We record what tags, forms, storage, and connected vendors do before consent, after a choice, and after withdrawal. You get reproducible evidence, accountable technical owners, and a post-fix retest. The result stays within technical evidence and makes no claim of legal compliance.
An external scan can reveal an early tracker, cookie, or third-party request. It cannot reliably explain conditional tag-manager rules, authenticated forms, server-side forwarding, downstream deletion, or what changes after consent is withdrawn. We combine browser evidence with agreed configuration and workflow access, then state what we could and could not verify.
Scope depends on the number of templates, markets, consent states, tags, forms, vendors, and connected systems; the availability of staging, logs, and test accounts; and whether remediation and retesting are included. The dedicated guide explains market price ranges and cost drivers.
Send the routes, markets, consent platform, tag manager, forms, and connected systems you want tested. We will define the states, access, synthetic records, evidence format, exclusions, and retest before work begins.
The GDPR sets principles, rights, data-protection-by-design, processor, record, security, and impact-assessment duties. We use those duties to structure evidence questions—not to turn an engineering test into a legal opinion.
The EDPB guidance informs how we test choice, purpose-specific selection, and withdrawal behavior.
The EDPB overview informs the questions and boundaries for an agreed synthetic access or deletion workflow trace.
A legal review interprets duties, lawful bases, notices, contracts, transfers, and risk. This audit observes what the website and agreed connected systems actually collect, send, store, and do after a consent change or synthetic rights request. We document implementation evidence for your DPO or counsel to assess.
No scanner can see every authenticated, server-side, or downstream flow. A scan is a useful discovery input. The audit adds repeatable state changes, manual workflow tests, agreed configuration evidence, ownership, and a post-fix retest—and records any limit on what could be verified.
No. It proves only the technical behavior observed within the agreed scope and test conditions. Your controller, DPO, or legal adviser remains responsible for legal interpretation and decisions. The evidence pack makes those decisions and the engineering work more concrete.
Every finding includes a technical fix and retest criterion. Implementation can be handled by your team or scoped separately with us. The proposal states whether a second evidence pass is included, so “fixed” means retested rather than assumed.
Tell us what needs fixing
We read every brief and reply within one business day.
Prefer to talk first?or request a tech stack audit →or email us directly →
Not sure where to start? Send the stuck decision, workflow, or page. We will say whether you need a diagnostic call, a tech stack audit, or a different first step.