{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--processor",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--processor)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-06",
    "fingerprint": "ewai:se:87781d",
    "proof": "sha256:2e0abeee065feb2446597f27d63b036882c8877eb3e06e1460632db7e9be96f5",
    "jurisdiction": "se",
    "lang": "en"
  },
  "brand_source": "Source: NovaCopilot",
  "brand": {
    "product": "NovaCopilot",
    "platform": "ExploreWorldAI",
    "infrastructure": "ExploreWorld Legal",
    "infrastructure_url": "legal.exploreworldai.com",
    "legal_entity": "Valkiv Ventures AB",
    "permanent_url": "https://legal.exploreworldai.com/novacopilot",
    "source": "Source: NovaCopilot",
    "powered_by": "Powered by NovaCopilot",
    "license": "https://legal.exploreworldai.com/licensvillkor",
    "contact": "stig@valkiv.com"
  },
  "object_type": "risk_chain",
  "object_id": "risk_chain:eu:gdpr--processor",
  "schema_version": "1",
  "schema": "https://legal.exploreworldai.com/api/public/v1/schemas/risk_chain",
  "url": "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--processor",
  "judgment": {
    "id": "eu:gdpr--processor",
    "text": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:gdpr--processor"
  },
  "siblings": {
    "risk": "https://legal.exploreworldai.com/api/public/v1/obj/risk/eu:gdpr--processor",
    "relation": "https://legal.exploreworldai.com/api/public/v1/obj/relation/eu:gdpr--processor",
    "change": "https://legal.exploreworldai.com/api/public/v1/obj/change/eu:gdpr--processor",
    "agent": "https://legal.exploreworldai.com/api/public/v1/obj/agent/eu:gdpr--processor",
    "provenance": "https://legal.exploreworldai.com/api/public/v1/obj/provenance/eu:gdpr--processor",
    "status": "https://legal.exploreworldai.com/api/public/v1/obj/status/eu:gdpr--processor",
    "precedent": "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:gdpr--processor",
    "edge": "https://legal.exploreworldai.com/api/public/v1/obj/edge/eu:gdpr--processor",
    "element": "https://legal.exploreworldai.com/api/public/v1/obj/element/eu:gdpr--processor",
    "decision": "https://legal.exploreworldai.com/api/public/v1/obj/decision/eu:gdpr--processor",
    "obligation": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr--processor",
    "sanction": "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr--processor",
    "weight": "https://legal.exploreworldai.com/api/public/v1/obj/weight/eu:gdpr--processor",
    "conflict": "https://legal.exploreworldai.com/api/public/v1/obj/conflict/eu:gdpr--processor",
    "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr--processor",
    "provision_link": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr--processor",
    "brief": "https://legal.exploreworldai.com/api/public/v1/obj/brief/eu:gdpr--processor",
    "citation_graph": "https://legal.exploreworldai.com/api/public/v1/obj/citation_graph/eu:gdpr--processor",
    "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr--processor",
    "compliance_effect": "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr--processor",
    "answer_node": "https://legal.exploreworldai.com/api/public/v1/obj/answer_node/eu:gdpr--processor",
    "exception": "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr--processor",
    "timeline": "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr--processor",
    "package": "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr--processor",
    "case_kit": "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:gdpr--processor",
    "documentation_requirement": "https://legal.exploreworldai.com/api/public/v1/obj/documentation_requirement/eu:gdpr--processor",
    "sme_kit": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--processor",
    "action_kit": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--processor"
  },
  "source": "NovaCopilot",
  "precedent_graph": "https://legal.exploreworldai.com/api/public/v1/precedent-graph/eu:gdpr--processor",
  "item": {
    "act": "gdpr",
    "jurisdiction": "eu",
    "role": "processor",
    "path": "element → obligation → breach → sanction → leading judgment",
    "steps": [
      {
        "elements": [
          "element:gdpr:processor",
          "element:gdpr:processing"
        ],
        "obligation": "obligation:eu:gdpr-art-28-processor",
        "role": "processor",
        "article": "28",
        "breach": "Failure to: Process only on documented instructions under a written contract.",
        "sanctions": [
          {
            "sanction_id": "sanction:eu:gdpr-art-83-4",
            "type": "administrative_fine",
            "max_amount": "EUR 10 000 000",
            "max_turnover_pct": 2,
            "authority": "Competent supervisory authority"
          },
          {
            "sanction_id": "sanction:eu:gdpr-art-58-2",
            "type": "corrective_order",
            "max_amount": null,
            "max_turnover_pct": null,
            "authority": "Competent supervisory authority"
          }
        ]
      },
      {
        "elements": [
          "element:gdpr:personal-data"
        ],
        "obligation": "obligation:eu:gdpr-art-32-processor",
        "role": "processor",
        "article": "32",
        "breach": "Failure to: Ensure a level of security appropriate to the risk.",
        "sanctions": [
          {
            "sanction_id": "sanction:eu:gdpr-art-83-4",
            "type": "administrative_fine",
            "max_amount": "EUR 10 000 000",
            "max_turnover_pct": 2,
            "authority": "Competent supervisory authority"
          },
          {
            "sanction_id": "sanction:eu:gdpr-art-58-2",
            "type": "corrective_order",
            "max_amount": null,
            "max_turnover_pct": null,
            "authority": "Competent supervisory authority"
          }
        ]
      },
      {
        "elements": [
          "element:gdpr:personal-data",
          "element:gdpr:processor"
        ],
        "obligation": "obligation:eu:gdpr-art-33-processor",
        "role": "processor",
        "article": "33",
        "breach": "Failure to: Notify the controller without undue delay after becoming aware of a breach.",
        "sanctions": [
          {
            "sanction_id": "sanction:eu:gdpr-art-83-4",
            "type": "administrative_fine",
            "max_amount": "EUR 10 000 000",
            "max_turnover_pct": 2,
            "authority": "Competent supervisory authority"
          },
          {
            "sanction_id": "sanction:eu:gdpr-art-58-2",
            "type": "corrective_order",
            "max_amount": null,
            "max_turnover_pct": null,
            "authority": "Competent supervisory authority"
          }
        ]
      }
    ],
    "risk_level": "high",
    "max_turnover_pct": 4,
    "leading_judgments": [
      "eu:c-798-24",
      "eu:c-474-24",
      "eu:c-199-24-62024cj0199"
    ],
    "gaps": [],
    "method": "Obligation and sanction registers joined on obligation ID; leading judgments are the newest in the outcome sample.",
    "links": {
      "obligations": [
        "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-28-processor",
        "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-32-processor",
        "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-33-processor"
      ],
      "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr",
      "compliance_effects": [
        "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-28-processor",
        "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-32-processor",
        "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-33-processor"
      ],
      "leading": [
        "https://legal.exploreworldai.com/api/public/v1/obj/citation_graph/eu:c-798-24",
        "https://legal.exploreworldai.com/api/public/v1/obj/citation_graph/eu:c-474-24",
        "https://legal.exploreworldai.com/api/public/v1/obj/citation_graph/eu:c-199-24-62024cj0199"
      ]
    },
    "hash": "4492bf0fb50090eb70c54e9c065698489248053f8f09f0d3189f04623341bbcb"
  },
  "links": {
    "provisions": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr",
    "case_law": {
      "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr",
      "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr"
    },
    "evidence": {
      "provenance": null,
      "chain_verify": "https://legal.exploreworldai.com/api/public/v1/changes/verify",
      "object_changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes"
    },
    "compact": "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--processor?view=compact",
    "representations": {},
    "machine_languages": [
      "en",
      "sv"
    ],
    "ref": "eu:gdpr--processor"
  },
  "watch": {
    "changes": "https://legal.exploreworldai.com/api/public/v1/changes",
    "whats_new": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu",
    "conditional": "Send If-None-Match with the ETag; unchanged objects return 304 without body.",
    "recheck_after_seconds": 86400
  },
  "hash": "sha256:2e0abeee065feb2446597f27d63b036882c8877eb3e06e1460632db7e9be96f5",
  "version": "legal-2026-10-06",
  "expires": "2026-10-07T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-06+legal-2026-10-06+2026-10-06T16:28:36",
    "content_hash": "sha256:2e0abeee065feb2446597f27d63b036882c8877eb3e06e1460632db7e9be96f5",
    "revalidate_after": "2026-10-06T17:35:00.731Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--processor",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering"
}