Skip to main content

GDPR

Vulkro supports two GDPR tasks: a draft Article 30 record of processing (RoPA) built from your code, and Article 32 control mapping.

vulkro scan . --format ropa-md > ropa.md        # Article 30 draft, Markdown
vulkro scan . --format ropa-html > ropa.html    # Article 30 draft, HTML
vulkro compliance . --profile gdpr              # Article 32 controls

Record of processing​

The RoPA is a template, not a finished record. It lists:

  • the categories of personal data Vulkro detected (contact data, date of birth, government identifiers, health data and so on)
  • each endpoint, with its method, path, auth status and module
  • the open personal-data findings to fix before you file it (add --profile owasp-asvs to fill in the control status too)
  • placeholders marked <!-- TBD --> for the controller, purposes, data subjects, transfers, retention and lawful basis, which you fill in

Article 32 controls​

Control
Art 32(1)(a) Pseudonymisation and encryption
Art 32(1)(b) Confidentiality
Art 32(1)(b) Integrity
Art 32(1)(b) Availability
Art 32(1)(c) Restoration of availability
Art 32(1)(d) Regular testing
Art 32(2) Risk assessment
Art 32(4) Personnel access

A control fails when findings show personal data could be exposed, altered or destroyed without authorization.

Personal data fields​

The privacy check classifies fields such as email, phone, dob, ssn, passport_number and ip_address in request and response shapes.

See also: Compliance overview, Output formats

Last updated on