Sources
What the site draws on, how its counts are made, and what it is not.
Not legal advice
Not legal advice. This is the author’s own reading of the law, written to help facilities managers ask better questions. It has not been reviewed by a lawyer. For decisions, read the official text and take legal advice.
Each legal statement names its article or instrument and links to the official text. Summaries of the law are marked as summaries, and plain readings as paraphrase. Dates were checked against the official texts and other primary sources; the non-EU countries on 2026-10-09.
The building and its counts
The building, its systems and the two ways they can be built are illustrative: no real building and no real vendor. Makers are lettered, not named. The counts follow fixed definitions, not a measurement:
| Copies | Places a lasting copy of the event is kept: a log, a database, a replica, a backup, a model’s input. A reader holding an event for a moment is not a copy. |
|---|---|
| Companies | Organisations whose product or service holds a copy. A hosting provider under contract counts. |
| Handoffs | Stops where a company that did not hold the event before now does. |
Recipients the owner chooses are counted, but apart: they hold the data by the owner’s right, not because of how the system was built. The definitions · the trace, hop by hop
The EU Data Act
- Regulation (EU) 2023/2854
- Data Act explained — European Commission
- Greenberg Traurig: action required for manufacturers of connected devices
Around it
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ 24 July 2026
- Regulation (EU) 2024/1689
- Regulation (EU) 2024/2847
- Bird & Bird: EU Digital Omnibus — major changes to the Data Act proposed
- Greenberg Traurig: Digital Omnibus proposes amendments to the Data Act (July 2026)
- McCann FitzGerald: Data Act developments, 2026 and beyond
- Simmons & Simmons: Regulating data, September 2026
- White & Case: EU agrees Digital Omnibus deal to simplify AI rules
- Regulation (EU) 2016/679
- ISO/IEC 42001:2023
- Directive (EU) 2022/2555
- AICPA TSC · ISO/IEC 27001:2022
Other countries
- OAIC: transparency for use of AI and automated decision-making
- Allens: automated decision-making transparency, the APP 1 amendments
- Customer and Product Data Act 2025
- MBIE: Consumer Data Right policy design
- Privacy Amendment Act 2025
- Bell Gully: IPP 3A effective 1 May 2026
- SI 2025/904, Data (Use and Access) Act 2025 (Commencement No. 1) Regulations 2025
- GOV.UK: Data (Use and Access) Act 2025, plans for commencement
- GOV.UK: the UK product security regime
- The Network and Information Systems Regulations 2018
- California Attorney General: California Consumer Privacy Act
The argument
How it is made
Everything the site says comes from a knowledge base written in the Open Knowledge Format, published here as it is: the index, a manifest and the change log. The pages are built from it, and the build checks that what they say agrees with it. The source is on GitHub.
The design follows the author’s The Longest Journey and F1 Analysis; the content began in an earlier prototype, stewardship-explorer.
For agents
llms.txt · the whole site as markdown · the knowledge base’s manifest
Not legal advice. This is the author’s own reading of the law, written to help facilities managers ask better questions. It has not been reviewed by a lawyer. For decisions, read the official text and take legal advice.