-notification-exceptions", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/obj/package/eu:q-breach-notification-exceptions)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-07", "fingerprint": "ewai:se:58efd4", "proof": "sha256:8b937f73e9e65bcf361dccd9532d25fd359f37162f7269c48c3ac6068245726e", "jurisdiction": "se", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "object_type": "package", "object_id": "package:eu:q-breach-notification-exceptions", "schema_version": "1", "schema": "https://legal.exploreworldai.com/api/public/v1/schemas/package", "url": "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:q-breach-notification-exceptions", "source": "NovaCopilot", "item": { "question": "Which exceptions apply to the duty to notify a personal data breach?", "answer": "The controller must notify the supervisory authority within 72 hours unless the breach is unlikely to result in a risk to individuals. Notice to the data subjects is not required where the data was protected, for example by encryption, where later measures remove the high risk, or where individual notice would take disproportionate effort and a public notice is used instead (GDPR art. 33 and 34).", "obligation": "obligation:eu:gdpr-art-33-controller", "exceptions": [ { "id": "exception:eu:gdpr-household", "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable" }, { "id": "exception:eu:gdpr-breach-unlikely-risk", "provision": "GDPR art. 33.1", "condition": "The personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.", "effect": "not_applicable" } ], "deadline": "72 hours", "timeline": { "in_application": true, "next_milestone": null, "relative_deadlines": [ "72 hours", "30 days" ] }, "source": { "title": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "contract": "frozen_core_v1", "frozen_fields": [ "question", "answer", "obligation", "exceptions", "deadline", "timeline", "source" ], "complete_kit": { "kit_type": "flagship_question", "obligations": [ { "id": "obligation:eu:gdpr-art-33-controller", "role": "controller", "provision": "GDPR: Regulation (EU) 2016/679", "duty": "Notify a personal data breach to the supervisory authority.", "deadline": "72 hours", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "id": "obligation:eu:gdpr-art-33-processor", "role": "processor", "provision": "GDPR: Regulation (EU) 2016/679", "duty": "Notify the controller without undue delay after becoming aware of a breach.", "deadline": null, "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "id": "obligation:eu:gdpr-art-32-controller", "role": "controller", "provision": "GDPR: Regulation (EU) 2016/679", "duty": "Ensure a level of security appropriate to the risk.", "deadline": null, "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" } ], "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "type": "administrative_fine", "authority": "Competent supervisory authority", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "provision": "Regulation (EU) 2016/679 (GDPR)", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "id": "sanction:eu:gdpr-art-58-2", "type": "corrective_order", "authority": "Competent supervisory authority", "max_amount": null, "max_turnover_pct": null, "provision": "Regulation (EU) 2016/679 (GDPR)", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" } ], "exceptions": [ { "id": "exception:eu:gdpr-household", "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable" }, { "id": "exception:eu:gdpr-breach-unlikely-risk", "provision": "GDPR art. 33.1", "condition": "The personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.", "effect": "not_applicable" }, { "id": "exception:eu:gdpr-household", "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable" }, { "id": "exception:eu:gdpr-breach-unlikely-risk", "provision": "GDPR art. 33.1", "condition": "The personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.", "effect": "not_applicable" }, { "id": "exception:eu:gdpr-household", "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable" } ], "checklist": [ "1. Notify a personal data breach to the supervisory authority (GDPR: Regulation (EU) 2016/679).", "2. Notify the controller without undue delay after becoming aware of a breach (GDPR: Regulation (EU) 2016/679).", "3. Ensure a level of security appropriate to the risk (GDPR: Regulation (EU) 2016/679)." ], "leading_cases": [ "eu:c-798-24", "eu:c-474-24", "eu:c-199-24-62024cj0199" ], "sme_kit": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-33", "fetches_saved": 9, "note": "Everything needed to answer is embedded. Follow links only to verify." }, "risk_level": "high", "risk_reason": "Breach of GDPR: Regulation (EU) 2016/679: Notify a personal data breach to the supervisory authority.", "risk_consequence": "administrative_fine up to EUR 10 000 000 or 2 % of turnover (Competent supervisory authority); corrective_order (Competent supervisory authority)", "risk_source": { "provision": "Regulation (EU) 2016/679 (GDPR)", "authority": "Competent supervisory authority", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "verification_state": "partially_verified", "verified_at": "2026-08-31", "verified_sources": [ "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" ], "note": "Exception wording is drawn from the provision but not yet checked verbatim against the official text.", "related_packages": [ "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-24-controller", "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-25-controller", "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-30-controller", "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-32-controller", "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-35-controller", "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-28-processor", "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-32-processor", "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-33-processor" ], "related_obligations": [ "obligation:eu:gdpr-art-24-controller", "obligation:eu:gdpr-art-25-controller", "obligation:eu:gdpr-art-30-controller", "obligation:eu:gdpr-art-32-controller", "obligation:eu:gdpr-art-35-controller", "obligation:eu:gdpr-art-28-processor", "obligation:eu:gdpr-art-32-processor", "obligation:eu:gdpr-art-33-processor" ], "related_exemptions": [ "exception:eu:gdpr-household", "exception:eu:gdpr-breach-unlikely-risk" ], "related_cases": [ "eu:c-798-24", "eu:c-474-24", "eu:c-199-24-62024cj0199" ], "related_authorities": [ "Competent supervisory authority" ], "related_statistics": [ "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr", "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr" ], "last_changed": "2026-10-06", "change_type": "new_package", "change_reason": "Unchanged since first publication.", "previous_hash": null, "precedent_strength": "leading", "leading_cases": [ "eu:c-798-24", "eu:c-474-24", "eu:c-199-24-62024cj0199" ], "contradicting_cases": [], "basis": "37 judgments in the register for gdpr.", "token_estimate": 302, "retrieval_equivalent_tokens_saved": 23698, "estimated_source_documents": 9, "method": "token_estimate = characters/4 of the frozen core. Retrieval equivalent: provision 1200, judgment 6000, sanction 600 tokens each.", "usable_without_further_analysis": true, "gaps": [], "generative_output": false, "attribution": "Source: NovaCopilot", "links": { "obligation": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-33-controller", "compliance_effect": "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-33-controller", "exceptions": "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-33-controller", "timeline": "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr", "risk_chain": "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--controller", "changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes?type=package", "index": "https://legal.exploreworldai.com/api/public/v1/agent-packages" }, "hash": "7fe07176b170994288ae6225f14fa30af8c2e3ca547fa2c9c6b360f3c32993ac" }, "links": { "provisions": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:q-breach-notification-exceptions", "case_law": { "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:q-breach-notification-exceptions", "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:q-breach-notification-exceptions" }, "evidence": { "provenance": null, "chain_verify": "https://legal.exploreworldai.com/api/public/v1/changes/verify", "object_changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes" }, "compact": "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:q-breach-notification-exceptions?view=compact", "representations": {}, "machine_languages": [ "en", "sv" ], "ref": "eu:q-breach-notification-exceptions" }, "watch": { "changes": "https://legal.exploreworldai.com/api/public/v1/changes", "whats_new": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu", "conditional": "Send If-None-Match with the ETag; unchanged objects return 304 without body.", "recheck_after_seconds": 86400 }, "hash": "sha256:8b937f73e9e65bcf361dccd9532d25fd359f37162f7269c48c3ac6068245726e", "version": "legal-2026-10-07", "expires": "2026-10-08T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-07+legal-2026-10-07+2026-10-07T14:29:26", "content_hash": "sha256:8b937f73e9e65bcf361dccd9532d25fd359f37162f7269c48c3ac6068245726e", "revalidate_after": "2026-10-07T15:57:02.431Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:q-breach-notification-exceptions", "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering" }