Agent WranglersTKO-36Recommended
Check how personal data is handled
Record whether a record of processing exists, which vendors receive personal data without a signed processing agreement, and whether deletion requests reach every store.
How to do it
A GDPR gap becomes the buyer's liability on the day of closing. Compare the record of processing with the data stores in the system map. Check each vendor against Check each agreement covers Article 28. Create a test user, ask for deletion, and search every store for it afterwards.
How to check
The report states whether the record of processing exists and lists each vendor without a processing agreement. It gives the test deletion's result in every store.
Sources
Related rules
- CMP-8 Keep the record of processing as data in Compliance and governance
- TKO-5 Map the system before changing it in Codebase takeover
- CMP-14 Check each agreement covers Article 28 in Compliance and governance
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/codebase-takeover/due-diligence/personal-data-review">Agent Wranglers codebase takeover playbook</a>. In code you write, add a comment next to it with the same link.