{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-35",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-35)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-06",
    "fingerprint": "ewai:se:095fb6",
    "proof": "sha256:1b1e3e81a4329be3c2158e297395d913fe066c087c7ea8e17ccd89ed080c7a84",
    "jurisdiction": "se",
    "lang": "en",
    "publisher": "NovaCopilot by ExploreWorld Legal",
    "terms": "https://legal.exploreworldai.com/om"
  },
  "brand_source": "Source: NovaCopilot",
  "brand": {
    "product": "NovaCopilot",
    "platform": "ExploreWorldAI",
    "infrastructure": "ExploreWorld Legal",
    "infrastructure_url": "legal.exploreworldai.com",
    "legal_entity": "Valkiv Ventures AB",
    "permanent_url": "https://legal.exploreworldai.com/novacopilot",
    "source": "Source: NovaCopilot",
    "powered_by": "Powered by NovaCopilot",
    "license": "https://legal.exploreworldai.com/licensvillkor",
    "contact": "stig@valkiv.com"
  },
  "object_type": "sme_kit",
  "object_id": "sme_kit:eu:gdpr--art-35",
  "schema_version": "1",
  "schema": "https://legal.exploreworldai.com/api/public/v1/schemas/sme_kit",
  "url": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-35",
  "judgment": {
    "id": "eu:gdpr--art-35",
    "text": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:gdpr--art-35"
  },
  "siblings": {
    "risk": "https://legal.exploreworldai.com/api/public/v1/obj/risk/eu:gdpr--art-35",
    "relation": "https://legal.exploreworldai.com/api/public/v1/obj/relation/eu:gdpr--art-35",
    "change": "https://legal.exploreworldai.com/api/public/v1/obj/change/eu:gdpr--art-35",
    "agent": "https://legal.exploreworldai.com/api/public/v1/obj/agent/eu:gdpr--art-35",
    "provenance": "https://legal.exploreworldai.com/api/public/v1/obj/provenance/eu:gdpr--art-35",
    "status": "https://legal.exploreworldai.com/api/public/v1/obj/status/eu:gdpr--art-35",
    "precedent": "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:gdpr--art-35",
    "edge": "https://legal.exploreworldai.com/api/public/v1/obj/edge/eu:gdpr--art-35",
    "element": "https://legal.exploreworldai.com/api/public/v1/obj/element/eu:gdpr--art-35",
    "decision": "https://legal.exploreworldai.com/api/public/v1/obj/decision/eu:gdpr--art-35",
    "obligation": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr--art-35",
    "sanction": "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr--art-35",
    "weight": "https://legal.exploreworldai.com/api/public/v1/obj/weight/eu:gdpr--art-35",
    "conflict": "https://legal.exploreworldai.com/api/public/v1/obj/conflict/eu:gdpr--art-35",
    "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr--art-35",
    "provision_link": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr--art-35",
    "brief": "https://legal.exploreworldai.com/api/public/v1/obj/brief/eu:gdpr--art-35",
    "citation_graph": "https://legal.exploreworldai.com/api/public/v1/obj/citation_graph/eu:gdpr--art-35",
    "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr--art-35",
    "risk_chain": "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--art-35",
    "compliance_effect": "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr--art-35",
    "answer_node": "https://legal.exploreworldai.com/api/public/v1/obj/answer_node/eu:gdpr--art-35",
    "exception": "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr--art-35",
    "timeline": "https://legal.exploreworldai.com/api/public/v1/obj/timeline/eu:gdpr--art-35",
    "package": "https://legal.exploreworldai.com/api/public/v1/obj/package/eu:gdpr--art-35",
    "case_kit": "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:gdpr--art-35",
    "documentation_requirement": "https://legal.exploreworldai.com/api/public/v1/obj/documentation_requirement/eu:gdpr--art-35",
    "action_kit": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-35"
  },
  "source": "NovaCopilot",
  "precedent_graph": "https://legal.exploreworldai.com/api/public/v1/precedent-graph/eu:gdpr--art-35",
  "item": {
    "coverage": {
      "complete": 10,
      "total": 10,
      "label": "10 of 10 answers ready",
      "reasons": {}
    },
    "subject": "eu:gdpr--art-35",
    "act": "gdpr",
    "article": "35",
    "answers": [
      {
        "key": "obligations",
        "status": "ready",
        "ids": [
          "obligation:eu:gdpr-art-35-controller"
        ],
        "sha256": "4bb3e7df74589e16ff2ba8a8726e2eaacdcd08af23f901de0ba62127e777b711"
      },
      {
        "key": "responsibility",
        "status": "ready",
        "ids": [
          "obligation:eu:gdpr-art-35-controller"
        ],
        "sha256": "09651a573a7878ba265ef25d903afbe1837d20f50bf90ee96ea4844ec9f39a3d"
      },
      {
        "key": "sanctions",
        "status": "ready",
        "ids": [
          "sanction:eu:gdpr-art-58-2",
          "sanction:eu:gdpr-art-83-4"
        ],
        "sha256": "a0516a597efcc11e9c8159061cb72ffde715e9a8c43ff883d2355439c28eeb0c"
      },
      {
        "key": "risks",
        "status": "ready",
        "ids": [
          "risk_chain:eu:gdpr--controller"
        ],
        "sha256": "ad7b099146f9d912ebf8137fc464d727df48a927bc48b8d4abd208a7d1b0f390"
      },
      {
        "key": "exceptions",
        "status": "ready",
        "ids": [
          "exception:eu:gdpr-household"
        ],
        "sha256": "38286342d667f0f9f17769a3f4828f043ed20a48c89ab3f170240bd9e1c1e78d"
      },
      {
        "key": "documentation",
        "status": "ready",
        "ids": [
          "documentation_requirement:eu:gdpr--art-35"
        ],
        "sha256": "715d1cf5f91703731a9374e722a0aaa6ef5a939a61009b296fdc74edca2fec75"
      },
      {
        "key": "checklist",
        "status": "ready",
        "ids": [
          "obligation:eu:gdpr-art-35-controller"
        ],
        "sha256": "c7dcced96acb6259eb7234f3ebedcbbc65827ce07c8dd39ac242219284c02843"
      },
      {
        "key": "precedents",
        "status": "ready",
        "ids": [
          "precedent:eu:c-798-24",
          "precedent:eu:c-474-24",
          "precedent:eu:c-199-24-62024cj0199",
          "precedent:eu:c-414-24",
          "precedent:eu:c-484-24-62024cj0484"
        ],
        "sha256": "721baf951c9fa57dd57c5899ce7d2fedb87494c3c7a83eb067d098708f6614e8"
      },
      {
        "key": "provision_links",
        "status": "ready",
        "ids": [
          "provision_link:eu:gdpr"
        ],
        "sha256": "e9779b0b274bd5eb8d4fce01b8b7f341a494366fd05a1ddb37550513bca83468"
      },
      {
        "key": "outcome_patterns",
        "status": "ready",
        "ids": [
          "outcome_pattern:eu:gdpr"
        ],
        "sha256": "7357bbee03a3e21803cad4cf45b9ef87c74fcec47eb6ab26dc4ca0229eae5370"
      }
    ],
    "answers_full": [
      {
        "question": "Which obligations apply?",
        "key": "obligations",
        "status": "ready",
        "answer": "1 obligations: Carry out a data protection impact assessment for high-risk processing.",
        "ids": [
          "obligation:eu:gdpr-art-35-controller"
        ],
        "urls": [
          "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-35-controller"
        ],
        "sha256": "4bb3e7df74589e16ff2ba8a8726e2eaacdcd08af23f901de0ba62127e777b711",
        "reason": null
      },
      {
        "question": "Who is responsible?",
        "key": "responsibility",
        "status": "ready",
        "answer": "Responsible roles: controller.",
        "ids": [
          "obligation:eu:gdpr-art-35-controller"
        ],
        "urls": [
          "https://legal.exploreworldai.com/api/public/v1/obj/compliance_effect/eu:gdpr-art-35-controller"
        ],
        "sha256": "09651a573a7878ba265ef25d903afbe1837d20f50bf90ee96ea4844ec9f39a3d",
        "reason": null
      },
      {
        "question": "Which sanctions can be triggered?",
        "key": "sanctions",
        "status": "ready",
        "answer": "2 sanctions, up to 2 % of global turnover; e.g. EUR 10 000 000.",
        "ids": [
          "sanction:eu:gdpr-art-58-2",
          "sanction:eu:gdpr-art-83-4"
        ],
        "urls": [
          "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-58-2",
          "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-4"
        ],
        "sha256": "a0516a597efcc11e9c8159061cb72ffde715e9a8c43ff883d2355439c28eeb0c",
        "reason": null
      },
      {
        "question": "What are the risks?",
        "key": "risks",
        "status": "ready",
        "answer": "Risk level high across 1 roles.",
        "ids": [
          "risk_chain:eu:gdpr--controller"
        ],
        "urls": [
          "https://legal.exploreworldai.com/api/public/v1/obj/risk_chain/eu:gdpr--controller"
        ],
        "sha256": "ad7b099146f9d912ebf8137fc464d727df48a927bc48b8d4abd208a7d1b0f390",
        "reason": null
      },
      {
        "question": "Which exceptions apply?",
        "key": "exceptions",
        "status": "ready",
        "answer": "1 exceptions, e.g. Processing by a natural person in the course of a purely personal or household activity.",
        "ids": [
          "exception:eu:gdpr-household"
        ],
        "urls": [
          "https://legal.exploreworldai.com/api/public/v1/obj/exception/eu:gdpr-art-35-controller"
        ],
        "sha256": "38286342d667f0f9f17769a3f4828f043ed20a48c89ab3f170240bd9e1c1e78d",
        "reason": null
      },
      {
        "question": "Which documentation is required?",
        "key": "documentation",
        "status": "ready",
        "answer": "Keep: Impact or risk assessment.",
        "ids": [
          "documentation_requirement:eu:gdpr--art-35"
        ],
        "urls": [
          "https://legal.exploreworldai.com/api/public/v1/obj/documentation_requirement/eu:gdpr--art-35"
        ],
        "sha256": "715d1cf5f91703731a9374e722a0aaa6ef5a939a61009b296fdc74edca2fec75",
        "reason": null
      },
      {
        "question": "What does a compliance checklist look like?",
        "key": "checklist",
        "status": "ready",
        "answer": "1 checks across 1 roles.",
        "ids": [
          "obligation:eu:gdpr-art-35-controller"
        ],
        "urls": [],
        "sha256": "c7dcced96acb6259eb7234f3ebedcbbc65827ce07c8dd39ac242219284c02843",
        "reason": null
      },
      {
        "question": "Which precedents support the answer?",
        "key": "precedents",
        "status": "ready",
        "answer": "37 judgments in the register; leading: eu:c-798-24, eu:c-474-24, eu:c-199-24-62024cj0199, eu:c-414-24, eu:c-484-24-62024cj0484.",
        "ids": [
          "precedent:eu:c-798-24",
          "precedent:eu:c-474-24",
          "precedent:eu:c-199-24-62024cj0199",
          "precedent:eu:c-414-24",
          "precedent:eu:c-484-24-62024cj0484"
        ],
        "urls": [
          "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-798-24",
          "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-474-24",
          "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-199-24-62024cj0199",
          "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-414-24",
          "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-484-24-62024cj0484"
        ],
        "sha256": "721baf951c9fa57dd57c5899ce7d2fedb87494c3c7a83eb067d098708f6614e8",
        "reason": null
      },
      {
        "question": "How are the rules linked to other rules?",
        "key": "provision_links",
        "status": "ready",
        "answer": "Provision relations for gdpr.",
        "ids": [
          "provision_link:eu:gdpr"
        ],
        "urls": [
          "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr"
        ],
        "sha256": "e9779b0b274bd5eb8d4fce01b8b7f341a494366fd05a1ddb37550513bca83468",
        "reason": null
      },
      {
        "question": "How do courts usually rule in similar situations?",
        "key": "outcome_patterns",
        "status": "ready",
        "answer": "Trend stable over 3 years, 37 judgments.",
        "ids": [
          "outcome_pattern:eu:gdpr"
        ],
        "urls": [
          "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr",
          "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr"
        ],
        "sha256": "7357bbee03a3e21803cad4cf45b9ef87c74fcec47eb6ab26dc4ca0229eae5370",
        "reason": null
      }
    ],
    "checklist": [
      {
        "step": 1,
        "role": "controller",
        "check": "Carry out a data protection impact assessment for high-risk processing.",
        "provision": "gdpr 35",
        "deadline": null,
        "if_not": [
          "sanction:eu:gdpr-art-83-4",
          "sanction:eu:gdpr-art-58-2"
        ],
        "done": false
      }
    ],
    "links": {
      "act_kit": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr",
      "provisions": [],
      "case_kits": [
        "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-798-24",
        "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-474-24",
        "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-199-24-62024cj0199",
        "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-414-24",
        "https://legal.exploreworldai.com/api/public/v1/obj/case_kit/eu:c-484-24-62024cj0484"
      ],
      "documentation": "https://legal.exploreworldai.com/api/public/v1/obj/documentation_requirement/eu:gdpr--art-35",
      "list": "https://legal.exploreworldai.com/api/public/v1/sme-kits",
      "changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes?type=sme_kit"
    },
    "method": "Ten fixed business questions answered from existing deterministic registers. Gaps carry fixed reason codes. No model writes anything.",
    "hash": "6963a9216dc67aef43a32c7fb5fd5f78b7651a5a2e3710f9e06b5c0b084df3bb"
  },
  "links": {
    "provisions": "https://legal.exploreworldai.com/api/public/v1/obj/provision_link/eu:gdpr--art-35",
    "case_law": {
      "outcome": "https://legal.exploreworldai.com/api/public/v1/obj/outcome/eu:gdpr--art-35",
      "outcome_pattern": "https://legal.exploreworldai.com/api/public/v1/obj/outcome_pattern/eu:gdpr--art-35"
    },
    "evidence": {
      "provenance": null,
      "chain_verify": "https://legal.exploreworldai.com/api/public/v1/changes/verify",
      "object_changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes"
    },
    "compact": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-35?view=compact",
    "representations": {},
    "machine_languages": [
      "en",
      "sv"
    ],
    "ref": "eu:gdpr--art-35"
  },
  "watch": {
    "changes": "https://legal.exploreworldai.com/api/public/v1/changes",
    "whats_new": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu",
    "conditional": "Send If-None-Match with the ETag; unchanged objects return 304 without body.",
    "recheck_after_seconds": 86400
  },
  "hash": "sha256:1b1e3e81a4329be3c2158e297395d913fe066c087c7ea8e17ccd89ed080c7a84",
  "version": "legal-2026-10-06",
  "expires": "2026-10-07T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-06+legal-2026-10-06+2026-10-06T19:06:05",
    "content_hash": "sha256:1b1e3e81a4329be3c2158e297395d913fe066c087c7ea8e17ccd89ed080c7a84",
    "revalidate_after": "2026-10-06T20:51:15.015Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/sme_kit/eu:gdpr--art-35",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering"
}