gdpr-compliance-check

GDPR compliance requires lawful basis for processing, prior consent for non-essential cookies, functional user rights (access, erasure, portability), a matching privacy policy, and documented retention periods. This audit walks through each area with a checklist covering consent records, cookie banners, and deletion flows.

A compliant banner blocks analytics and marketing cookies until consent is given, offers a "Reject All" option as prominent as "Accept All", provides granular per-category control, and avoids dark patterns. Consent records must be stored with timestamp and version before any tracker loads.

GDPR requires prior opt-in consent and a lawful basis for processing, while CCPA focuses on disclosure and opt-out, including a "Do Not Sell My Personal Information" link. CCPA also mandates 12-month category disclosures and financial incentive transparency.

Yes, erasure must be real, not soft-deletion. Backups should expire deleted data within a documented retention period, third-party processors must be notified, and logs should be anonymized. Exceptions like tax records or legal holds must be documented.

An audit identifies gaps between code, policy, and regulation but does not constitute legal advice or guarantee regulatory approval. High-risk processing still requires a formal Data Protection Impact Assessment and review by qualified legal counsel.