Data subject rights readiness

Check method

Whether export, deletion and retention paths exist in the product at all.

Possible evidence type

Code or configuration review, without exploiting the risk.

Access and limitations

Connected repository. Actual results and checks not run appear in your report. A check with no finding does not guarantee the absence of risk.

Concrete scenario

A rights request button exists but the process behind it is incomplete.

What to inspect

Review identity verification, request tracking and actual access, correction or deletion outcomes with authorized test data.

Remediation approach

Provide a documented operational process, handle lawful exceptions and verify the outcome instead of relying on UI labels.

Connect visible behavior to a data-processing purpose

Privacy review starts with what personal data is collected, why it is needed, where it goes and how long it is retained. A privacy page or cookie banner does not by itself demonstrate a lawful basis, valid consent, vendor agreements or working user rights. Requirements depend on processing context and applicable law.

1. Inventory forms, analytics, cookies, logs, AI inputs and third-party recipients.
2. Compare actual collection and retention with the information given to users.
3. Identify consent or another appropriate legal basis with qualified advice where needed.

Verify real user rights and minimize collection

Remove unnecessary data collection and make disclosures consistent with actual processing. A link labelled “delete account” is not proof that all personal data is erased, and a response deadline cannot be inferred from the interface. Operational and legal review remain necessary beyond the automated checker.

1. Review consent choices before non-essential tracking starts.
2. Test access, correction and deletion workflows with authorized test data.
3. Document exceptions, recipients and retention; consult the official regulation for obligations.