GDPR Readiness Audit

gdpr-readiness · v1.1.0 · paid

EU General Data Protection Regulation compliance covering lawful basis, user rights (DSAR), consent management, data processing agreements, and breach accountability.

Lawful Basis & Data Collection

lawful-basis · weight 0.25

Each data collection point documents its legal basis under GDPR Art. 6
ab-001497
critical
Only data necessary for the stated purpose is collected; no excessive fields
ab-001498
critical
Data collected for one purpose is not repurposed without separate consent
ab-001499
high
At the point of collection, users are told what data is collected, why, and retention period
ab-001500
high

User Rights / DSAR

user-rights · weight 0.25

Users can request and receive a copy of all personal data held about them
ab-001501
high
Users can request permanent deletion of their personal data and account
ab-001502
high
Users can export their data in a structured, machine-readable format
ab-001503
medium
Users can correct inaccurate personal data through the application UI
ab-001504
medium
Users can request restriction of processing while disputes are resolved
ab-001505
low

Consent Management

consent-management · weight 0.22

Consent banner presents separate toggles per purpose; non-essential categories default to off
ab-001506
critical
Consent decisions recorded with timestamp, consent version, and categories accepted
ab-001507
high
Users can withdraw consent as easily as they gave it
ab-001508
medium
Non-essential scripts only load after consent is granted for that category
ab-001509
medium
When consent purposes or third parties change, existing consent is invalidated
ab-001510
low

Data Processing & Transfers

data-processing · weight 0.15

Data processing agreements exist with all third-party processors
ab-001511
medium
International data transfers use SCCs, adequacy decisions, or other lawful mechanisms
ab-001512
low
A list of sub-processors is maintained and accessible
ab-001513
low
DPIA conducted for high-risk processing activities per Art. 35
ab-001514
info

Breach & Accountability

breach-accountability · weight 0.13

72-hour breach notification process documented
ab-001515
low
Records of processing activities maintained per Art. 30
ab-001516
info
DPO designated if processing triggers Art. 37 requirements
ab-001517
info
Privacy policy accessible, dated, plain language, covers all GDPR-required disclosures
ab-001518
info