Skip to content
HackIndex
Menu

Your privacy statement makes promises. Does your code keep them?

The GDPR code check looks in your source code at how personal data is really processed: what you store, for how long, who can reach it and where it goes. Order it on its own or on top of a security code review.

Request a GDPR code check What does it cost?
  • On its own or on top
  • Overview of your personal data
  • Concrete code changes

When

Sound familiar?

  • A customer sends a data processing agreement.

    In it you promise appropriate measures. Does the code live up to that?

  • Someone asks for access or deletion.

    Can you do that completely, including logs and connected systems?

  • The app processes sensitive data.

    Health, finances, national ID numbers or data of children need extra care.

  • Nobody knows exactly what is stored anymore.

    After a few years of development that overview is often gone.

Scope

The path of a piece of personal data

The check follows personal data from the moment it comes in until the moment it should be gone. Pick a step.

Coming in

Storage

Use

End

What the test answers

Collecting

Do you only ask for what you need?

  • Fields that are stored but serve no purpose
  • Sensitive data that is not needed
  • Consent that the code does not respect

What the test answers

Storing

How is the data stored?

  • Sensitive data without encryption
  • Copies of the same data in several places
  • Documents and ID copies that are too easy to reach

What the test answers

Log files

What does the app write away unnoticed?

  • Personal data and passwords in logs
  • Logs that are never cleaned up

What the test answers

Access

Do employees see more than needed?

  • Admin areas with access to all data
  • Whether it is recorded who views data

What the test answers

Sharing

Where does the data go?

  • Integrations that send more data than needed
  • Services outside the EU
  • An overview of every processor in the code

What the test answers

Keeping and deleting

Is anything ever thrown away?

  • Retention periods in the code next to your privacy statement
  • Being able to handle a request for access or deletion completely

From a report

What a finding looks like

For each finding what is wrong, the evidence, what it means and how to fix it.

Reference
HI-OP-2026-T3PA-05
Severity
High
CVSS
Not applicable, the severity is about the risk for the people the data belongs to.
Where
app/Exceptions/Handler.php, line 27
Who can do this
Every form that runs into an error
Retest
Fixed

National ID numbers and passwords end up in the log files

On an error the whole form is logged, including the ID number and the password. The logs are never cleaned up and also go to an error tracking service outside the EU.

Evidence

// app/Exceptions/Handler.php, line 27
Log::error($e->getMessage(), [
    'input' => request()->all(),
]);

Impact

Sensitive personal data is kept without limit and shared with a party outside the EU. That conflicts with data minimisation and with the retention period in your privacy statement.

Fix

app/Exceptions/Handler.php

Log::error($e->getMessage(), [
Removed: 'input' => request()->all(),
Added: 'input' => request()->except(['bsn', 'password']),
]);

A made-up example. Real findings stay confidential.

View the sample report

Clear up front

What is and is not included

IN Part of the job

  • How the code collects, stores and shares personal data
  • Retention periods and cleaning up data
  • Access and deletion per person
  • An overview of the processors in the code

OUT Not included

  • Legal advice, such as your privacy statement or processing agreement
  • Policy and processes, within your organisation
  • Security, unless you add the security code review

Price

What does it cost?

After a short look at the code you get a fixed price. These points decide the size.

from, excl. VAT

€1,150

Fixed price, no extra charges afterwards

  • Kind of data Contact details are simpler than health, ID numbers or data of children.
  • Integrations Every service the data goes to is followed.
  • Size In how many places personal data passes through the code.

Preparation

What you provide

The better this is ready, the more time goes into the testing itself.

  • Needed Read access to the repository An invitation in GitHub or GitLab that you revoke afterwards.
  • Needed Your privacy statement To compare what you promise with what the code does.
  • Optional A list of processors As far as known. The check completes it.

Combine

More coverage in one job

This service

GDPR code check

from €1,150

How your code handles personal data.

On top

Security code review

from €1,520

A data breach often starts with a security flaw. Together the same code is checked on both points in one round.

More about Security code review

Frequently asked questions

Is this a GDPR audit?

No. The check looks at what your code does with personal data. Policy, contracts and processes fall outside it.

Can I order the check without a security review?

Yes. The GDPR code check can be ordered on its own or combined with a security code review.

What do I get exactly?

An overview of the personal data in your code and where it goes, plus findings with a concrete code change.

Get your code checked for GDPR.

Tell which data you process and where it goes. You'll receive a proposal with a fixed price.

Request a GDPR code check

Other services