{
  "primary_source": {
    "publisher": "EUR-Lex, Publications Office of the European Union",
    "identifier": "CELEX 32016R0679",
    "official_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679",
    "authoritative": true,
    "note": "The official publication is authoritative. The legislator is responsible for the content; NovaCopilot is responsible for traceability, check history, receipts and hashes."
  },
  "evidence_grade": "A",
  "evidence_grade_label": "Checked",
  "freshness": {
    "last_checked": "2026-10-30",
    "check_interval_days": 7,
    "source_type": "eu_law"
  },
  "id": "gdpr-breach",
  "question": "We had a data breach. Whom must we notify under GDPR and how fast?",
  "framework": "GDPR",
  "articles": [
    {
      "ref": "gdpr:33",
      "title": "Notification of a personal data breach to the supervisory authority",
      "status": "verified"
    },
    {
      "ref": "gdpr:34",
      "title": "Communication of a personal data breach to the data subject",
      "status": "verified"
    }
  ],
  "depth": "brief",
  "answer": {
    "type": "source_excerpt",
    "ref": "GDPR Article 33",
    "text": "Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay."
  },
  "sources": {
    "official": [
      "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32016R0679"
    ],
    "verified_at": [
      "2026-10-30",
      "2026-10-30"
    ]
  },
  "omitted": {},
  "next_depth": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-breach?depth=standard",
  "source": "Source: NovaCopilot",
  "tokens": 219,
  "core_sha256": "607b5441d0969f1cdf5b7b8e61ebaf3fa093a50c668873661467566fdc7a6e41",
  "license_scope": "public_index",
  "rules_url": "https://legal.exploreworldai.com/novacopilot/datakalla",
  "return_links": {
    "article_basis": [
      {
        "ref": "gdpr:33",
        "url": "https://legal.exploreworldai.com/api/public/v1/article-basis?act=gdpr&article=33"
      },
      {
        "ref": "gdpr:34",
        "url": "https://legal.exploreworldai.com/api/public/v1/article-basis?act=gdpr&article=34"
      }
    ],
    "feeds": {
      "agent_answers": "https://legal.exploreworldai.com/feed/agentsvar.xml",
      "praxis_graph": "https://legal.exploreworldai.com/feed/praxisgraf.xml"
    },
    "formats": {
      "html": "https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-breach",
      "json": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-breach",
      "brief": "https://legal.exploreworldai.com/api/public/v1/agent-answer/gdpr-breach?depth=brief"
    },
    "canonical": "https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-breach",
    "cite_as": "NovaCopilot, \"We had a data breach. Whom must we notify under GDPR and how fast?\", https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-breach",
    "publisher": "NovaCopilot",
    "source": "Source: NovaCopilot",
    "refresh_note": "Re-fetch the canonical address; copies do not receive later verified changes."
  },
  "reader_formats": {
    "html": "https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-breach",
    "json": "https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-breach?format=json",
    "graph": "https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-breach?format=graph",
    "decision": "https://legal.exploreworldai.com/novacopilot/agentsvar/gdpr-breach?format=decision"
  }
}