# GDPR code check

# Your privacy statement makes promises. Does your code keep them?

The GDPR code check looks in your source code at how personal data is really processed: what you store, for how long, who can reach it and where it goes. Order it on its own or on top of a security code review.

**From €1,150 excl. VAT**. Fixed price once the scope is agreed

- **Delivery**: Read access to your repository
- **Looks at**: Storing, keeping, sharing and deleting
- **Combine**: With security code review
- **Start**: By arrangement, usually within two weeks
- **Report**: Within 10 working days of the check
- **Up front**: NDA, code only used for this check

[Request a GDPR code check](https://hackindex.nl/en/contact/details?parts=avg)

## Sound familiar?

- **A customer sends a data processing agreement.** In it you promise appropriate measures. Does the code live up to that?
- **Someone asks for access or deletion.** Can you do that completely, including logs and connected systems?
- **The app processes sensitive data.** Health, finances, national ID numbers or data of children need extra care.
- **Nobody knows exactly what is stored anymore.** After a few years of development that overview is often gone.

## The path of a piece of personal data

The check follows personal data from the moment it comes in until the moment it should be gone. Pick a step.

### Coming in: Collecting

Do you only ask for what you need?

- Fields that are stored but serve no purpose
- Sensitive data that is not needed
- Consent that the code does not respect

### Storage: Storing

How is the data stored?

- Sensitive data without encryption
- Copies of the same data in several places
- Documents and ID copies that are too easy to reach

### Storage: Log files

What does the app write away unnoticed?

- Personal data and passwords in logs
- Logs that are never cleaned up

### Use: Access

Do employees see more than needed?

- Admin areas with access to all data
- Whether it is recorded who views data

### Use: Sharing

Where does the data go?

- Integrations that send more data than needed
- Services outside the EU
- An overview of every processor in the code

### End: Keeping and deleting

Is anything ever thrown away?

- Retention periods in the code next to your privacy statement
- Being able to handle a request for access or deletion completely

## What a finding looks like

For each finding what is wrong, the evidence, what it means and how to fix it.

### HI-OP-2026-T3PA-05: National ID numbers and passwords end up in the log files

- **Severity**: High

On an error the whole form is logged, including the ID number and the password. The logs are never cleaned up and also go to an error tracking service outside the EU.

```
// app/Exceptions/Handler.php, line 27
Log::error($e->getMessage(), [
    'input' => request()->all(),
]);
```

Sensitive personal data is kept without limit and shared with a party outside the EU. That conflicts with data minimisation and with the retention period in your privacy statement.

```diff
Log::error($e->getMessage(), [
-    'input' => request()->all(),
+    'input' => request()->except(['bsn', 'password']),
]);
```

A made-up example. Real findings stay confidential.

## What is and is not included

### Part of the job

- How the code collects, stores and shares personal data
- Retention periods and cleaning up data
- Access and deletion per person
- An overview of the processors in the code

### Not included

- **Legal advice**, such as your privacy statement or processing agreement
- **Policy and processes**, within your organisation
- **Security**, unless you add the security code review

## What does it cost?

After a short look at the code you get a fixed price. These points decide the size.

**From €1,150 excl. VAT**. Fixed price, no extra charges afterwards

- **Kind of data**: Contact details are simpler than health, ID numbers or data of children.
- **Integrations**: Every service the data goes to is followed.
- **Size**: In how many places personal data passes through the code.

## What you provide

The better this is ready, the more time goes into the testing itself.

- **Read access to the repository** (Needed): An invitation in GitHub or GitLab that you revoke afterwards.
- **Your privacy statement** (Needed): To compare what you promise with what the code does.
- **A list of processors** (Optional): As far as known. The check completes it.

## More coverage in one job

- **GDPR code check** (from €1,150): How your code handles personal data.

- **Security code review** (from €1,520): A data breach often starts with a security flaw. Together the same code is checked on both points in one round.

[More about Security code review](https://hackindex.nl/en/security-code-review)

## Frequently asked questions

### Is this a GDPR audit?

No. The check looks at what your code does with personal data. Policy, contracts and processes fall outside it.

### Can I order the check without a security review?

Yes. The GDPR code check can be ordered on its own or combined with a security code review.

### What do I get exactly?

An overview of the personal data in your code and where it goes, plus findings with a concrete code change.

## Get your code checked for GDPR.

Tell which data you process and where it goes. You'll receive a proposal with a fixed price.

- [Request a GDPR code check](https://hackindex.nl/en/contact/details?parts=avg)

## Other services

- [Web and API pentest](https://hackindex.nl/en/web-and-api-pentest): Web applications and APIs, with extra depth in Laravel and WordPress
- [Mobile pentest](https://hackindex.nl/en/mobile-pentest): iOS and Android apps, including the API behind them
- [Security code review](https://hackindex.nl/en/security-code-review): Your source code read for vulnerabilities

Source: https://hackindex.nl/en/gdpr-code-check