Mapping — EU recitals

Step by step

• 1. List the systems, services and processing the surface may reach. Can be shown: the list, with date and owner.
• 2. Assign a role to each entry: who are you in relation to the act? Can be shown: the role choice with one sentence on why.
• 3. Fetch the articles that touch the entry from the register, with reading date. Can be shown: the article rows with address, hash and reading date.
• 4. Note hash and address per article, so the map can be checked later. Can be shown: the gaps and what was decided about them.
• 5. Fix the map with a date and an owner, and put it where it can be found. Can be shown: the next check date and who owns it.

Audit chain

• GDPR — 5: Principles relating to processing of personal data — e039f92a054c2009
• GDPR — 7: Conditions for consent — a964590806793e8f
• GDPR — 6: Lawfulness of processing — 193758ef71455742
• GDPR — 13: Information to be provided where personal data are collected from the data subject — 2e9c052bc1efd6d0
• GDPR — 22: Automated individual decision-making, including profiling — a6402833d82daea2
• GDPR — 32: Security of processing — 00970deabf8e51d9
• GDPR — 33: Notification of a personal data breach to the supervisory authority — 743b4711108e27e2
• GDPR — 35: Data protection impact assessment — e3f5d603a6997830

What forces a redo

• The node hash changes — the text behind the row is no longer the same.
• The reading date moves forward — the row has been re-read against the source.
• A timeline passes — the requirement starts to apply or tightens.

As data

• The same node as data: add ?format=json to the address, or ?format=agent for receipt and dependencies.

Roles

• Controller
• Deployer
• Distributor
• GPAI provider
• Importer
• Processor
• Provider

Articles

• GDPR — 5: Principles relating to processing of personal data
• GDPR — 7: Conditions for consent
• GDPR — 6: Lawfulness of processing
• GDPR — 13: Information to be provided where personal data are collected from the data subject
• GDPR — 22: Automated individual decision-making, including profiling
• GDPR — 32: Security of processing
• GDPR — 33: Notification of a personal data breach to the supervisory authority
• GDPR — 35: Data protection impact assessment
• GDPR — 46: Transfers subject to appropriate safeguards
• GDPR — 83: General conditions for imposing administrative fines
• AI Act — 6: Classification rules for high-risk AI systems
• AI Act — 5: Prohibited AI practices
• AI Act — 9: Risk management system
• AI Act — 17: Quality management system
• AI Act — 43: Conformity assessment
• AI Act — 49: Registration
• AI Act — 50: Transparency obligations for providers and deployers of certain AI systems
• AI Act — 71: EU database for high-risk AI systems listed in Annex III
• AI Act — 99: Penalties
• DORA — 17: ICT-related incident management process
• DORA — 28: General principles

Relations

• EU recitals
• Assessment
• Documentation
• Follow-up

Metadata

Acts

GDPR, AI Act, DORA

Articles

21

Reading date

2026-08-31

Freshness

74/100

Hash

131bfb4f9584e8de

Corpus version

legal-2026-08-25

Next check

—