Privacy Regulations

5 automated security scanners

Global Privacy Alignment

Purpose: This scanner analyzes the global privacy alignment for a given domain and company by examining its privacy policy to determine if it adheres to a unified framework across multiple regulations, such as GDPR, CCPA/CPRA, and LGPD. It evaluates the presence of a designated Data Protection Officer (DPO), consistency in international transfer mechanisms, and opt-out options for sale or sharing.

What It Detects:

Mentioned Regulations: Identifies if multiple privacy regulations are mentioned but lacks a clear unifying framework or governance.
Rights Framework Fragmentation: Detects whether the rights framework is fragmented by region, indicating inconsistencies in how personal data handling is addressed across different jurisdictions.
No Global DPO: Indicates the absence of a single point of contact for privacy matters that could facilitate consistent application of privacy policies and compliance with regulations.
Inconsistent International Transfer Mechanisms: Detects if there are multiple mechanisms mentioned for transferring personal information internationally, but they are not presented as a unified policy.
Restricted Opt-out Options: Identifies opt-out options that appear to be restricted to specific regions rather than being universally available.

Inputs Required:

Domain: The website domain under examination.
Company Name: The name of the company associated with the domain.

Business Impact: The alignment of a company’s privacy policy across multiple jurisdictions is crucial for maintaining trust, avoiding legal disputes, and ensuring compliance with regulatory standards. Fragmentation in these policies can lead to inconsistencies that may be exploited by malicious actors or result in significant fines due to non-compliance.

Risk Levels:

Critical: The policy lacks any unifying framework across multiple regulations, resulting in severe fragmentation that significantly compromises privacy and legal compliance.
High: There is a notable lack of consistency in the handling of personal data across different jurisdictions, which increases the risk of non-compliance with regulatory standards.
Medium: While some level of inconsistency exists, it does not pose an immediate critical threat but should be addressed to maintain best practices and legal compliance.
Low: The privacy policy appears globally aligned without significant fragmentation or governance gaps that could compromise data handling practices.
Info: Informal findings indicate minor inconsistencies or missing elements in the privacy policy that do not significantly impact overall risk but are nonetheless areas for improvement.

Example Findings:

A company’s privacy policy mentions both GDPR and CCPA requirements but does not clearly delineate how it complies with both, potentially leading to compliance issues.
The absence of a global DPO is noted in the governance structure, which could lead to inconsistencies in enforcing data protection policies across different regions.

CCPA CPRA Compliance

Purpose: This scanner is designed to analyze the compliance with California Consumer Privacy Act (CCPA) and its equivalent in Colorado, the Colorado Privacy Act (CPRA), for given domains and companies. It searches for specific statements related to CCPA/CPRA compliance on company websites and extracts relevant information about their practices.

What It Detects:

The scanner identifies if a “Do Not Sell My Personal Information” link is present on the homepage, indicating compliance with the opt-out mechanism under CCPA.
It checks for visibility of the Do Not Sell link across various pages to ensure user awareness and accessibility.
It evaluates whether the company provides an option to limit the use of sensitive personal information as required by CPRA.
The scanner looks for evidence of processing purposes, consent requirements, and protections documented for sensitive personal information.
It scans for the presence of a “Do Not Sell” button or mechanism that would allow users to opt out of sharing their data with third parties under CCPA compliance.
The tool searches for statements about consumer rights including the right to know, delete, correct, and limit the use of sensitive personal information as per CPRA requirements.
It checks if notices regarding collection practices at the point of data usage are present on the website.
The scanner verifies whether Global Privacy Control (GPC) is recognized by the company’s systems for CCPA compliance.
It assesses documented procedures for authorized agents and policies against discrimination in processing personal information as per CPRA standards.

Inputs Required:

<domain>: The website domain of the company being assessed.
<company_name>: The name of the company whose privacy practices are to be evaluated.

Business Impact: Ensuring compliance with CCPA and CPRA is crucial for protecting consumer data rights, preventing unauthorized access to sensitive information, and maintaining trust in digital transactions. Non-compliance can lead to significant legal liabilities, fines, and damage to brand reputation.

Risk Levels:

Critical: The scanner flags critical findings when there are no compliance statements found on the website or when key links for opt-out mechanisms or personal data handling practices are missing.
High: When important compliance details such as “Do Not Sell” links, consumer rights notices, and GPC recognition are absent, risk is considered high.
Medium: Medium risk findings emerge from the absence of certain privacy policies or when there’s a lack of clarity in data handling practices documented on the website.
Low: Lower severity risks pertain to minor non-compliance points that do not significantly impact consumer trust or legal exposure but still need attention for continuous improvement.
Info: These are informational findings and include scenarios where specific compliance statements are present but some requirements under CCPA/CPRA remain unaddressed.

If the README does not specify exact risk levels, we infer them based on the severity of non-compliance detected by the scanner.

Example Findings:

A company’s website lacks a clear “Do Not Sell” button that would allow users to opt out of data sharing under CCPA.
There is no mention of consumer rights including the right to know, delete, or correct personal information on the site as per CPRA requirements.

Purpose: This scanner analyzes GDPR compliance for given domains and companies by examining privacy statements and policies to determine adherence to key GDPR principles such as legal basis for processing, obtaining explicit consent, respecting data subject rights, designating a DPO, managing international transfers, and establishing procedures for handling breaches.

What It Detects:

Legal Basis for Processing: The scanner identifies whether the company has clearly documented the legal basis for processing personal data in its privacy statements.
Consent Mechanisms: It checks if consent is obtained freely and explicitly, with options to withdraw consent being available.
Data Subject Rights: The scanner verifies access rights, erasure requests, portability of data, and rectification capabilities as per GDPR requirements.
DPO Designation: It assesses whether the company has designated a DPO and if this is clearly stated in their policies.
International Transfers: The tool checks for disclosures about international transfers of personal data and compliance with transfer mechanisms like standard contractual clauses.
Breach Notification Procedures: It evaluates the existence of procedures to report and handle data breaches as mandated by GDPR.
Privacy By Design: The scanner looks for evidence that privacy is integrated into the design, architecture, and operations of the company’s services and systems.

Inputs Required:

<domain>: The web domain of the organization under investigation.
<company_name>: The official name or identifier of the company.

Business Impact: Ensuring GDPR compliance is crucial for protecting personal data rights and maintaining trust with users. Non-compliance can lead to significant fines, legal battles, and damage to brand reputation. This scanner helps organizations self-assess their GDPR readiness and identify areas needing improvement.

Risk Levels:

Critical: The system fails to detect any of the required elements or detects critical errors in processing (e.g., no privacy policy found).
High: Missing essential components like a clear legal basis, consent mechanisms not meeting GDPR standards, or significant gaps in data subject rights handling.
Medium: Incomplete information on international transfers, lack of DPO designation, or inadequate breach notification procedures.
Low: Some elements are present but significantly incomplete or lacking detailed documentation.
Info: Informational findings indicate minor issues that do not significantly impact GDPR compliance but could be improved for better practices.

Example Findings:

A company claims to have a DPO designated, but the role and responsibilities are unclear in their policies.
The privacy policy does not specify any legal basis for processing personal data, which is mandatory under GDPR.

LGPD Compliance

Purpose: This scanner analyzes the compliance with the Brazilian Lei Geral de Proteção de Dados (LGPD) for given domains and company names. It searches for statements related to data protection, identifies gaps in legal basis for processing, consent mechanisms, and other relevant areas, assessing overall risk based on findings.

What It Detects:

Legal Basis Transparency: The scanner checks if the legal bases for data processing are documented clearly (e.g., necessity of contract, legitimate interest).
Consent Mechanisms: It verifies whether consent mechanisms are free and informed, with a clear highlight for specific purposes, and withdrawal options are available.
Data Subject Rights: The scanner looks for acknowledgment of rights such as access to data, correction if needed, deletion, and portability.
DPO Designation: It assesses the presence of a designated Data Protection Officer (DPO) and public availability of contact information.
International Transfers: Scanner identifies any international transfers of personal data and checks for adequate safeguards mentioned in compliance documentation.
Sensitive Data Handling: The scanner evaluates if sensitive categories of data are handled with documented legal basis, especially concerning privacy.
Breach Notification: It verifies the existence of procedures for reporting and notifying data breaches to the relevant authorities.

Inputs Required:

<domain>: The website domain under evaluation.
<company_name>: The name associated with the domain (e.g., Acme Corporation).

Business Impact: The compliance with LGPD is crucial for any organization operating in or targeting Brazil, as it directly affects how personal data can be handled and protected. Non-compliance can lead to significant fines and damage reputation. This scanner helps identify areas of non-compliance early on, allowing for timely remediation and risk mitigation.

Risk Levels:

Critical: When the number of compliance gaps is 8 or more, indicating severe deficiencies in data protection practices.
High: When there are between 4 to 7 gaps, suggesting significant but manageable shortcomings.
Medium: When there are between 2 to 3 gaps, indicating some areas need attention but overall impact is moderate.
Low: When the number of gaps is less than 2, showing good compliance with LGPD provisions.
Info: Used for findings that do not significantly affect data protection practices but still require awareness and potential improvement.

Example Findings:

The company’s privacy policy does not clearly state the legal basis for processing personal data from customers.
Consent forms provided to users are too brief, lacking explicit information about how data will be used beyond basic services.

PIPEDA Compliance

Purpose: This scanner analyzes the compliance of a given domain with respect to the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada. It checks for adherence to requirements related to privacy officer designation, contact information availability, purpose identification, consent acquisition, individual access to information, and data breach notification procedures.

What It Detects:

Accountability: Privacy Officer or responsible individual not designated.
- The scanner identifies whether a privacy officer or responsible individual is designated in the organization’s structure. If not, it flags this as a compliance gap.
Openness: Contact information for privacy inquiries is not readily available.
- It checks if there is clear contact information provided on the website that users can easily access to inquire about their personal data.
Identifying Purposes: Purposes for data collection are not clearly identified.
- The scanner looks for explicit statements in the privacy policy or terms of service outlining the purposes for which user data is collected.
Consent: User consent is not explicitly obtained.
- It verifies if there is a mechanism within the policies to obtain and document user consent for data processing activities.
Individual Access: A process for users to access their information is not documented.
- The scanner checks whether there is a clear procedure in place for individuals to request and access their personal information held by the organization.
Safeguards: Security safeguards for protecting data are not disclosed.
- It assesses if the website has any security measures in place that protect user data, which should be clearly documented according to PIPEDA requirements.
Breach Notification: A data breach notification policy is not documented.
- The scanner evaluates whether there is a procedure or protocol for notifying individuals and the appropriate regulatory authorities about any unauthorized access or use of their personal information.

Inputs Required:

<domain>: The web address of the organization’s website to be assessed.
<company_name>: The legal name of the company, which is used in reporting compliance findings.

Business Impact: Ensuring compliance with PIPEDA is crucial for protecting personal information in accordance with Canadian law. Non-compliance can lead to significant fines and damage to the organization’s reputation. This scanner helps organizations identify gaps in their data protection practices that could expose them to legal risks and financial penalties.

Risk Levels:

Critical: The system fails to detect any of the required compliance statements, indicating a fundamental inability to comply with PIPEDA regulations.
High: There are significant gaps in one or more areas identified by the scanner (e.g., multiple non-compliance points).
Medium: There are several minor compliance issues that could be improved but do not significantly impact overall risk.
Low: The system shows minimal to no compliance issues, indicating a generally well-managed data protection posture.
Info: Informal or advisory findings related to potential improvements in documentation or practices without immediate critical risks.

Example Findings:

“The privacy policy does not clearly identify the purposes for which user data is collected.”
“There is no designated privacy officer, and contact information for inquiries is incomplete on the website.”

Privacy Regulations

Privacy Regulations

Global Privacy Alignment

CCPA CPRA Compliance

GDPR Compliance

LGPD Compliance

PIPEDA Compliance