{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-07",
    "fingerprint": "ewai:se:18586d",
    "proof": "sha256:a1a66a30b30d5bb88c23afc61a4bd6ac38bf2cd8041f0685243e2d9c15b2c7aa",
    "jurisdiction": "se",
    "lang": "en",
    "publisher": "NovaCopilot by ExploreWorld Legal",
    "terms": "https://legal.exploreworldai.com/om"
  },
  "brand_source": "Source: NovaCopilot",
  "brand": {
    "product": "NovaCopilot",
    "platform": "ExploreWorldAI",
    "infrastructure": "ExploreWorld Legal",
    "infrastructure_url": "legal.exploreworldai.com",
    "legal_entity": "Valkiv Ventures AB",
    "permanent_url": "https://legal.exploreworldai.com/novacopilot",
    "source": "Source: NovaCopilot",
    "powered_by": "Powered by NovaCopilot",
    "license": "https://legal.exploreworldai.com/licensvillkor",
    "contact": "stig@valkiv.com"
  },
  "object_type": "provision_link",
  "object_id": "provision_link:eu:gdpr",
  "schema_version": "1",
  "schema": "https://legal.exploreworldai.com/api/public/v1/schemas/provision_link",
  "url": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr",
  "judgment": {
    "id": "eu:gdpr",
    "text": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:gdpr"
  },
  "siblings": {
    "risk": "https://legal.exploreworldai.com/api/public/v1/obj/risk/eu:gdpr",
    "relation": "https://legal.exploreworldai.com/api/public/v1/obj/relation/eu:gdpr",
    "change": "https://legal.exploreworldai.com/api/public/v1/obj/change/eu:gdpr",
    "agent": "https://legal.exploreworldai.com/api/public/v1/obj/agent/eu:gdpr",
    "provenance": "https://legal.exploreworldai.com/api/public/v1/obj/provenance/eu:gdpr",
    "status": "https://legal.exploreworldai.com/api/public/v1/obj/status/eu:gdpr",
    "precedent": "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:gdpr",
    "edge": "https://legal.exploreworldai.com/api/public/v1/obj/edge/eu:gdpr",
    "element": "https://legal.exploreworldai.com/api/public/v1/obj/element/eu:gdpr",
    "decision": "https://legal.exploreworldai.com/api/public/v1/obj/decision/eu:gdpr",
    "obligation": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr",
    "sanction": "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr",
    "weight": "https://legal.exploreworldai.com/api/public/v1/obj/weight/eu:gdpr",
    "conflict": "https://legal.exploreworldai.com/api/public/v1/obj/conflict/eu:gdpr",
    "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr",
    "brief": "https://legal.exploreworldai.com/api/public/v1/obj/brief/eu:gdpr",
    "citation_graph": "https://legal.exploreworldai.com/api/public/v1/obj/citation_graph/eu:gdpr",
    "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr",
    "risk_chain": "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr",
    "compliance_effect": "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr",
    "answer_node": "https://legal.exploreworldai.com/api/public/v1/obj/answer_node/eu:gdpr",
    "exception": "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr",
    "timeline": "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr",
    "package": "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr",
    "case_kit": "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:gdpr",
    "documentation_requirement": "https://legal.exploreworldai.com/api/public/v1/obj/documentation_requirement/eu:gdpr",
    "sme_kit": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr",
    "action_kit": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr"
  },
  "source": "NovaCopilot",
  "precedent_graph": "https://legal.exploreworldai.com/api/public/v1/precedent-graph/eu:gdpr",
  "item": {
    "subject": "act:eu:gdpr",
    "links": [
      {
        "relation": "implemented_by",
        "from": "act:eu:gdpr",
        "to": "act:se:dataskyddslagen",
        "basis": "Kompletterar förordning (EU) 2016/679",
        "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/_sfs-2018-218/"
      },
      {
        "relation": "implemented_by",
        "from": "act:eu:gdpr",
        "to": "act:se:kamerabevakningslagen",
        "basis": "Nationell reglering vid sidan av förordning (EU) 2016/679",
        "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/_sfs-2018-1200/"
      },
      {
        "relation": "implemented_by",
        "from": "act:eu:gdpr",
        "to": "act:se:patientdatalagen",
        "basis": "Kompletterar förordning (EU) 2016/679 för hälso- och sjukvården",
        "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/_sfs-2008-355/"
      },
      {
        "relation": "supplemented_by",
        "from": "act:eu:gdpr",
        "to": "act:se:SFS 2018:218",
        "basis": "national register (supplementary)",
        "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2018218-med-kompletterande-bestammelser_sfs-2018-218/"
      },
      {
        "relation": "implemented_by",
        "from": "act:eu:gdpr",
        "to": "act:no:LOV-2018-06-15-38",
        "basis": "national register (transposition)",
        "url": "https://lovdata.no/dokument/NL/lov/2018-06-15-38"
      },
      {
        "relation": "supplemented_by",
        "from": "act:eu:gdpr",
        "to": "act:dk:LOV nr 502 af 23/05/2018",
        "basis": "national register (supplementary)",
        "url": "https://www.retsinformation.dk/eli/lta/2018/502"
      },
      {
        "relation": "supplemented_by",
        "from": "act:eu:gdpr",
        "to": "act:fi:1050/2018",
        "basis": "national register (supplementary)",
        "url": "https://www.finlex.fi/fi/laki/ajantasa/2018/20181050"
      },
      {
        "relation": "supplemented_by",
        "from": "act:eu:gdpr",
        "to": "act:de:BDSG",
        "basis": "national register (supplementary)",
        "url": "https://www.gesetze-im-internet.de/bdsg_2018/"
      },
      {
        "relation": "implemented_by",
        "from": "act:eu:gdpr",
        "to": "act:uk:2018 c. 12",
        "basis": "national register (transposition)",
        "url": "https://www.legislation.gov.uk/ukpga/2018/12/contents"
      },
      {
        "relation": "analogous_to",
        "from": "provision:eu:gdpr:32",
        "to": "provision:eu:nis2:21",
        "basis": "Both articles require security measures proportionate to the risk, one for personal data and one for network and information systems.",
        "url": null
      },
      {
        "relation": "analogous_to",
        "from": "provision:eu:gdpr:32",
        "to": "provision:eu:dora:9",
        "basis": "Safeguards for processing meet safeguards for the ICT systems of a financial entity: the same kind of requirement, a different object of protection.",
        "url": null
      },
      {
        "relation": "intersects_with",
        "from": "provision:eu:gdpr:33",
        "to": "provision:eu:nis2:23",
        "basis": "One and the same incident can trigger notification to the data protection authority and to the CSIRT, on different deadlines and to different recipients.",
        "url": null
      },
      {
        "relation": "intersects_with",
        "from": "provision:eu:gdpr:33",
        "to": "provision:eu:dora:19",
        "basis": "Reporting a major ICT-related incident and notifying a personal data breach can be triggered by the same event at a financial entity.",
        "url": null
      },
      {
        "relation": "depends_on",
        "from": "provision:eu:ai-act:10",
        "to": "provision:eu:gdpr:9",
        "basis": "The article on data and data governance leans on the exception for special categories of personal data where such data are needed to detect and correct bias.",
        "url": null
      },
      {
        "relation": "depends_on",
        "from": "provision:eu:ai-act:26",
        "to": "provision:eu:gdpr:35",
        "basis": "The obligations of the deployer presuppose the impact assessment the data protection regulation already requires, and refer back to it.",
        "url": null
      },
      {
        "relation": "analogous_to",
        "from": "provision:eu:ai-act:22",
        "to": "provision:eu:gdpr:27",
        "basis": "Both articles require a representative inside the union for a party established outside it, with the same role as the point of contact for supervision.",
        "url": null
      },
      {
        "relation": "analogous_to",
        "from": "provision:eu:dora:28",
        "to": "provision:eu:gdpr:28",
        "basis": "The requirements on the contract with an ICT third-party provider sit close to those on the processor agreement: instructions, audit and exit.",
        "url": null
      },
      {
        "relation": "intersects_with",
        "from": "provision:eu:dsa:16",
        "to": "provision:eu:gdpr:17",
        "basis": "A notice of illegal content and an erasure request can concern the same post, but are decided on different grounds and by different recipients.",
        "url": null
      },
      {
        "relation": "analogous_to",
        "from": "provision:eu:data-act:4",
        "to": "provision:eu:gdpr:20",
        "basis": "The right to access data from a connected product runs parallel to the right to data portability, over a wider set of data.",
        "url": null
      },
      {
        "relation": "depends_on",
        "from": "provision:eu:eprivacy:5",
        "to": "provision:eu:gdpr:6",
        "basis": "The protection of confidentiality of communications rests on a consent whose meaning is taken from the data protection regulation, which also carries the other bases.",
        "url": null
      }
    ],
    "obligations": [
      {
        "relation": "imposes",
        "from": "act:eu:gdpr",
        "to": "obligation:eu:gdpr-art-24-controller",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-24-controller"
      },
      {
        "relation": "imposes",
        "from": "act:eu:gdpr",
        "to": "obligation:eu:gdpr-art-25-controller",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-25-controller"
      },
      {
        "relation": "imposes",
        "from": "act:eu:gdpr",
        "to": "obligation:eu:gdpr-art-30-controller",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-30-controller"
      },
      {
        "relation": "imposes",
        "from": "act:eu:gdpr",
        "to": "obligation:eu:gdpr-art-32-controller",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-32-controller"
      },
      {
        "relation": "imposes",
        "from": "act:eu:gdpr",
        "to": "obligation:eu:gdpr-art-33-controller",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-33-controller"
      },
      {
        "relation": "imposes",
        "from": "act:eu:gdpr",
        "to": "obligation:eu:gdpr-art-35-controller",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-35-controller"
      },
      {
        "relation": "imposes",
        "from": "act:eu:gdpr",
        "to": "obligation:eu:gdpr-art-28-processor",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-28-processor"
      },
      {
        "relation": "imposes",
        "from": "act:eu:gdpr",
        "to": "obligation:eu:gdpr-art-32-processor",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-32-processor"
      },
      {
        "relation": "imposes",
        "from": "act:eu:gdpr",
        "to": "obligation:eu:gdpr-art-33-processor",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-33-processor"
      },
      {
        "relation": "imposes",
        "from": "act:eu:gdpr",
        "to": "obligation:eu:gdpr-art-5-controller",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-5-controller"
      },
      {
        "relation": "imposes",
        "from": "act:eu:gdpr",
        "to": "obligation:eu:gdpr-art-6-controller",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-6-controller"
      },
      {
        "relation": "imposes",
        "from": "act:eu:gdpr",
        "to": "obligation:eu:gdpr-art-12-controller",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-12-controller"
      },
      {
        "relation": "imposes",
        "from": "act:eu:gdpr",
        "to": "obligation:eu:gdpr-art-15-controller",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-15-controller"
      },
      {
        "relation": "imposes",
        "from": "act:eu:gdpr",
        "to": "obligation:eu:gdpr-art-17-controller",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-17-controller"
      }
    ],
    "sanctions": [
      {
        "relation": "sanctioned_by",
        "from": "act:eu:gdpr",
        "to": "sanction:eu:gdpr-art-83-4",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-4"
      },
      {
        "relation": "sanctioned_by",
        "from": "act:eu:gdpr",
        "to": "sanction:eu:gdpr-art-83-5",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-5"
      },
      {
        "relation": "sanctioned_by",
        "from": "act:eu:gdpr",
        "to": "sanction:eu:gdpr-art-83-6",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-6"
      },
      {
        "relation": "sanctioned_by",
        "from": "act:eu:gdpr",
        "to": "sanction:eu:gdpr-art-58-2",
        "url": "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-58-2"
      }
    ],
    "counts": {
      "links": 20,
      "obligations": 14,
      "sanctions": 4
    },
    "gaps": [],
    "method": "Register links only: SE_ACTS euActId, national implementation rows, article crosswalk, obligation and sanction registers.",
    "hash": "42f399007303698e04ecb2e51884fef353348f97ed8d10e79a4700d48ec81ed3"
  },
  "links": {
    "provisions": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr",
    "case_law": {
      "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr",
      "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr"
    },
    "evidence": {
      "provenance": null,
      "chain_verify": "https://legal.exploreworldai.com/api/public/v1/changes/verify",
      "object_changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes"
    },
    "compact": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr?view=compact",
    "representations": {},
    "machine_languages": [
      "en",
      "sv"
    ],
    "ref": "eu:gdpr"
  },
  "watch": {
    "changes": "https://legal.exploreworldai.com/api/public/v1/changes",
    "whats_new": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu",
    "conditional": "Send If-None-Match with the ETag; unchanged objects return 304 without body.",
    "recheck_after_seconds": 86400
  },
  "hash": "sha256:a1a66a30b30d5bb88c23afc61a4bd6ac38bf2cd8041f0685243e2d9c15b2c7aa",
  "version": "legal-2026-10-07",
  "expires": "2026-10-08T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-07+legal-2026-10-07+2026-10-07T05:56:43",
    "content_hash": "sha256:a1a66a30b30d5bb88c23afc61a4bd6ac38bf2cd8041f0685243e2d9c15b2c7aa",
    "revalidate_after": "2026-10-07T07:08:37.033Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering"
}