Data Protection Audit
data-protection · v1.1.1 · paid
GDPR and privacy compliance review covering data collection, consent mechanisms, retention policies, and PII handling.
Data Collection & Consent
data-collection-consent · weight 0.32
- criticalConsent banner visible on first load with separate togglesab-000831
- criticalAll personal data encrypted at restab-000832
- criticalPII separated from identifiers; analytics uses pseudonymous IDsab-000833
- highEach cookie classified (necessary/analytics/marketing) with documented purposeab-000834
- highPrivacy policy covers all data types, purposes, retention, third-parties, user rightsab-000835
- highApplication collects only necessary data; no PII beyond what's requiredab-000836
- highEach data collection point documents its lawful basisab-000837
Storage & Retention
storage-retention · weight 0.29
- highWritten retention schedule for each data type; automated deletion confirmedab-000838
- mediumIf users under 13 possible: explicit parental consent flow and COPPA complianceab-000839
- mediumData transfers outside primary jurisdiction use SCCs, BCRs, or adequacy decisionsab-000840
- mediumAll third-party services have Data Processing Agreements; subprocessors documentedab-000841
- mediumNo PII in browser storage (localStorage/sessionStorage); encrypted if neededab-000842
User Rights & Access
user-rights-access · weight 0.22
- mediumAuthenticated users can download all personal data in portable formatab-000843
- lowUsers can permanently delete their account and all associated PIIab-000844
- lowUsers can edit and correct their profile informationab-000845
- lowExported data uses standard, non-proprietary format with documented schemaab-000846
Compliance Documentation
compliance-documentation · weight 0.17
- lowDocumented incident response plan for data breachesab-000847
- lowHigh-risk processing documented with DPIA; mitigation strategies trackedab-000848
- infoData flow diagram or register identifies all data types, sources, destinationsab-000849
- infoAnalytics configured with IP masking; no user IDs sent without explicit consentab-000850
- infoAudit of all third-party scripts documents data collection; undisclosed trackers flaggedab-000851
- infoApplication respects DNT signal; analytics disabled when DNT header setab-000852