Does your business need a privacy scan?
Five questions. Real preliminary signal across GDPR, CCPA, and US state privacy laws, not a marketing quiz. Email-gated only after you see the answer.
Does your business collect, store, or process personal data (names, emails, IPs, identifiers, location, behaviour, etc.) of customers, employees, or website visitors?
Almost every B2C / B2B SaaS does. Answer no only if you operate purely on anonymised aggregates with no identifiers anywhere.
Frequently asked questions
When does GDPR apply to me?
GDPR (and the parallel UK GDPR) applies whenever you process personal data of individuals located in the EU/EEA or UK, regardless of where your company is based. There is no minimum-volume threshold: one EU subject is enough to attach the regulation.
What is a Data Subject Access Request (DSAR) and how fast must I respond?
A DSAR is a formal request from an individual asking what personal data you hold about them, why, and demanding correction or deletion. Under GDPR you have 30 days (extendable to 90 in complex cases). Under CCPA you have 45 days (extendable to 90). Failure to respond exposes you to administrative fines and private right of action.
Do I need a DPIA?
A Data Protection Impact Assessment (DPIA) is required under GDPR Article 35 for processing likely to result in a high risk to individuals, including large-scale processing of sensitive categories (health, biometric, criminal records), systematic monitoring, or automated decisions with legal effect. Many US state laws (Colorado, Virginia, Connecticut) mirror these triggers.
What sensitive categories trigger heightened obligations?
Under GDPR Article 9 and CCPA-CPRA: health and medical data, biometric data, racial or ethnic origin, religious beliefs, sexual orientation, government IDs (SSN, driver's license, passport), precise geolocation, and data of children under 13 (COPPA also applies in the US).