by PrivScan (LX AI)
A GDPR readiness checklist for SaaS teams
A GDPR readiness checklist is an ordered list of the disclosures, consents and records a SaaS product must have in place before it processes personal data of people in the EU or EEA. Its value is sequencing: it tells you which gap to close first, not just that gaps exist.
What the checklist covers
- Purposes and lawful basis. Name the purpose for each category of personal data and the basis you rely on for it. - Cookies, consent and trackers. Confirm nothing fires before the visitor has actually chosen. - Data-collection surfaces. Signup forms, support widgets, analytics and AI features all collect — each needs to appear in the notice. - Recipients and transfers. Processors, sub-processors and any transfer outside the EEA belong in the disclosure. - Retention. State how long you keep each category, or the criteria used to decide. - Data-subject requests. There must be a real path for access, correction, deletion and objection. - Breach process. Who is told, by whom, and how quickly internally — before an incident, not during one.
Where PrivScan fits
Enter a URL and PrivScan scans the site or app for GDPR and consumer-privacy gaps — cookies, consent, trackers and data collection — then returns a prioritised remediation checklist your team can work through. The output is deliberately plain: a list of gaps, what each one relates to, and the order in which to close them.
What it does not do
It does not certify compliance, it does not replace a qualified reviewer, and it does not tell you what your internal records should say. A clean scan means no gaps were detected by these checks — not that your processing is lawful.
What is PrivScan?
PrivScan automatically scans your website or app for GDPR and consumer-privacy gaps - cookies, consent, trackers, and data collection - then hands your team a prioritized remediation checklist.
What PrivScan actually outputs
- Scan your site for common GDPR compliance gaps - Review cookie, consent, and data-collection practices - Get a privacy readiness score with article references - Receive a remediation checklist
Frequently asked questions
Does passing a scan mean we are GDPR compliant?
No. It means the checks found no gaps at that URL at that time. Compliance depends on your processing, your records and your contracts, which still need human review.
What do we need to run it?
The URL you want scanned, and ideally a short note on how you collect user data. The more context you give, the more precise the checklist.
Does it look at cookies and trackers?
Yes. Cookie, consent and tracker findings are part of the scan, alongside data-collection review.
How often should we re-run it?
After any material change to tracking, forms, analytics or AI features, and again before a launch into a new market.
Is this legal advice?
No. It is a decision-support checklist. Have a qualified reviewer confirm the facts and the local requirements that apply to you.
Which regulations does it focus on?
GDPR and consumer-privacy themes. Other regimes have their own disclosure requirements that this scan does not cover.
What does PrivScan check?
It scans your site for common GDPR gaps - cookie-consent granularity (Art. 7), lawful-basis statements (Art. 6), and data-retention notices (Art. 13/14) - then scores readiness from 0 to 100.
Is PrivScan a replacement for a DPO?
No. It is decision-support that flags likely gaps; final assessments should be confirmed with a qualified privacy professional.
Which regions does it cover?
EU GDPR by default, with UK GDPR and global guidance selectable in the input.
How is the readiness score calculated?
A weighted check of consent, lawful basis, retention, and tracker transparency; the demo returns a sample 54/100 with cited articles.
Can I export the report?
Pro exports the full scan and remediation checklist; Free includes one watermarked run per day.
Does it scan single-page apps?
It analyzes the URL plus your described data practices; deeper SPA crawling is on the roadmap.
References
- EUR-Lex — Regulation (EU) 2016/679 (GDPR) - European Data Protection Board — guidelines and recommendations
Try the product: PrivScan
2026-09-20 · primary sources only · no fabricated traffic metrics · decision-support only
Related articles
- Privacy policy gaps AI products usually find first - Explore the full AI micro-SaaS topic matrix →
GDPR readiness checklist for SaaS founders
Inventory personal data fields, purposes, retention, processors, and subprocessors. Publish a privacy notice that matches reality. Prefer minimization. Document international transfer mechanisms when applicable. Train support staff not to request unnecessary ID documents. Keep a breach contact path. This checklist does not replace counsel.
What this is NOT
Not legal advice; counsel required for high-risk processing.
Operator note 1
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.
Operator note 2
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.
Operator note 3
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.
Operator note 4
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.
Operator note 5
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.
Operator note 6
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.
Operator note 7
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.
Operator note 8
Document the control owner, the last test date, the fixture path, and the expected fail-closed behavior when credentials or quotas are missing. Record whether results are rule-based or model-assisted, and never present demo output as live AI. Prefer primary standards links over secondary summaries. Keep customer metrics empty until verified. Re-run this checklist after framework updates and after major prompt or tool-registry changes. Store evidence in tickets with timestamps. Reject efficacy language such as absolute guarantees.
Does passing a scan mean we are GDPR compliant?
No. It means the checks found no gaps at that URL at that time. Compliance depends on your processing, your records and your contracts, which still need human review.
What do we need to run it?
The URL you want scanned, and ideally a short note on how you collect user data. The more context you give, the more precise the checklist.
Does it look at cookies and trackers?
Yes. Cookie, consent and tracker findings are part of the scan, alongside data-collection review.
How often should we re-run it?
After any material change to tracking, forms, analytics or AI features, and again before a launch into a new market.
Is this legal advice?
No. It is a decision-support checklist. Have a qualified reviewer confirm the facts and the local requirements that apply to you.
Which regulations does it focus on?
GDPR and consumer-privacy themes. Other regimes have their own disclosure requirements that this scan does not cover.
What does PrivScan check?
It scans your site for common GDPR gaps - cookie-consent granularity (Art. 7), lawful-basis statements (Art. 6), and data-retention notices (Art. 13/14) - then scores readiness from 0 to 100.
Is PrivScan a replacement for a DPO?
No. It is decision-support that flags likely gaps; final assessments should be confirmed with a qualified privacy professional.
Which regions does it cover?
EU GDPR by default, with UK GDPR and global guidance selectable in the input.
How is the readiness score calculated?
A weighted check of consent, lawful basis, retention, and tracker transparency; the demo returns a sample 54/100 with cited articles.
Can I export the report?
Pro exports the full scan and remediation checklist; Free includes one watermarked run per day.
Does it scan single-page apps?
It analyzes the URL plus your described data practices; deeper SPA crawling is on the roadmap.
Does passing a scan mean we are GDPR compliant?
No. It means the checks found no gaps at that URL at that time. Compliance depends on your processing, your records and your contracts, which still need human review.
What do we need to run it?
The URL you want scanned, and ideally a short note on how you collect user data. The more context you give, the more precise the checklist.
Does it look at cookies and trackers?
Yes. Cookie, consent and tracker findings are part of the scan, alongside data-collection review.
How often should we re-run it?
After any material change to tracking, forms, analytics or AI features, and again before a launch into a new market.
Is this legal advice?
No. It is a decision-support checklist. Have a qualified reviewer confirm the facts and the local requirements that apply to you.
Which regulations does it focus on?
GDPR and consumer-privacy themes. Other regimes have their own disclosure requirements that this scan does not cover.
Decision-support only. Not legal advice, a DPO replacement, or a compliance certificate.