Turning a Privacy Scan Into GDPR Art. 30 Evidence

Most cookie checkers hand you a list of scripts and a colour. That is useful for a developer on a Tuesday. It is not what a data-protection authority, an enterprise procurement team, or your own DPO is asking for. They want evidence: what loaded, when, from whom, where the data went, and against which articles — in a form nobody can quietly edit afterwards.

From findings to a record

PrivaScan loads your page in a real headless browser and records every network request made before any consent is given, plus the cookies set and the web-storage keys written. Each third party is classified — vendor, category, purpose, destination region — and mapped to the KVKK / GDPR / ePrivacy articles it touches. A finding is traceable to a specific host, not a vague warning.

Those findings roll up into two artefacts you can actually hand over:

• A Privacy Scan Report — an A–F risk grade, an AI-authored findings narrative, and concrete developer remediation.
• A Data Inventory (GDPR Art. 30) — the processors observed, their purpose, the data category, the destination region, and the legal basis each one touches: a running start on the record of processing activities Art. 30 requires.

Tamper-evident by design

Evidence you can silently rewrite is not evidence. Every PrivaScan document carries a unique reference and a SHA-256 fingerprint. Anyone — an auditor, a customer, a regulator — can visit the public verify page, upload the PDF they were given, and confirm it is byte-for-byte the document on record. The comparison runs entirely in their browser; the file never leaves it.

Scope that matches the site

Trackers differ by page — the checkout may fire a payment pixel the homepage never touches. PrivaScan crawls your site and scans each page, then unions the trackers into one site-wide result, so your evidence reflects the whole property, not just the page you remembered to test.

The honest part

We will never print "compliant" on a document, because no automated tool can establish a legal conclusion. What PrivaScan gives you is the fast, repeatable, documented baseline — exactly what fired before consent, where it went, and the articles it engages — which you then take to counsel for the legal call. A privacy record built on that footing is one you can defend.

General information, not legal advice.