by PrivScan (LX AI)
A GDPR readiness checklist is an ordered list of the disclosures, consents and records a SaaS product must have in place before it processes personal data of people in the EU or EEA. Its value is sequencing: it tells you which gap to close first, not just that gaps exist.
Key takeaways
Enter a URL and PrivScan scans the site or app for GDPR and consumer-privacy gaps — cookies, consent, trackers and data collection — then returns a prioritised remediation checklist your team can work through. The output is deliberately plain: a list of gaps, what each one relates to, and the order in which to close them.
It does not certify compliance, it does not replace a qualified reviewer, and it does not tell you what your internal records should say. A clean scan means no gaps were detected by these checks — not that your processing is lawful.
PrivScan automatically scans your website or app for GDPR and consumer-privacy gaps - cookies, consent, trackers, and data collection - then hands your team a prioritized remediation checklist.
No. It means the checks found no gaps at that URL at that time. Compliance depends on your processing, your records and your contracts, which still need human review.
The URL you want scanned, and ideally a short note on how you collect user data. The more context you give, the more precise the checklist.
Yes. Cookie, consent and tracker findings are part of the scan, alongside data-collection review.
After any material change to tracking, forms, analytics or AI features, and again before a launch into a new market.
No. It is a decision-support checklist. Have a qualified reviewer confirm the facts and the local requirements that apply to you.
GDPR and consumer-privacy themes. Other regimes have their own disclosure requirements that this scan does not cover.
It scans your site for common GDPR gaps - cookie-consent granularity (Art. 7), lawful-basis statements (Art. 6), and data-retention notices (Art. 13/14) - then scores readiness from 0 to 100.
No. It is decision-support that flags likely gaps; final assessments should be confirmed with a qualified privacy professional.
EU GDPR by default, with UK GDPR and global guidance selectable in the input.
A weighted check of consent, lawful basis, retention, and tracker transparency; the demo returns a sample 54/100 with cited articles.
Pro exports the full scan and remediation checklist; Free includes one watermarked run per day.
It analyzes the URL plus your described data practices; deeper SPA crawling is on the roadmap.
Try the product: PrivScan
Inventory personal data fields, purposes, retention, processors, and subprocessors. Publish a privacy notice that matches reality. Prefer minimization. Document international transfer mechanisms when applicable. Train support staff not to request unnecessary ID documents. Keep a breach contact path. This checklist does not replace counsel.
Not legal advice; counsel required for high-risk processing.
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.