One Person, Many Hands

A person who needs substantial support may have many people around them.

A parent.

A legal guardian.

A sibling.

A teacher.

A shadow teacher.

A direct-support worker.

A speech-language therapist.

An occupational therapist.

A paediatrician or other physician.

A psychologist.

A centre administrator.

An advocate.

A trusted community member.

A technician maintaining an assistive device.

A future successor preparing for the day when the primary caregiver can no longer continue.

Each person may know something important.

Each may have responsibilities.

Some may hold lawful authority within a particular domain.

Some may contribute professional recommendations.

Some may help the person communicate.

Some may know the small daily patterns that no formal report has ever captured.

But none of this means that every hand around the person should have access to everything—or authority over everything.

This is the next problem Amanah Companions must solve.

The original architecture began with an easy authority shape:

one principal human → one governed system → review before consequential action

That model remains useful.

Amanah does not destroy it.

It widens it.

The person receiving support remains the continuity subject. Around that person is a changing care circle made of humans, institutions, devices, and eventually embodied systems. Amanah must represent their legitimate roles without turning the circle into collective ownership of the person.

The question is not simply:

Who has permission?

It is:

Permission to do what, for which person, in which context, under what conditions, based on whose authority, for how long, with what record, and subject to which refusal or review?

That is an authority topology.

The problem with one giant permission switch

Most software permissions begin simply.

Administrator.

Editor.

Viewer.

Owner.

Member.

For ordinary files, this can be adequate.

For a human life, it is dangerously crude.

Imagine a therapist who has been invited into an Amanah care circle.

A single “professional access” switch might allow them to see:

• communication history;
• sensory patterns;
• household routines;
• private family notes;
• medical references;
• school difficulties;
• relationship history;
• current location;
• incident reports;
• personal journals;
• and every AI-generated hypothesis.

That would be excessive.

The therapist may need only the information relevant to a specific professional question.

Likewise, a teacher may need the person’s classroom communication access, sensory accommodations, transition supports, and emergency information. That does not mean the teacher should see private health history, household conflict, adult relationships, or everything the person has ever refused.

A device technician may need to know:

• which hardware they are authorised to service;
• whether the unit is currently active;
• the fault logs;
• the required privacy mode;
• and whether the person’s data has been cleared from a temporary device.

They do not need to read the person’s care history.

A parent may know almost everything about a young child’s daily life and still not possess universal authority forever.

A doctor may carry clinical authority in medicine without becoming the authority over education, relationships, religion, leisure, work, communication style, or personal identity.

Amanah therefore cannot be built on one unrestricted role called:

Trusted person

Trust is not a universal data licence.

Care is not a universal authority licence.

Professional status is not a universal authority licence.

Family relationship is not a universal authority licence.

The system needs a more precise grammar.

One continuity subject, many scoped participants

The central architecture can remain simple at its core:

One durable person principal. Many participants attached through scoped, reviewable relationships.

The participants may include:

• the person themselves;
• parents;
• guardians or lawful representatives;
• supporters chosen by the person;
• family caregivers;
• paid carers;
• teachers and school support staff;
• clinicians;
• therapists;
• advocates;
• care centres;
• supported-living services;
• employers or vocational mentors;
• government or funding bodies;
• device technicians;
• software providers;
• AI models;
• robotic adapters;
• and future successors.

But these participants are not equal.

They are not unequal in the sense that one permanent hierarchy can rank every human from most powerful to least powerful.

They are unequal because their authority is different in kind, domain, context, and duration.

A speech-language therapist may be highly authoritative concerning an AAC assessment while having no authority to disclose the person’s private communication history to an employer.

A parent may be the most knowledgeable source about a child’s regulation patterns while still being capable of misinterpretation.

A doctor may verify a contraindication but should not rewrite a person’s daily preferences.

A support worker may be authorised to carry out an approved routine but not to change the care rule.

A teacher may observe a recurring pattern but should not promote it into permanent truth.

An AI may identify a possible correlation but has no moral or legal standing merely because its analysis sounds persuasive.

The system must preserve these differences.

Authority and evidence are not the same thing

This is one of the most important distinctions in Amanah.

A person or institution may have authority.

A record has evidence.

Those are not interchangeable.

A medical report may carry strong evidentiary weight. It is not an actor.

A caregiver observation may be highly valuable. It is not automatically a permission.

A diagnosis may inform the support profile. It does not issue commands.

A sensor may detect motion. It does not know why the motion occurred.

An AI may summarise a pattern. It does not gain authority by finding it.

A parent may hold lawful authority for a minor. That does not make every parental interpretation factually correct.

A clinician may be licensed. That does not make their authority universal beyond their professional scope.

This matters because care systems often allow documentation to acquire invisible power.

Once something appears in a formal record, later humans may obey it without asking:

• Who wrote this?
• What did they actually observe?
• Was it confirmed?
• Is it still current?
• Was the person able to respond?
• Did another source disagree?
• Does this record authorise action, or merely provide information?
• Is this relevant in the current context?
• Who is accountable for the decision being made now?

Amanah needs to make those questions structural.

The authority topology

A practical Amanah permission should be describable through a chain like this:

Actor → Role → Domain → Scope → Permitted action → Conditions → Evidence basis → Person participation → Provenance → Expiry or review → Override and stop rules

Each part answers a different question.

Actor

Who or what is attempting to view, propose, approve, change, or perform something?

An actor might be:

• the supported person;
• a parent;
• a guardian;
• a teacher;
• a carer;
• a clinician;
• an advocate;
• a centre;
• an AI service;
• a device;
• or an embodied adapter.

Role

In what recognised capacity is the actor participating?

One individual may hold more than one role.

A mother may be:

• parent;
• primary caregiver;
• legal guardian;
• communication partner;
• account administrator;
• and source of historical observations.

Those roles should not be collapsed simply because they belong to the same human.

Her authority as guardian may be legally distinct from her knowledge as caregiver.

Her technical access as account administrator should not silently expand her authority over an adult child’s private life.

Domain

Which area of life is involved?

Possible domains include:

• communication;
• sensory support;
• healthcare;
• medication reference;
• education;
• transport;
• personal care;
• home environment;
• finance;
• community participation;
• work;
• relationships;
• privacy;
• research;
• emergency response;
• and device maintenance.

A permission that applies in one domain should not automatically cross into another.

Scope

What exact information, decision, or action is included?

“Healthcare access” is still too broad.

A clinician may need access only to:

• the current appointment summary;
• known communication needs;
• relevant symptoms;
• current medications from verified records;
• and the person’s consent or lawful authority path for this consultation.

They may not need every historical care note.

Permitted action

What may the actor actually do?

There is a significant difference between permission to:

• view;
• contribute;
• propose;
• review;
• verify;
• approve;
• execute;
• export;
• delegate;
• revoke;
• or delete.

A carer who can add a shift observation should not automatically be able to approve a new care protocol.

A clinician who can verify a medical instruction should not automatically be able to alter the person’s relationship permissions.

A technician who can replace a device should not be able to export the person’s continuity archive.

Conditions

Under what circumstances is the permission active?

Conditions may include:

• the person is currently enrolled at this centre;
• the professional credential remains valid;
• the task occurs during an approved shift;
• the person has assented;
• a guardian or lawful representative has approved;
• the action matches a pre-authorised protocol;
• the device is in the correct location;
• a second reviewer is required;
• no dissent signal has been detected;
• the network is available;
• or an emergency threshold has been met.

Evidence basis

What information is the proposed decision relying upon?

A recommendation might draw from:

• the person’s current expression;
• a verified professional plan;
• an approved care rule;
• a caregiver observation;
• a machine hypothesis;
• or an emergency sensor.

The system should know the difference.

Person participation

How has the supported person participated in this particular matter?

Possible states may include:

• direct decision;
• supported decision;
• co-decision;
• lawful representation after documented support attempts;
• assent;
• dissent;
• uncertainty;
• no response;
• inaccessible communication channel;
• or emergency action under a narrowly defined rule.

These states cannot be treated as morally equivalent.

Provenance

Who created the permission, recommendation, record, or action request?

When?

In which system?

Under which policy version?

Was it imported?

Was it machine-generated?

Was it later reviewed?

Expiry or review

When does the authority end or require reconsideration?

A school role should not remain active after the student leaves.

A temporary support worker should not retain access after the shift or contract ends.

A professional recommendation may need review.

A guardian’s role may change when the child becomes an adult.

A device permission may expire after one task.

A crisis override should not become normal operating authority.

Override and stop rules

Who or what can halt the action?

A person’s configured refusal signal may stop a physical support.

A guardian cannot necessarily override every direct adult refusal.

A clinician may halt a medically unsafe action.

A human supervisor may stop a robot.

A technical safe state may stop everything if the device cannot verify current permissions.

The topology is not complete unless it explains how power stops.

The person is not merely another actor in the list

It may be tempting to model the supported person as one role among many.

That would miss the point.

The person is both:

1. a possible actor within decisions; and
2. the continuity subject around whom all other roles exist.

That gives the person a different architectural status.

A therapist may leave the circle.

The person remains.

A school may close its account.

The person remains.

A parent may die.

The person remains.

A robot may be replaced.

The person remains.

This does not mean the person has identical operational control in every circumstance.

A child cannot simply be treated as a contractual administrator.

A person may need decision support.

A lawful representative may hold authority within specific jurisdictions and domains.

Emergencies may permit limited action when ordinary participation is temporarily impossible.

But the system must never interpret support needs as permission to remove the person from their own architecture.

Supported decision-making is not decorative consultation

It is easy for a system to display a “person-centred” badge while all meaningful decisions are still made elsewhere.

The person is asked.

The answer is recorded.

Then the institution proceeds with the outcome it already wanted.

That is participation theatre.

A genuine supported-decision pathway may require:

• accessible information;
• familiar language;
• pictures or symbols;
• AAC;
• a trusted supporter;
• a quiet environment;
• repeated explanation;
• more processing time;
• smaller choices;
• separation of one complex decision into several parts;
• clarification of consequences;
• and the chance to return later.

NICE guidance for England and Wales, for example, recommends finding out how the person wishes to be supported, using communication specialists where needed, and tailoring support to the individual decision and circumstances.¹ That guidance is jurisdiction-specific, but the practical lesson is widely relevant:

A person cannot be said to have participated meaningfully when the system never made the decision accessible.

The CRPD Committee’s interpretation of Article 12 similarly calls for a shift from substitute decision-making toward support that respects the person’s rights, will, and preferences.²

Amanah cannot resolve the legal disagreements surrounding capacity and guardianship across all countries.

It can still refuse to encode the crudest version of substituted decision-making as its universal default.

The difficult reality of childhood

Amanah began with non-speaking autistic children and other people who may need substantial or lifelong support.

For a child, parents or guardians will often carry extensive responsibility.

They consent to services.

They arrange appointments.

They manage transport.

They approve technology.

They communicate with schools.

They hold reports.

They notice patterns.

They pay bills.

They make safety decisions.

They may know the child’s communication better than anyone else.

A system that ignores this reality would be unusable.

But a system that encodes the parent as the permanent owner of the person creates another problem.

The child grows.

The care relationship changes.

The legal framework changes.

The young person may develop new communication methods.

They may make some decisions directly.

They may reject some parental interpretations.

They may want privacy.

They may form relationships.

They may acquire an advocate.

They may want one supporter involved in healthcare and another in finance.

They may still need extensive assistance without remaining administratively eight years old forever.

Amanah therefore needs a life-course authority transition.

Not a sudden birthday switch.

A gradual, reviewable transition that asks:

• What can the person now access directly?
• What choices are already theirs?
• Where is support helpful?
• Where does lawful representation remain?
• Which old permissions should expire?
• Which information should become private?
• What has the person asked to change?
• Which trusted people do they choose?
• How will disagreement be handled?
• What happens if the parent and adult child want different things?

The architecture must be able to mature even when support needs remain substantial.

The care circle is plural—but not one shared room

The phrase care circle can sound warm.

But warmth can conceal poor access design.

If every approved member enters one shared room, information spreads too widely.

A school sees home information.

A centre sees private clinical notes.

A clinician sees relationship history.

A technician sees sensory records.

A funding agency sees intimate daily-life details.

A temporary worker receives permanent access.

That is not coordination.

It is exposure.

Amanah therefore needs bounded contexts inside one durable continuity spine.

Possible contexts include:

• home;
• school;
• centre;
• healthcare;
• supported living;
• employment;
• transport;
• public activity;
• intimate personal care;
• private person-owned space;
• and technical operations.

The same human may belong to more than one context, but access should still be explicit.

A parent may view home and healthcare information for a minor.

A school support worker may see only the school projection.

A clinician may receive an appointment projection.

A centre may receive the current support plan and shift handoff.

An employer may receive only the accommodations the person has chosen or lawfully authorised for disclosure.

A robot receives a task projection.

The spine coordinates these contexts without merging them into one unrestricted biography.

Minimum access is not mistrust

In technical systems, “least privilege” means granting only the access needed for the current role or task.

NIST’s Zero Trust Architecture describes access decisions as per-session or per-request rather than based on implicit trust, and applies least-privilege principles to restrict visibility and accessibility.³

Amanah is not simply a zero-trust enterprise network.

But the architectural lesson transfers:

Being trusted does not mean receiving permanent, universal access.

This is not an accusation against carers or professionals.

It protects everyone.

The supported person is protected from unnecessary exposure.

The professional is protected from holding sensitive information they do not need.

The institution is protected from uncontrolled data circulation.

The family is protected from one participant exporting the entire life record.

The system is easier to audit.

A breach has a smaller radius.

A role ending does not require reconstructing the whole database.

The European Union’s GDPR expresses a related data principle: personal data should be adequate, relevant, and limited to what is necessary for the stated purpose.⁴ Amanah must be designed for multiple jurisdictions, so GDPR cannot be treated as universal law. But data minimisation is a sound design principle even where the legal framework differs.

The correct question is not:

Do we trust this person?

It is:

What does this person legitimately need for this role, purpose, and time?

Professional credentials should unlock scope, not the whole person

A verified professional identity may be valuable.

Amanah may eventually need to confirm that someone is:

• a licensed physician;
• an occupational therapist;
• a speech-language therapist;
• a psychologist;
• an accredited care worker;
• a registered teacher;
• or another recognised professional.

But credential verification should not work like a master key.

The system may verify:

This person currently holds the credential required to submit or approve this category of recommendation.

That does not mean:

This person may access every record belonging to the supported person.

A professional credential should bind to:

• a recognised role;
• a defined professional scope;
• a specific relationship to the person;
• a purpose;
• a valid time period;
• and a set of permitted actions.

It should also be revocable.

A professional who leaves the case should lose access.

A licence that expires should no longer authorise credential-gated actions.

A professional who is suspended should not retain invisible authority through an old account.

A professional may remain an important historical source without remaining a current decision-maker.

This will become particularly important if Amanah is used across countries with very different credential systems.

The architecture should not assume that every country has one reliable national register or digital identity infrastructure.

Credential strength, verification method, and institutional reliability must remain visible.

The undiagnosed person complicates the gate

A diagnosis-only access system may initially appear safer.

Formal diagnosis.

Verified professional.

Registered service.

Approved user.

Controlled technology.

But it would also reproduce existing inequalities in assessment.

Some people remain undiagnosed because services are expensive.

Some wait years.

Some live in countries or regions with few specialists.

Some are missed because diagnostic systems were not designed around their gender, language, culture, race, age, or presentation.

Some families resist assessment because of stigma.

Some schools minimise concerns.

Some people identify their needs only in adulthood.

Some require support long before formal diagnosis becomes available.

This does not mean that every Amanah capability should be universally open.

It means diagnosis cannot be the only legitimate doorway.

Low-risk support may be accessible through:

• self-identified need;
• a functional support assessment;
• a school or centre recommendation;
• a provisional professional opinion;
• an AAC assessment;
• documented accessibility need;
• or another bounded pathway.

Higher-risk functions may require stronger professional, institutional, or regulatory gates.

The authority topology must therefore represent not only who is involved, but what kind of evidence or credential is proportionate to the capability being unlocked.

That question belongs fully in Articles 20 and 21.

But the groundwork begins here:

A permission system is only fair when it can distinguish safety from exclusion.

A machine may participate without becoming a moral actor

Amanah will involve non-human actors.

A language model may summarise.

A classifier may detect a possible pattern.

A retrieval system may assemble context.

A sensor may report a condition.

A robotic adapter may perform an approved movement.

These components need permissions too.

But their permissions should be described as capabilities, not moral authority.

A model may be permitted to:

• summarise a shift handoff;
• identify conflicting records;
• label uncertainty;
• draft a question for human review;
• retrieve an approved support;
• or produce a minimum context projection.

It may not be permitted to:

• approve its own proposal;
• infer legal consent;
• upgrade an observation into fact;
• override dissent;
• diagnose;
• prescribe;
• transfer private information outside scope;
• or convert physical capability into decision authority.

An embodied adapter may be permitted to execute:

bring the AAC device to the person after a valid request

It is not permitted to decide:

the person should use AAC now

The distinction is simple:

Machines may carry authorised capability. They do not thereby acquire moral jurisdiction over the person.

Every permission needs a visible origin

Permission should never feel like magic.

The system should be able to answer:

• Who granted this?
• On what basis?
• For which role?
• For which domain?
• What was the person’s participation?
• What information was considered?
• When does it expire?
• Who can revoke it?
• What happens if authorities disagree?
• Was the action actually performed?
• Which model or device was involved?
• Which policy version governed the decision?

This is provenance applied to care authority.

It is what prevents:

The system allowed it

from becoming the end of the explanation.

Amanah should instead be able to say:

This action was permitted under a current home-support protocol approved by the authorised guardian, with a configured person assent check, for this device, during this time window. The person expressed refusal, so execution was halted and logged.

Or:

This clinician can submit a recommendation in the communication domain, but cannot activate it as a care rule. Review by the authorised participants remains required.

Or:

This school account previously had access to the education projection. The enrolment ended, so the grant expired automatically.

Authority becomes inspectable.

Accountability remains human.

Disagreement is not a system error

Many care systems are designed as though legitimate humans will always agree.

They will not.

A parent and therapist may disagree.

Two clinicians may disagree.

A teacher may interpret behaviour differently from the family.

A support worker may observe something nobody else has seen.

A guardian may want an action the person refuses.

A person may change their mind.

An institution may prioritise safety while the family sees unnecessary restriction.

A doctor may recommend a plan the care centre cannot implement.

A future successor may challenge an old routine.

Amanah must not flatten disagreement into one “current truth.”

It needs to preserve:

• who holds decision authority;
• who holds relevant expertise;
• who observed what;
• who disagreed;
• the person’s expression;
• uncertainty;
• the immediate risk;
• and the required escalation path.

Some disagreements can be resolved through review.

Some require legal or clinical processes outside the system.

Some should block action.

Some permit a temporary safe fallback.

Some should remain unresolved rather than being hidden.

A mature continuity system is not one where everyone agrees.

It is one where disagreement does not disappear inside the database.

Expiry is part of dignity

Permissions often accumulate.

People are added and never removed.

Temporary workers retain accounts.

Old institutions remain linked.

Former clinicians keep access.

A parent’s childhood permissions persist unchanged.

Emergency authority becomes routine.

A device remains trusted after replacement.

This is how a care circle becomes a permanent audience.

Expiry should therefore be a first-class feature.

Amanah grants may expire by:

• date;
• shift;
• task completion;
• end of enrolment;
• end of employment;
• change of legal status;
• credential expiry;
• device replacement;
• withdrawal by the person;
• withdrawal by the granting authority;
• completion of a medical episode;
• or scheduled review.

Some permissions may be renewed.

Some may require re-consent.

Some may narrow.

Some may transfer to a successor.

Some should end automatically.

A system that remembers who once had access but forgets to remove them is not preserving continuity.

It is preserving exposure.

The right structure is not the most restrictive structure

Governance can also fail by becoming so heavy that nothing useful happens.

If every calming support requires five approvals, the system cannot respond.

If every carer note requires a committee, staff stop contributing.

If every routine prompt requires a clinician, Amanah becomes unusable.

If the person must repeat the same consent process for every harmless, previously approved action, the system creates burden rather than agency.

The Gate must distinguish:

• low-risk pre-authorised supports;
• reversible assistance;
• information retrieval;
• proposals requiring review;
• sensitive disclosures;
• consequential decisions;
• physical actions;
• emergencies;
• and prohibited actions.

Good governance is not maximum friction.

It is appropriate friction.

A valid, bounded support should be able to proceed.

A risky action should slow down.

An unauthorised action should stop.

An impossible action should fail safely.

A dissent signal should matter.

A harmless function should not be trapped behind theatre.

A worked example

Consider an autistic young adult preparing for a medical appointment.

The person uses AAC when overwhelmed but speaks at other times.

Their mother is a trusted supporter but is no longer the universal account owner.

A clinician is seeing them for a gastrointestinal concern.

A support worker will provide transport.

Amanah might generate separate projections.

The person receives

• an accessible explanation of the appointment;
• a visual sequence;
• options for who may accompany them;
• a way to express questions, consent, refusal, or “not now”;
• and control over which personal information is shared.

The mother receives

• the appointment time;
• the support role the person requested;
• questions the person has authorised her to help communicate;
• and any current guardian or supporter permissions relevant to the appointment.

She does not automatically receive the person’s private notes.

The clinician receives

• the presenting concern;
• verified medication references;
• communication access needs;
• sensory accommodations for the consultation;
• relevant observations with their sources;
• and the decision-support pathway.

The clinician does not receive unrelated school history, employment notes, or relational memory.

The transport worker receives

• pickup details;
• mobility or sensory travel accommodations;
• emergency contact information;
• and the minimum communication cues needed for the journey.

They do not receive the medical complaint.

The AI receives

• permission to prepare the appointment summary;
• only the sources approved for that purpose;
• a prohibition on inferring diagnosis;
• and a requirement to label unresolved inconsistencies.

The clinic device receives

• a temporary communication projection;
• no permanent care archive;
• and an automatic clearing instruction after the appointment.

One person.

Many hands.

No hand receives the whole life merely because it is helping with one part.

What Amanah is trying to protect

The goal is not to make care colder.

It is not to replace trust with bureaucracy.

It is not to reduce family love, professional judgment, or human familiarity to access-control tables.

It is to stop those human goods from being used as excuses for invisible power.

A parent can love deeply and still need limits.

A professional can be competent and still need scope.

A centre can provide essential support and still not own the person’s history.

A model can be useful and still require strict capability boundaries.

A robot can be physically impressive and still have no right to decide.

The care circle should help carry the person’s life.

It should not close around them.

The governing sentence

Amanah Companions needs an authority model capable of holding two truths at once:

One human life may require many participants.

And:

Many participants must not become many owners.

That is the purpose of scoped authority.

The person remains the continuity subject.

The parent remains parent.

The clinician remains clinician.

The teacher remains teacher.

The carer remains carer.

The advocate remains advocate.

The technician remains technician.

The AI remains an assistance layer.

The body remains an execution endpoint.

Each can matter.

Each can carry responsibility.

Each can contribute knowledge.

Each must know where its authority begins, where it ends, and what happens when the person says stop.

---

Research status

This essay extends the fourteen foundational Amanah Companions articles, particularly:

• Human-Led Care in an AI-Assisted Future
• The Guardian Gate: Human Authority in AI-Assisted Care
• Designing the Care Profile
• AAC Integration and the Communication Map
• Care Memory vs Surveillance Archive
• Data Projections for Continuity-Based Care AI
• AI Prototype Architecture for an Amanah Companion System

It also develops the later Amanah position:

One durable person principal; multiple participants with domain-specific, scoped, conditional, reviewable, and expiring authority.

The proposed authority topology is a research and design model. It is not a substitute for jurisdiction-specific law concerning childhood, guardianship, legal capacity, healthcare consent, education, safeguarding, employment, data protection, or professional regulation.

Sources

1. National Institute for Health and Care Excellence, Decision-making and mental capacity (NG108), particularly its recommendations on finding out how a person wants to be supported, accessible communication, specialist input, advocacy, and decision-specific support. This guidance applies within the England and Wales legal and service context. https://www.nice.org.uk/guidance/ng108/chapter/Recommendations ↩
2. United Nations Committee on the Rights of Persons with Disabilities, General Comment No. 1 (2014): Article 12 — Equal Recognition before the Law. https://www.ohchr.org/en/documents/general-comments-and-recommendations/general-comment-no-1-article-12-equal-recognition-1 ↩
3. National Institute of Standards and Technology, SP 800-207: Zero Trust Architecture, 2020. Amanah is not an enterprise zero-trust implementation, but the publication is relevant to per-request access, explicit trust evaluation, and least-privilege visibility and access. https://doi.org/10.6028/NIST.SP.800-207 ↩
4. European Union, General Data Protection Regulation, Article 5(1)(c), data minimisation: personal data should be adequate, relevant, and limited to what is necessary for the purposes of processing. This is an EU legal standard, cited as one jurisdictional example rather than universal law. https://eur-lex.europa.eu/eli/reg/2016/679/oj ↩