{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:q-processor-documentation", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/obj/package/eu:q-processor-documentation)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-06", "fingerprint": "ewai:se:8f3e0f", "proof": "sha256:a94d97ee6ee281fea066fd4a68f90d62051c24687fea65edfea2ac78d9425441", "jurisdiction": "se", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "brand": { "product": "NovaCopilot", "platform": "ExploreWorldAI", "infrastructure": "ExploreWorld Legal", "infrastructure_url": "legal.exploreworldai.com", "legal_entity": "Valkiv Ventures AB", "permanent_url": "https://legal.exploreworldai.com/novacopilot", "source": "Source: NovaCopilot", "powered_by": "Powered by NovaCopilot", "license": "https://legal.exploreworldai.com/licensvillkor", "contact": "stig@valkiv.com" }, "object_type": "package", "object_id": "package:eu:q-processor-documentation", "schema_version": "1", "schema": "https://legal.exploreworldai.com/api/public/v1/schemas/package", "url": "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:q-processor-documentation", "judgment": { "id": "eu:q-processor-documentation", "text": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:q-processor-documentation" }, "siblings": { "risk": "https://legal.exploreworldai.com/api/public/v1/obj/risk/eu:q-processor-documentation", "relation": "https://legal.exploreworldai.com/api/public/v1/obj/relation/eu:q-processor-documentation", "change": "https://legal.exploreworldai.com/api/public/v1/obj/change/eu:q-processor-documentation", "agent": "https://legal.exploreworldai.com/api/public/v1/obj/agent/eu:q-processor-documentation", "provenance": "https://legal.exploreworldai.com/api/public/v1/obj/provenance/eu:q-processor-documentation", "status": "https://legal.exploreworldai.com/api/public/v1/obj/status/eu:q-processor-documentation", "precedent": "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:q-processor-documentation", "edge": "https://legal.exploreworldai.com/api/public/v1/obj/edge/eu:q-processor-documentation", "element": "https://legal.exploreworldai.com/api/public/v1/obj/element/eu:q-processor-documentation", "decision": "https://legal.exploreworldai.com/api/public/v1/obj/decision/eu:q-processor-documentation", "obligation": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:q-processor-documentation", "sanction": "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:q-processor-documentation", "weight": "https://legal.exploreworldai.com/api/public/v1/obj/weight/eu:q-processor-documentation", "conflict": "https://legal.exploreworldai.com/api/public/v1/obj/conflict/eu:q-processor-documentation", "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:q-processor-documentation", "provision_link": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:q-processor-documentation", "brief": "https://legal.exploreworldai.com/api/public/v1/obj/brief/eu:q-processor-documentation", "citation_graph": "https://legal.exploreworldai.com/api/public/v1/obj/citation_graph/eu:q-processor-documentation", "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:q-processor-documentation", "risk_chain": "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:q-processor-documentation", "compliance_effect": "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:q-processor-documentation", "answer_node": "https://legal.exploreworldai.com/api/public/v1/obj/answer_node/eu:q-processor-documentation", "exception": "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:q-processor-documentation", "timeline": "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:q-processor-documentation", "case_kit": "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:q-processor-documentation", "documentation_requirement": "https://legal.exploreworldai.com/api/public/v1/obj/documentation_requirement/eu:q-processor-documentation", "sme_kit": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:q-processor-documentation", "action_kit": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:q-processor-documentation" }, "source": "NovaCopilot", "precedent_graph": "https://legal.exploreworldai.com/api/public/v1/precedent-graph/eu:q-processor-documentation", "item": { "question": "Which documentation requirements apply to data processors and controllers under GDPR?", "answer": "A processor may only act on documented instructions under a written contract, and the controller must keep records of processing activities, demonstrate compliance and carry out impact assessments for high-risk processing. Both must document security measures appropriate to the risk (GDPR art. 24, 28, 30, 32 and 35).", "obligation": "obligation:eu:gdpr-art-28-processor", "exceptions": [ { "id": "exception:eu:gdpr-household", "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable" } ], "deadline": null, "timeline": { "in_application": true, "next_milestone": null, "relative_deadlines": [ "72 hours", "30 days" ] }, "source": { "title": "GDPR: Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "contract": "frozen_core_v1", "frozen_fields": [ "question", "answer", "obligation", "exceptions", "deadline", "timeline", "source" ], "complete_kit": { "kit_type": "flagship_question", "obligations": [ { "id": "obligation:eu:gdpr-art-28-processor", "role": "processor", "provision": "GDPR: Regulation (EU) 2016/679", "duty": "Process only on documented instructions under a written contract.", "deadline": null, "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "id": "obligation:eu:gdpr-art-30-controller", "role": "controller", "provision": "GDPR: Regulation (EU) 2016/679", "duty": "Keep records of processing activities.", "deadline": null, "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "id": "obligation:eu:gdpr-art-24-controller", "role": "controller", "provision": "GDPR: Regulation (EU) 2016/679", "duty": "Implement and demonstrate measures that make processing compliant.", "deadline": null, "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "id": "obligation:eu:gdpr-art-32-processor", "role": "processor", "provision": "GDPR: Regulation (EU) 2016/679", "duty": "Ensure a level of security appropriate to the risk.", "deadline": null, "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "id": "obligation:eu:gdpr-art-35-controller", "role": "controller", "provision": "GDPR: Regulation (EU) 2016/679", "duty": "Carry out a data protection impact assessment for high-risk processing.", "deadline": null, "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" } ], "sanctions": [ { "id": "sanction:eu:gdpr-art-83-4", "type": "administrative_fine", "authority": "Competent supervisory authority", "max_amount": "EUR 10 000 000", "max_turnover_pct": 2, "provision": "Regulation (EU) 2016/679 (GDPR)", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, { "id": "sanction:eu:gdpr-art-58-2", "type": "corrective_order", "authority": "Competent supervisory authority", "max_amount": null, "max_turnover_pct": null, "provision": "Regulation (EU) 2016/679 (GDPR)", "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" } ], "exceptions": [ { "id": "exception:eu:gdpr-household", "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable" }, { "id": "exception:eu:gdpr-household", "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable" }, { "id": "exception:eu:gdpr-records-under-250", "provision": "GDPR art. 30.5", "condition": "Fewer than 250 employees, unless the processing is likely to result in a risk, is not occasional, or includes special categories or criminal data.", "effect": "not_applicable" }, { "id": "exception:eu:gdpr-household", "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable" }, { "id": "exception:eu:gdpr-household", "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable" }, { "id": "exception:eu:gdpr-household", "provision": "GDPR art. 2.2 c", "condition": "Processing by a natural person in the course of a purely personal or household activity.", "effect": "not_applicable" } ], "checklist": [ "1. Process only on documented instructions under a written contract (GDPR: Regulation (EU) 2016/679).", "2. Keep records of processing activities (GDPR: Regulation (EU) 2016/679).", "3. Implement and demonstrate measures that make processing compliant (GDPR: Regulation (EU) 2016/679).", "4. Ensure a level of security appropriate to the risk (GDPR: Regulation (EU) 2016/679).", "5. Carry out a data protection impact assessment for high-risk processing (GDPR: Regulation (EU) 2016/679)." ], "leading_cases": [ "eu:c-798-24", "eu:c-474-24", "eu:c-199-24-62024cj0199" ], "sme_kit": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr", "fetches_saved": 11, "note": "Everything needed to answer is embedded. Follow links only to verify." }, "risk_level": "high", "risk_reason": "Breach of GDPR: Regulation (EU) 2016/679: Process only on documented instructions under a written contract.", "risk_consequence": "administrative_fine up to EUR 10 000 000 or 2 % of turnover (Competent supervisory authority); corrective_order (Competent supervisory authority)", "risk_source": { "provision": "Regulation (EU) 2016/679 (GDPR)", "authority": "Competent supervisory authority", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj" }, "verification_state": "partially_verified", "verified_at": "2026-08-31", "verified_sources": [ "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679" ], "note": "Exception wording is drawn from the provision but not yet checked verbatim against the official text.", "related_packages": [ "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-24-controller", "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-25-controller", "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-30-controller", "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-32-controller", "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-33-controller", "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-35-controller", "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-32-processor", "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr-art-33-processor" ], "related_obligations": [ "obligation:eu:gdpr-art-24-controller", "obligation:eu:gdpr-art-25-controller", "obligation:eu:gdpr-art-30-controller", "obligation:eu:gdpr-art-32-controller", "obligation:eu:gdpr-art-33-controller", "obligation:eu:gdpr-art-35-controller", "obligation:eu:gdpr-art-32-processor", "obligation:eu:gdpr-art-33-processor" ], "related_exemptions": [ "exception:eu:gdpr-household" ], "related_cases": [ "eu:c-798-24", "eu:c-474-24", "eu:c-199-24-62024cj0199" ], "related_authorities": [ "Competent supervisory authority" ], "related_statistics": [ "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr", "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr" ], "last_changed": "2026-10-06", "change_type": "new_package", "change_reason": "Unchanged since first publication.", "previous_hash": null, "precedent_strength": "leading", "leading_cases": [ "eu:c-798-24", "eu:c-474-24", "eu:c-199-24-62024cj0199" ], "contradicting_cases": [], "basis": "37 judgments in the register for gdpr.", "token_estimate": 229, "retrieval_equivalent_tokens_saved": 22571, "estimated_source_documents": 8, "method": "token_estimate = characters/4 of the frozen core. Retrieval equivalent: provision 1200, judgment 6000, sanction 600 tokens each.", "usable_without_further_analysis": true, "gaps": [], "generative_output": false, "attribution": "Source: NovaCopilot", "links": { "obligation": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-28-processor", "compliance_effect": "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-28-processor", "exceptions": "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-28-processor", "timeline": "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr", "risk_chain": "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--processor", "changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes?type=package", "index": "https://legal.exploreworldai.com/api/public/v1/agent-packages" }, "hash": "dc72f97f6be7cb0ec351e8fc334dc33c1306e1f3cec38271de10607bc2aad6a3" }, "links": { "provisions": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:q-processor-documentation", "case_law": { "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:q-processor-documentation", "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:q-processor-documentation" }, "evidence": { "provenance": null, "chain_verify": "https://legal.exploreworldai.com/api/public/v1/changes/verify", "object_changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes" }, "compact": "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:q-processor-documentation?view=compact", "representations": {}, "machine_languages": [ "en", "sv" ], "ref": "eu:q-processor-documentation" }, "watch": { "changes": "https://legal.exploreworldai.com/api/public/v1/changes", "whats_new": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu", "conditional": "Send If-None-Match with the ETag; unchanged objects return 304 without body.", "recheck_after_seconds": 86400 }, "hash": "sha256:a94d97ee6ee281fea066fd4a68f90d62051c24687fea65edfea2ac78d9425441", "version": "legal-2026-10-06", "expires": "2026-10-07T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-06+legal-2026-10-06+2026-10-06T21:39:09", "content_hash": "sha256:a94d97ee6ee281fea066fd4a68f90d62051c24687fea65edfea2ac78d9425441", "revalidate_after": "2026-10-06T23:09:46.501Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:q-processor-documentation", "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering" }