{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-12", "fingerprint": "ewai:se:4722c0", "proof": "sha256:340d6d86e6a33b4813c022c772398a85c64226d234af67c6d6c71ab9fd83f41e", "jurisdiction": "se", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "object_type": "sme_kit", "object_id": "sme_kit:eu:gdpr", "schema_version": "1", "schema": "https://legal.exploreworldai.com/api/public/v1/schemas/sme_kit", "url": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr", "source": "NovaCopilot", "item": { "coverage": { "complete": 10, "total": 10, "label": "10 of 10 answers ready", "reasons": {} }, "subject": "eu:gdpr", "act": "gdpr", "article": null, "answers": [ { "key": "obligations", "status": "ready", "ids": [ "obligation:eu:gdpr-art-12-controller", "obligation:eu:gdpr-art-13-controller", "obligation:eu:gdpr-art-14-controller", "obligation:eu:gdpr-art-15-controller", "obligation:eu:gdpr-art-16-controller", "obligation:eu:gdpr-art-17-controller", "obligation:eu:gdpr-art-18-controller", "obligation:eu:gdpr-art-19-controller", "obligation:eu:gdpr-art-20-controller", "obligation:eu:gdpr-art-21-controller", "obligation:eu:gdpr-art-22-controller", "obligation:eu:gdpr-art-24-controller", "obligation:eu:gdpr-art-25-controller", "obligation:eu:gdpr-art-26-controller", "obligation:eu:gdpr-art-27-controller", "obligation:eu:gdpr-art-28-2-processor", "obligation:eu:gdpr-art-28-processor", "obligation:eu:gdpr-art-30-controller", "obligation:eu:gdpr-art-30-processor", "obligation:eu:gdpr-art-31-controller", "obligation:eu:gdpr-art-32-controller", "obligation:eu:gdpr-art-32-processor", "obligation:eu:gdpr-art-33-controller", "obligation:eu:gdpr-art-33-processor", "obligation:eu:gdpr-art-34-controller", "obligation:eu:gdpr-art-35-controller", "obligation:eu:gdpr-art-36-controller", "obligation:eu:gdpr-art-37-controller", "obligation:eu:gdpr-art-44-controller", "obligation:eu:gdpr-art-44-processor", "obligation:eu:gdpr-art-5-controller", "obligation:eu:gdpr-art-6-controller", "obligation:eu:gdpr-art-7-controller", "obligation:eu:gdpr-art-8-controller", "obligation:eu:gdpr-art-9-controller" ], "sha256": "621d5155288450bb4980935d03cff3a5992871a778949f6fc2133ab221dbcf08" }, { "key": "responsibility", "status": "ready", "ids": [ "obligation:eu:gdpr-art-12-controller", "obligation:eu:gdpr-art-13-controller", "obligation:eu:gdpr-art-14-controller", "obligation:eu:gdpr-art-15-controller", "obligation:eu:gdpr-art-16-controller", "obligation:eu:gdpr-art-17-controller", "obligation:eu:gdpr-art-18-controller", "obligation:eu:gdpr-art-19-controller", "obligation:eu:gdpr-art-20-controller", "obligation:eu:gdpr-art-21-controller", "obligation:eu:gdpr-art-22-controller", "obligation:eu:gdpr-art-24-controller", "obligation:eu:gdpr-art-25-controller", "obligation:eu:gdpr-art-26-controller", "obligation:eu:gdpr-art-27-controller", "obligation:eu:gdpr-art-28-2-processor", "obligation:eu:gdpr-art-28-processor", "obligation:eu:gdpr-art-30-controller", "obligation:eu:gdpr-art-30-processor", "obligation:eu:gdpr-art-31-controller", "obligation:eu:gdpr-art-32-controller", "obligation:eu:gdpr-art-32-processor", "obligation:eu:gdpr-art-33-controller", "obligation:eu:gdpr-art-33-processor", "obligation:eu:gdpr-art-34-controller", "obligation:eu:gdpr-art-35-controller", "obligation:eu:gdpr-art-36-controller", "obligation:eu:gdpr-art-37-controller", "obligation:eu:gdpr-art-44-controller", "obligation:eu:gdpr-art-44-processor", "obligation:eu:gdpr-art-5-controller", "obligation:eu:gdpr-art-6-controller", "obligation:eu:gdpr-art-7-controller", "obligation:eu:gdpr-art-8-controller", "obligation:eu:gdpr-art-9-controller" ], "sha256": "7943f048662e4a7ae440c1db3218804db616b158e9893e8333ea8d0894db765f" }, { "key": "sanctions", "status": "ready", "ids": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-83-6" ], "sha256": "a021a03bc0c9d637e0be8ce153ea72f65877d96335511dfb9e1e25de9da4fc90" }, { "key": "risks", "status": "ready", "ids": [ "risk_chain:eu:gdpr--controller", "risk_chain:eu:gdpr--processor" ], "sha256": "5d52280d67238564901538e559b9ddbb1e31886eda5778496c3516b1a9b6a7e3" }, { "key": "exceptions", "status": "ready", "ids": [ "exception:eu:gdpr-household" ], "sha256": "38286342d667f0f9f17769a3f4828f043ed20a48c89ab3f170240bd9e1c1e78d" }, { "key": "documentation", "status": "ready", "ids": [ "documentation_requirement:eu:gdpr" ], "sha256": "2e2a71c1b7b720577d02dab1e5b76e5893ada7f423a598e15d7bd8a04c2c0d82" }, { "key": "checklist", "status": "ready", "ids": [ "obligation:eu:gdpr-art-12-controller", "obligation:eu:gdpr-art-13-controller", "obligation:eu:gdpr-art-14-controller", "obligation:eu:gdpr-art-15-controller", "obligation:eu:gdpr-art-16-controller", "obligation:eu:gdpr-art-17-controller", "obligation:eu:gdpr-art-18-controller", "obligation:eu:gdpr-art-19-controller", "obligation:eu:gdpr-art-20-controller", "obligation:eu:gdpr-art-21-controller", "obligation:eu:gdpr-art-22-controller", "obligation:eu:gdpr-art-24-controller", "obligation:eu:gdpr-art-25-controller", "obligation:eu:gdpr-art-26-controller", "obligation:eu:gdpr-art-27-controller", "obligation:eu:gdpr-art-28-2-processor", "obligation:eu:gdpr-art-28-processor", "obligation:eu:gdpr-art-30-controller", "obligation:eu:gdpr-art-30-processor", "obligation:eu:gdpr-art-31-controller", "obligation:eu:gdpr-art-32-controller", "obligation:eu:gdpr-art-32-processor", "obligation:eu:gdpr-art-33-controller", "obligation:eu:gdpr-art-33-processor", "obligation:eu:gdpr-art-34-controller", "obligation:eu:gdpr-art-35-controller", "obligation:eu:gdpr-art-36-controller", "obligation:eu:gdpr-art-37-controller", "obligation:eu:gdpr-art-44-controller", "obligation:eu:gdpr-art-44-processor", "obligation:eu:gdpr-art-5-controller", "obligation:eu:gdpr-art-6-controller", "obligation:eu:gdpr-art-7-controller", "obligation:eu:gdpr-art-8-controller", "obligation:eu:gdpr-art-9-controller" ], "sha256": "da7e5d5e22a338c8d9a8692339387327e7eb780b0f352dcca593ed2ab431984d" }, { "key": "precedents", "status": "ready", "ids": [ "precedent:eu:c-798-24", "precedent:eu:c-474-24", "precedent:eu:c-199-24-62024cj0199", "precedent:eu:c-414-24", "precedent:eu:c-484-24-62024cj0484" ], "sha256": "721baf951c9fa57dd57c5899ce7d2fedb87494c3c7a83eb067d098708f6614e8" }, { "key": "provision_links", "status": "ready", "ids": [ "provision_link:eu:gdpr" ], "sha256": "caa6a836d721631cf484ba248a80104fd10a8333bedf3558c43853e7fad949eb" }, { "key": "outcome_patterns", "status": "ready", "ids": [ "outcome_pattern:eu:gdpr" ], "sha256": "efbed392590ef0d6285f4bbbc1d5fd37d9c7b965c718222eaa1862da18b420cf" } ], "answers_full": [ { "question": "Which obligations apply?", "key": "obligations", "status": "ready", "answer": "35 obligations: Implement and demonstrate measures that make processing compliant.; Apply data protection by design and by default.; Keep records of processing activities. …", "ids": [ "obligation:eu:gdpr-art-12-controller", "obligation:eu:gdpr-art-13-controller", "obligation:eu:gdpr-art-14-controller", "obligation:eu:gdpr-art-15-controller", "obligation:eu:gdpr-art-16-controller", "obligation:eu:gdpr-art-17-controller", "obligation:eu:gdpr-art-18-controller", "obligation:eu:gdpr-art-19-controller", "obligation:eu:gdpr-art-20-controller", "obligation:eu:gdpr-art-21-controller", "obligation:eu:gdpr-art-22-controller", "obligation:eu:gdpr-art-24-controller", "obligation:eu:gdpr-art-25-controller", "obligation:eu:gdpr-art-26-controller", "obligation:eu:gdpr-art-27-controller", "obligation:eu:gdpr-art-28-2-processor", "obligation:eu:gdpr-art-28-processor", "obligation:eu:gdpr-art-30-controller", "obligation:eu:gdpr-art-30-processor", "obligation:eu:gdpr-art-31-controller", "obligation:eu:gdpr-art-32-controller", "obligation:eu:gdpr-art-32-processor", "obligation:eu:gdpr-art-33-controller", "obligation:eu:gdpr-art-33-processor", "obligation:eu:gdpr-art-34-controller", "obligation:eu:gdpr-art-35-controller", "obligation:eu:gdpr-art-36-controller", "obligation:eu:gdpr-art-37-controller", "obligation:eu:gdpr-art-44-controller", "obligation:eu:gdpr-art-44-processor", "obligation:eu:gdpr-art-5-controller", "obligation:eu:gdpr-art-6-controller", "obligation:eu:gdpr-art-7-controller", "obligation:eu:gdpr-art-8-controller", "obligation:eu:gdpr-art-9-controller" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-12-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-13-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-14-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-15-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-16-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-17-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-18-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-19-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-20-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-21-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-22-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-24-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-25-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-26-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-27-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-28-2-processor", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-28-processor", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-30-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-30-processor", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-31-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-32-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-32-processor", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-33-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-33-processor", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-34-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-35-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-36-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-37-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-44-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-44-processor", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-5-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-6-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-7-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-8-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-9-controller" ], "sha256": "621d5155288450bb4980935d03cff3a5992871a778949f6fc2133ab221dbcf08", "reason": null }, { "question": "Who is responsible?", "key": "responsibility", "status": "ready", "answer": "Responsible roles: controller, processor.", "ids": [ "obligation:eu:gdpr-art-12-controller", "obligation:eu:gdpr-art-13-controller", "obligation:eu:gdpr-art-14-controller", "obligation:eu:gdpr-art-15-controller", "obligation:eu:gdpr-art-16-controller", "obligation:eu:gdpr-art-17-controller", "obligation:eu:gdpr-art-18-controller", "obligation:eu:gdpr-art-19-controller", "obligation:eu:gdpr-art-20-controller", "obligation:eu:gdpr-art-21-controller", "obligation:eu:gdpr-art-22-controller", "obligation:eu:gdpr-art-24-controller", "obligation:eu:gdpr-art-25-controller", "obligation:eu:gdpr-art-26-controller", "obligation:eu:gdpr-art-27-controller", "obligation:eu:gdpr-art-28-2-processor", "obligation:eu:gdpr-art-28-processor", "obligation:eu:gdpr-art-30-controller", "obligation:eu:gdpr-art-30-processor", "obligation:eu:gdpr-art-31-controller", "obligation:eu:gdpr-art-32-controller", "obligation:eu:gdpr-art-32-processor", "obligation:eu:gdpr-art-33-controller", "obligation:eu:gdpr-art-33-processor", "obligation:eu:gdpr-art-34-controller", "obligation:eu:gdpr-art-35-controller", "obligation:eu:gdpr-art-36-controller", "obligation:eu:gdpr-art-37-controller", "obligation:eu:gdpr-art-44-controller", "obligation:eu:gdpr-art-44-processor", "obligation:eu:gdpr-art-5-controller", "obligation:eu:gdpr-art-6-controller", "obligation:eu:gdpr-art-7-controller", "obligation:eu:gdpr-art-8-controller", "obligation:eu:gdpr-art-9-controller" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-12-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-13-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-14-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-15-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-16-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-17-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-18-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-19-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-20-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-21-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-22-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-24-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-25-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-26-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-27-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-28-2-processor", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-28-processor", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-30-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-30-processor", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-31-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-32-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-32-processor", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-33-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-33-processor", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-34-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-35-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-36-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-37-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-44-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-44-processor", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-5-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-6-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-7-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-8-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-9-controller" ], "sha256": "7943f048662e4a7ae440c1db3218804db616b158e9893e8333ea8d0894db765f", "reason": null }, { "question": "Which sanctions can be triggered?", "key": "sanctions", "status": "ready", "answer": "4 sanctions, up to 4 % of global turnover; e.g. EUR 10 000 000.", "ids": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-83-6" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-58-2", "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-4", "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-5", "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-6" ], "sha256": "a021a03bc0c9d637e0be8ce153ea72f65877d96335511dfb9e1e25de9da4fc90", "reason": null }, { "question": "What are the risks?", "key": "risks", "status": "ready", "answer": "Risk level high across 2 roles.", "ids": [ "risk_chain:eu:gdpr--controller", "risk_chain:eu:gdpr--processor" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--controller", "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--processor" ], "sha256": "5d52280d67238564901538e559b9ddbb1e31886eda5778496c3516b1a9b6a7e3", "reason": null }, { "question": "Which exceptions apply?", "key": "exceptions", "status": "ready", "answer": "1 exceptions, e.g. Processing by a natural person in the course of a purely personal or household activity.", "ids": [ "exception:eu:gdpr-household" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-12-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-13-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-14-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-15-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-16-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-17-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-18-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-19-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-20-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-21-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-22-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-24-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-25-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-26-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-27-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-28-2-processor", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-28-processor", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-30-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-30-processor", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-31-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-32-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-32-processor", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-33-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-33-processor", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-34-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-35-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-36-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-37-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-44-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-44-processor", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-5-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-6-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-7-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-8-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-9-controller" ], "sha256": "38286342d667f0f9f17769a3f4828f043ed20a48c89ab3f170240bd9e1c1e78d", "reason": null }, { "question": "Which documentation is required?", "key": "documentation", "status": "ready", "answer": "Keep: Record of processing activities, Report to authority, Impact or risk assessment, Written agreement.", "ids": [ "documentation_requirement:eu:gdpr" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/documentation_requirement/eu:gdpr" ], "sha256": "2e2a71c1b7b720577d02dab1e5b76e5893ada7f423a598e15d7bd8a04c2c0d82", "reason": null }, { "question": "What does a compliance checklist look like?", "key": "checklist", "status": "ready", "answer": "35 checks across 2 roles.", "ids": [ "obligation:eu:gdpr-art-12-controller", "obligation:eu:gdpr-art-13-controller", "obligation:eu:gdpr-art-14-controller", "obligation:eu:gdpr-art-15-controller", "obligation:eu:gdpr-art-16-controller", "obligation:eu:gdpr-art-17-controller", "obligation:eu:gdpr-art-18-controller", "obligation:eu:gdpr-art-19-controller", "obligation:eu:gdpr-art-20-controller", "obligation:eu:gdpr-art-21-controller", "obligation:eu:gdpr-art-22-controller", "obligation:eu:gdpr-art-24-controller", "obligation:eu:gdpr-art-25-controller", "obligation:eu:gdpr-art-26-controller", "obligation:eu:gdpr-art-27-controller", "obligation:eu:gdpr-art-28-2-processor", "obligation:eu:gdpr-art-28-processor", "obligation:eu:gdpr-art-30-controller", "obligation:eu:gdpr-art-30-processor", "obligation:eu:gdpr-art-31-controller", "obligation:eu:gdpr-art-32-controller", "obligation:eu:gdpr-art-32-processor", "obligation:eu:gdpr-art-33-controller", "obligation:eu:gdpr-art-33-processor", "obligation:eu:gdpr-art-34-controller", "obligation:eu:gdpr-art-35-controller", "obligation:eu:gdpr-art-36-controller", "obligation:eu:gdpr-art-37-controller", "obligation:eu:gdpr-art-44-controller", "obligation:eu:gdpr-art-44-processor", "obligation:eu:gdpr-art-5-controller", "obligation:eu:gdpr-art-6-controller", "obligation:eu:gdpr-art-7-controller", "obligation:eu:gdpr-art-8-controller", "obligation:eu:gdpr-art-9-controller" ], "urls": [], "sha256": "da7e5d5e22a338c8d9a8692339387327e7eb780b0f352dcca593ed2ab431984d", "reason": null }, { "question": "Which precedents support the answer?", "key": "precedents", "status": "ready", "answer": "38 judgments in the register; leading: eu:c-798-24, eu:c-474-24, eu:c-199-24-62024cj0199, eu:c-414-24, eu:c-484-24-62024cj0484.", "ids": [ "precedent:eu:c-798-24", "precedent:eu:c-474-24", "precedent:eu:c-199-24-62024cj0199", "precedent:eu:c-414-24", "precedent:eu:c-484-24-62024cj0484" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-798-24", "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-474-24", "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-199-24-62024cj0199", "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-414-24", "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-484-24-62024cj0484" ], "sha256": "721baf951c9fa57dd57c5899ce7d2fedb87494c3c7a83eb067d098708f6614e8", "reason": null }, { "question": "How are the rules linked to other rules?", "key": "provision_links", "status": "ready", "answer": "Provision relations for gdpr.", "ids": [ "provision_link:eu:gdpr" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr" ], "sha256": "caa6a836d721631cf484ba248a80104fd10a8333bedf3558c43853e7fad949eb", "reason": null }, { "question": "How do courts usually rule in similar situations?", "key": "outcome_patterns", "status": "ready", "answer": "Trend stable over 3 years, 38 judgments.", "ids": [ "outcome_pattern:eu:gdpr" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr", "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr" ], "sha256": "efbed392590ef0d6285f4bbbc1d5fd37d9c7b965c718222eaa1862da18b420cf", "reason": null } ], "checklist": [ { "step": 1, "role": "controller", "check": "Implement and demonstrate measures that make processing compliant.", "provision": "gdpr 24", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 2, "role": "controller", "check": "Apply data protection by design and by default.", "provision": "gdpr 25", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 3, "role": "controller", "check": "Keep records of processing activities.", "provision": "gdpr 30", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 4, "role": "controller", "check": "Ensure a level of security appropriate to the risk.", "provision": "gdpr 32", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 5, "role": "controller", "check": "Notify a personal data breach to the supervisory authority.", "provision": "gdpr 33", "deadline": "72 hours", "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 6, "role": "controller", "check": "Carry out a data protection impact assessment for high-risk processing.", "provision": "gdpr 35", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 7, "role": "processor", "check": "Process only on documented instructions under a written contract.", "provision": "gdpr 28", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 8, "role": "processor", "check": "Ensure a level of security appropriate to the risk.", "provision": "gdpr 32", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 9, "role": "processor", "check": "Notify the controller without undue delay after becoming aware of a breach.", "provision": "gdpr 33", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 10, "role": "controller", "check": "Process personal data in line with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and be able to demonstrate compliance (accountability).", "provision": "gdpr 5", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 11, "role": "controller", "check": "Process personal data only where at least one legal basis in Article 6(1) applies.", "provision": "gdpr 6", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 12, "role": "controller", "check": "Provide information on action taken on a data subject request under Articles 15 to 22 without undue delay and in any event within one month of receipt of the request.", "provision": "gdpr 12", "deadline": "30 days", "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 13, "role": "controller", "check": "Give the data subject confirmation as to whether personal data concerning him or her are being processed, access to the personal data and the information listed in Article 15(1), and a copy of the data.", "provision": "gdpr 15", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 14, "role": "controller", "check": "Erase personal data without undue delay where one of the grounds in Article 17(1) applies.", "provision": "gdpr 17", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 15, "role": "controller", "check": "Be able to demonstrate consent where processing is based on consent, present consent requests clearly distinguishable from other matters, and make withdrawal as easy as giving consent.", "provision": "gdpr 7", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 16, "role": "controller", "check": "Obtain consent from the holder of parental responsibility when offering information society services directly to a child below 16, or the lower national age of at least 13, and make reasonable efforts to verify it.", "provision": "gdpr 8", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 17, "role": "controller", "check": "Do not process special categories of personal data unless an exception in Article 9(2) applies.", "provision": "gdpr 9", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 18, "role": "controller", "check": "Give the data subject the information listed in Article 13, including identity, purposes, legal basis, recipients, transfers, retention period and rights, when personal data are obtained from the data subject.", "provision": "gdpr 13", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 19, "role": "controller", "check": "Give the data subject the information listed in Article 14 where personal data have not been obtained from the data subject, including the source of the data.", "provision": "gdpr 14", "deadline": "30 days", "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 20, "role": "controller", "check": "Rectify inaccurate personal data and complete incomplete data on the data subject's request.", "provision": "gdpr 16", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 21, "role": "controller", "check": "Restrict processing where the data subject contests accuracy, the processing is unlawful, the data are needed for legal claims or an objection is pending.", "provision": "gdpr 18", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 22, "role": "controller", "check": "Communicate any rectification, erasure or restriction to each recipient to whom the data have been disclosed, unless impossible or involving disproportionate effort.", "provision": "gdpr 19", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 23, "role": "controller", "check": "Provide personal data processed by automated means on the basis of consent or contract in a structured, commonly used and machine-readable format, and transmit it to another controller where technically feasible.", "provision": "gdpr 20", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 24, "role": "controller", "check": "Stop processing based on Article 6(1)(e) or (f) on objection unless compelling legitimate grounds override, and always stop processing for direct marketing on objection.", "provision": "gdpr 21", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 25, "role": "controller", "check": "Do not subject a data subject to a decision based solely on automated processing with legal or similarly significant effects unless an exception applies, and then provide human intervention, the right to express a view and to contest the decision.", "provision": "gdpr 22", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 26, "role": "controller", "check": "Determine joint controllers' respective responsibilities in a transparent arrangement and make its essence available to the data subject.", "provision": "gdpr 26", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 27, "role": "controller", "check": "Designate in writing a representative in the Union when not established in the Union but subject to Article 3(2), unless the processing is occasional and low risk.", "provision": "gdpr 27", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 28, "role": "controller", "check": "Cooperate with the supervisory authority in the performance of its tasks on request.", "provision": "gdpr 31", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 29, "role": "controller", "check": "Communicate a personal data breach likely to result in a high risk to the rights and freedoms of natural persons to the data subjects in clear and plain language.", "provision": "gdpr 34", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 30, "role": "controller", "check": "Consult the supervisory authority before processing where a data protection impact assessment indicates high risk in the absence of mitigating measures.", "provision": "gdpr 36", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 31, "role": "controller", "check": "Designate a data protection officer where the core activities are public authority processing, large-scale regular and systematic monitoring, or large-scale special category or criminal data, and publish the contact details.", "provision": "gdpr 37", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 32, "role": "controller", "check": "Transfer personal data to a third country or international organisation only under an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a derogation in Article 49.", "provision": "gdpr 44", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 33, "role": "processor", "check": "Do not engage another processor without prior specific or general written authorisation of the controller, and inform the controller of intended changes so it can object.", "provision": "gdpr 28(2)", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 34, "role": "processor", "check": "Maintain a written record of all categories of processing activities carried out on behalf of each controller.", "provision": "gdpr 30", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 35, "role": "processor", "check": "Transfer personal data to a third country or international organisation only under Chapter V safeguards.", "provision": "gdpr 44", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-5", "sanction:eu:gdpr-art-58-2" ], "done": false } ], "links": { "act_kit": null, "provisions": [ "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-24", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-25", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-30", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-32", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-33", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-35", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-28", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-5", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-6", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-12", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-15", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-17", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-7", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-8", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-9", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-13", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-14", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-16", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-18", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-19", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-20", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-21", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-22", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-26", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-27", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-31", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-34", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-36", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-37", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-44", "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-28-2" ], "case_kits": [ "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-798-24", "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-474-24", "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-199-24-62024cj0199", "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-414-24", "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-484-24-62024cj0484" ], "documentation": "https://legal.exploreworldai.com/api/public/v1/obj/documentation_requirement/eu:gdpr", "list": "https://legal.exploreworldai.com/api/public/v1/sme-kits", "changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes?type=sme_kit" }, "method": "Ten fixed business questions answered from existing deterministic registers. Gaps carry fixed reason codes. No model writes anything.", "hash": "e8748d8060b02c0ba4a3783f62db12ae1676298d8fc7c3a6763138c164c70555" }, "links": { "provisions": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr", "case_law": { "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr", "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr" }, "evidence": { "provenance": null, "chain_verify": "https://legal.exploreworldai.com/api/public/v1/changes/verify", "object_changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes" }, "compact": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr?view=compact", "representations": {}, "machine_languages": [ "en", "sv" ], "ref": "eu:gdpr" }, "watch": { "changes": "https://legal.exploreworldai.com/api/public/v1/changes", "whats_new": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu", "conditional": "Send If-None-Match with the ETag; unchanged objects return 304 without body.", "recheck_after_seconds": 86400 }, "hash": "sha256:340d6d86e6a33b4813c022c772398a85c64226d234af67c6d6c71ab9fd83f41e", "version": "legal-2026-10-12", "expires": "2026-10-13T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-12+legal-2026-10-12+2026-10-12T12:04:16", "content_hash": "sha256:340d6d86e6a33b4813c022c772398a85c64226d234af67c6d6c71ab9fd83f41e", "revalidate_after": "2026-10-12T13:18:55.176Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr", "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering" }