{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-33", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-33)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-06", "fingerprint": "ewai:se:e17a61", "proof": "sha256:673a800fd3edb058eeea4a331312276d5ebe5435d7a5bdfe271e933d59585545", "jurisdiction": "se", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "brand": { "product": "NovaCopilot", "platform": "ExploreWorldAI", "infrastructure": "ExploreWorld Legal", "infrastructure_url": "legal.exploreworldai.com", "legal_entity": "Valkiv Ventures AB", "permanent_url": "https://legal.exploreworldai.com/novacopilot", "source": "Source: NovaCopilot", "powered_by": "Powered by NovaCopilot", "license": "https://legal.exploreworldai.com/licensvillkor", "contact": "stig@valkiv.com" }, "object_type": "sme_kit", "object_id": "sme_kit:eu:gdpr--art-33", "schema_version": "1", "schema": "https://legal.exploreworldai.com/api/public/v1/schemas/sme_kit", "url": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-33", "judgment": { "id": "eu:gdpr--art-33", "text": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:gdpr--art-33" }, "siblings": { "risk": "https://legal.exploreworldai.com/api/public/v1/obj/risk/eu:gdpr--art-33", "relation": "https://legal.exploreworldai.com/api/public/v1/obj/relation/eu:gdpr--art-33", "change": "https://legal.exploreworldai.com/api/public/v1/obj/change/eu:gdpr--art-33", "agent": "https://legal.exploreworldai.com/api/public/v1/obj/agent/eu:gdpr--art-33", "provenance": "https://legal.exploreworldai.com/api/public/v1/obj/provenance/eu:gdpr--art-33", "status": "https://legal.exploreworldai.com/api/public/v1/obj/status/eu:gdpr--art-33", "precedent": "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:gdpr--art-33", "edge": "https://legal.exploreworldai.com/api/public/v1/obj/edge/eu:gdpr--art-33", "element": "https://legal.exploreworldai.com/api/public/v1/obj/element/eu:gdpr--art-33", "decision": "https://legal.exploreworldai.com/api/public/v1/obj/decision/eu:gdpr--art-33", "obligation": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr--art-33", "sanction": "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr--art-33", "weight": "https://legal.exploreworldai.com/api/public/v1/obj/weight/eu:gdpr--art-33", "conflict": "https://legal.exploreworldai.com/api/public/v1/obj/conflict/eu:gdpr--art-33", "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr--art-33", "provision_link": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr--art-33", "brief": "https://legal.exploreworldai.com/api/public/v1/obj/brief/eu:gdpr--art-33", "citation_graph": "https://legal.exploreworldai.com/api/public/v1/obj/citation_graph/eu:gdpr--art-33", "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr--art-33", "risk_chain": "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--art-33", "compliance_effect": "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr--art-33", "answer_node": "https://legal.exploreworldai.com/api/public/v1/obj/answer_node/eu:gdpr--art-33", "exception": "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr--art-33", "timeline": "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr--art-33", "package": "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr--art-33", "case_kit": "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:gdpr--art-33", "documentation_requirement": "https://legal.exploreworldai.com/api/public/v1/obj/documentation_requirement/eu:gdpr--art-33", "action_kit": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-33" }, "source": "NovaCopilot", "precedent_graph": "https://legal.exploreworldai.com/api/public/v1/precedent-graph/eu:gdpr--art-33", "item": { "coverage": { "complete": 10, "total": 10, "label": "10 of 10 answers ready", "reasons": {} }, "subject": "eu:gdpr--art-33", "act": "gdpr", "article": "33", "answers": [ { "key": "obligations", "status": "ready", "ids": [ "obligation:eu:gdpr-art-33-controller", "obligation:eu:gdpr-art-33-processor" ], "sha256": "d001466e74107c53cfb1c90137a0b8ad77059159925e0154ed36abab844a65cc" }, { "key": "responsibility", "status": "ready", "ids": [ "obligation:eu:gdpr-art-33-controller", "obligation:eu:gdpr-art-33-processor" ], "sha256": "6107e6dcf604a84f319bebc031c4adfda2b13922a6ca3807361d2ed4df2d7487" }, { "key": "sanctions", "status": "ready", "ids": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "sha256": "a0516a597efcc11e9c8159061cb72ffde715e9a8c43ff883d2355439c28eeb0c" }, { "key": "risks", "status": "ready", "ids": [ "risk_chain:eu:gdpr--controller", "risk_chain:eu:gdpr--processor" ], "sha256": "d1b0a81d0703a21fd2a9c142c6d76ab55bd3606f9691a0e0d3d3462435ecd24d" }, { "key": "exceptions", "status": "ready", "ids": [ "exception:eu:gdpr-breach-unlikely-risk", "exception:eu:gdpr-household" ], "sha256": "4fb02055712ae3e10ece5ff9b2ef3d260d748504c20ca2025b776275db02e710" }, { "key": "documentation", "status": "ready", "ids": [ "documentation_requirement:eu:gdpr--art-33" ], "sha256": "aeb430dc26bc2349339854e135df114ba8ee53b9f5528a478529733045078204" }, { "key": "checklist", "status": "ready", "ids": [ "obligation:eu:gdpr-art-33-controller", "obligation:eu:gdpr-art-33-processor" ], "sha256": "91455f3564c47d3074f80f19edace7f990a586f53167b16549049483f40412a5" }, { "key": "precedents", "status": "ready", "ids": [ "precedent:eu:c-798-24", "precedent:eu:c-474-24", "precedent:eu:c-199-24-62024cj0199", "precedent:eu:c-414-24", "precedent:eu:c-484-24-62024cj0484" ], "sha256": "721baf951c9fa57dd57c5899ce7d2fedb87494c3c7a83eb067d098708f6614e8" }, { "key": "provision_links", "status": "ready", "ids": [ "provision_link:eu:gdpr" ], "sha256": "e9779b0b274bd5eb8d4fce01b8b7f341a494366fd05a1ddb37550513bca83468" }, { "key": "outcome_patterns", "status": "ready", "ids": [ "outcome_pattern:eu:gdpr" ], "sha256": "7357bbee03a3e21803cad4cf45b9ef87c74fcec47eb6ab26dc4ca0229eae5370" } ], "answers_full": [ { "question": "Which obligations apply?", "key": "obligations", "status": "ready", "answer": "2 obligations: Notify a personal data breach to the supervisory authority.; Notify the controller without undue delay after becoming aware of a breach.", "ids": [ "obligation:eu:gdpr-art-33-controller", "obligation:eu:gdpr-art-33-processor" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-33-controller", "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-33-processor" ], "sha256": "d001466e74107c53cfb1c90137a0b8ad77059159925e0154ed36abab844a65cc", "reason": null }, { "question": "Who is responsible?", "key": "responsibility", "status": "ready", "answer": "Responsible roles: controller, processor.", "ids": [ "obligation:eu:gdpr-art-33-controller", "obligation:eu:gdpr-art-33-processor" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-33-controller", "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-33-processor" ], "sha256": "6107e6dcf604a84f319bebc031c4adfda2b13922a6ca3807361d2ed4df2d7487", "reason": null }, { "question": "Which sanctions can be triggered?", "key": "sanctions", "status": "ready", "answer": "2 sanctions, up to 2 % of global turnover; e.g. EUR 10 000 000.", "ids": [ "sanction:eu:gdpr-art-58-2", "sanction:eu:gdpr-art-83-4" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-58-2", "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-4" ], "sha256": "a0516a597efcc11e9c8159061cb72ffde715e9a8c43ff883d2355439c28eeb0c", "reason": null }, { "question": "What are the risks?", "key": "risks", "status": "ready", "answer": "Risk level high across 2 roles.", "ids": [ "risk_chain:eu:gdpr--controller", "risk_chain:eu:gdpr--processor" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--controller", "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--processor" ], "sha256": "d1b0a81d0703a21fd2a9c142c6d76ab55bd3606f9691a0e0d3d3462435ecd24d", "reason": null }, { "question": "Which exceptions apply?", "key": "exceptions", "status": "ready", "answer": "2 exceptions, e.g. Processing by a natural person in the course of a purely personal or household activity.", "ids": [ "exception:eu:gdpr-breach-unlikely-risk", "exception:eu:gdpr-household" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-33-controller", "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-33-processor" ], "sha256": "4fb02055712ae3e10ece5ff9b2ef3d260d748504c20ca2025b776275db02e710", "reason": null }, { "question": "Which documentation is required?", "key": "documentation", "status": "ready", "answer": "Keep: Report to authority.", "ids": [ "documentation_requirement:eu:gdpr--art-33" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/documentation_requirement/eu:gdpr--art-33" ], "sha256": "aeb430dc26bc2349339854e135df114ba8ee53b9f5528a478529733045078204", "reason": null }, { "question": "What does a compliance checklist look like?", "key": "checklist", "status": "ready", "answer": "2 checks across 2 roles.", "ids": [ "obligation:eu:gdpr-art-33-controller", "obligation:eu:gdpr-art-33-processor" ], "urls": [], "sha256": "91455f3564c47d3074f80f19edace7f990a586f53167b16549049483f40412a5", "reason": null }, { "question": "Which precedents support the answer?", "key": "precedents", "status": "ready", "answer": "37 judgments in the register; leading: eu:c-798-24, eu:c-474-24, eu:c-199-24-62024cj0199, eu:c-414-24, eu:c-484-24-62024cj0484.", "ids": [ "precedent:eu:c-798-24", "precedent:eu:c-474-24", "precedent:eu:c-199-24-62024cj0199", "precedent:eu:c-414-24", "precedent:eu:c-484-24-62024cj0484" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-798-24", "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-474-24", "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-199-24-62024cj0199", "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-414-24", "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-484-24-62024cj0484" ], "sha256": "721baf951c9fa57dd57c5899ce7d2fedb87494c3c7a83eb067d098708f6614e8", "reason": null }, { "question": "How are the rules linked to other rules?", "key": "provision_links", "status": "ready", "answer": "Provision relations for gdpr.", "ids": [ "provision_link:eu:gdpr" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr" ], "sha256": "e9779b0b274bd5eb8d4fce01b8b7f341a494366fd05a1ddb37550513bca83468", "reason": null }, { "question": "How do courts usually rule in similar situations?", "key": "outcome_patterns", "status": "ready", "answer": "Trend stable over 3 years, 37 judgments.", "ids": [ "outcome_pattern:eu:gdpr" ], "urls": [ "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr", "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr" ], "sha256": "7357bbee03a3e21803cad4cf45b9ef87c74fcec47eb6ab26dc4ca0229eae5370", "reason": null } ], "checklist": [ { "step": 1, "role": "controller", "check": "Notify a personal data breach to the supervisory authority.", "provision": "gdpr 33", "deadline": "72 hours", "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false }, { "step": 2, "role": "processor", "check": "Notify the controller without undue delay after becoming aware of a breach.", "provision": "gdpr 33", "deadline": null, "if_not": [ "sanction:eu:gdpr-art-83-4", "sanction:eu:gdpr-art-58-2" ], "done": false } ], "links": { "act_kit": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr", "provisions": [], "case_kits": [ "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-798-24", "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-474-24", "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-199-24-62024cj0199", "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-414-24", "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-484-24-62024cj0484" ], "documentation": "https://legal.exploreworldai.com/api/public/v1/obj/documentation_requirement/eu:gdpr--art-33", "list": "https://legal.exploreworldai.com/api/public/v1/sme-kits", "changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes?type=sme_kit" }, "method": "Ten fixed business questions answered from existing deterministic registers. Gaps carry fixed reason codes. No model writes anything.", "hash": "fb10f827e708f3e672f40dbc48e690e959471fac4c78104fc2582b05b25f0b06" }, "links": { "provisions": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr--art-33", "case_law": { "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr--art-33", "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr--art-33" }, "evidence": { "provenance": null, "chain_verify": "https://legal.exploreworldai.com/api/public/v1/changes/verify", "object_changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes" }, "compact": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-33?view=compact", "representations": {}, "machine_languages": [ "en", "sv" ], "ref": "eu:gdpr--art-33" }, "watch": { "changes": "https://legal.exploreworldai.com/api/public/v1/changes", "whats_new": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu", "conditional": "Send If-None-Match with the ETag; unchanged objects return 304 without body.", "recheck_after_seconds": 86400 }, "hash": "sha256:673a800fd3edb058eeea4a331312276d5ebe5435d7a5bdfe271e933d59585545", "version": "legal-2026-10-06", "expires": "2026-10-07T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-06+legal-2026-10-06+2026-10-06T19:06:05", "content_hash": "sha256:673a800fd3edb058eeea4a331312276d5ebe5435d7a5bdfe271e933d59585545", "revalidate_after": "2026-10-06T20:50:22.639Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-33", "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering" }