GDPR Compliance Monitoring

What is GDPR Article 32 monitoring?

GDPR Article 32 requires that organisations implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. For websites, this includes ensuring that personal data collection is lawful (consent), transparent (privacy policy), minimised (tracking audit), and protected (secure cookies, HTTPS).

Shieldome scans each monitored URL weekly and produces a scored GDPR compliance report covering consent, cookies, trackers, privacy policy, and sensitive data indicators. You receive an email alert whenever a new tracker is detected or a previously passing check starts failing.

What is checked

Consent banner (Art. 7)

Shieldome detects whether the page loads a recognised consent management platform (CMP). Supported platforms include OneTrust, Cookiebot, CookieYes, TrustArc, Quantcast Choice, Usercentrics, Didomi, Osano, Complianz, iubenda, and others. The presence of a CMP is checked; whether it is correctly implemented (opt-in before non-essential cookies are set) requires a manual audit.

Privacy policy link (Art. 13)

Article 13 requires that data subjects are informed about processing activities at the time their data is collected. Shieldome checks whether the page contains a link to a privacy policy using common patterns across multiple languages (English, German, French, Spanish, and others).

Cookie analysis (Art. 32)

Shieldome inspects all cookies set by the page and checks each one for:

Third-party tracker detection (Art. 6)

Shieldome scans the page HTML for script tags and resource URLs matching known third-party data processors. Each detected tracker is mapped to the GDPR lawful basis it most commonly relies on. Detected categories:

Third-party domains (Art. 44–46)

Shieldome lists all external domains that receive requests from the page. This includes fonts, scripts, images, and analytics endpoints. Transfers to processors outside the EU/EEA require either an adequacy decision, Standard Contractual Clauses, or another approved mechanism under Chapter V.

Sensitive data exposure (Art. 32)

Shieldome checks whether the page HTML contains patterns resembling personal data — email addresses, phone numbers, or national ID formats — in a context that suggests unintended exposure (for example, in error messages, debug output, or page source comments).

Plans and quotas

Adding a URL

Open the GDPR Monitoring tab in the dashboard. Click Add URL, enter the full URL of the page you want to monitor (typically your homepage and any data collection forms), and add an optional label. Shieldome runs the first scan immediately in the background.

Once the scan completes, the card shows:

• An overall GDPR risk score (0–100)
• Status: OK, Issues, or Error
• Tracker count and consent platform detected
• Date and time of the last scan

Understanding the score

Each failing check deducts points from a starting score of 100. Critical issues (no consent banner with tracking scripts present, insecure cookies carrying personal data) deduct more than informational observations. A score above 80 is considered low risk; below 60 indicates significant issues that should be addressed before a regulatory audit.

Alert emails

You receive an email alert when:

• A new third-party tracker is detected that was not present in the previous scan
• A check that was previously passing begins to fail
• The scan encounters an error fetching the page

The alert includes the specific change, the affected URL, and the scan timestamp.

Triggering a manual scan

Click Scan now on any monitored URL card to run an immediate scan outside the weekly schedule. This is useful after deploying changes to your consent implementation or privacy policy.

Scan history

Click View history on a URL card to see a timeline of all past scans, scores, and tracker counts. Select any historical scan to review the full findings snapshot from that point in time — useful for demonstrating compliance posture to a DPO or auditor.

Frequently asked questions

Does GDPR Monitoring replace a full GDPR audit?
No. It automates the technical checks that can be performed from a public URL. A complete GDPR compliance programme requires a Data Protection Impact Assessment (DPIA), Records of Processing Activities (RoPA), staff training, and a DPO assessment of all data flows — none of which can be automated by an external scanner.

We use consent management — why are trackers still flagged?
Shieldome detects trackers that are present in the page HTML at fetch time. If your CMP loads trackers before consent is given (a common misconfiguration), they will be flagged. Ensure that tracking scripts are only injected after the user actively consents, not on page load.

Can I use scan history as evidence for a supervisory authority?
Scan history provides timestamped evidence that you actively monitor your web properties for compliance indicators. Whether it satisfies a specific supervisory authority's evidential requirements depends on the authority and the nature of the inquiry. Consult your DPO or legal counsel for advice on documentation requirements.

What if my page requires login to access?
The scanner fetches pages without a session. If the URL you add requires authentication, the scan will see the login page instead of the actual content and most checks will not apply. Monitor your public-facing pages (homepage, product pages, sign-up forms) where data collection occurs before login.

What is a "third-party domain" transfer?
Any request the page initiates to a domain outside your own — loading a font from Google Fonts, an analytics pixel from a US server, or a chat widget from a third party — constitutes a data transfer. The IP address of the visitor's browser is shared with that third party. Under GDPR, transfers to non-EEA processors require a legal mechanism.