---
title: "Check how personal data is handled · Agent Wranglers"
url: https://agentwranglers.se/playbook/codebase-takeover/due-diligence/personal-data-review
id: TKO-36
level: Recommended
applies: eu-users
updated: 2026-10-22
tokens: 698
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Check how personal data is handled

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Due diligence](https://agentwranglers.se/playbook/codebase-takeover/due-diligence.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: TKO-36
- Level: Recommended
- Chapter: [Due diligence](https://agentwranglers.se/playbook/codebase-takeover/due-diligence.md)
- Rule: Record whether a record of processing exists, which vendors receive personal data without a signed processing agreement, and whether deletion requests reach every store.
- Check: The report states whether the record of processing exists and lists each vendor without a processing agreement. It gives the test deletion's result in every store.
- Applies when: The project has users in the EU.
- How: A GDPR gap becomes the buyer's liability on the day of closing. Compare the [record of processing](https://agentwranglers.se/playbook/compliance/records-and-data-map/records-of-processing.md) with the data stores in the [system map](https://agentwranglers.se/playbook/codebase-takeover/triage/system-map.md). Check each vendor against [Check each agreement covers Article 28](https://agentwranglers.se/playbook/compliance/processors-and-transfers/dpa-article-28.md). Create a test user, ask for deletion, and search every store for it afterwards.

## Sources

- [GDPR, Regulation (EU) 2016/679](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

## Related rules

- CMP-8 [Keep the record of processing as data](https://agentwranglers.se/playbook/compliance/records-and-data-map/records-of-processing.md) in Compliance and governance
- TKO-5 [Map the system before changing it](https://agentwranglers.se/playbook/codebase-takeover/triage/system-map.md) in Codebase takeover
- CMP-14 [Check each agreement covers Article 28](https://agentwranglers.se/playbook/compliance/processors-and-transfers/dpa-article-28.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/codebase-takeover/due-diligence/personal-data-review">Agent Wranglers codebase takeover playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [List what must be rebuilt to grow](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/rebuild-list.md)
- Next: [Tie every finding to a rule ID and evidence](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/findings-with-rule-ids.md)
- [Due diligence](https://agentwranglers.se/playbook/codebase-takeover/due-diligence.md)