Paste the text of your privacy notice or privacy policy. The checker looks for every element required by Articles 13 and 14 GDPR, from the identity of the controller to the right to lodge a complaint, and shows you what is missing, what to check and what to write, with a model for each. The text stays in your browser.
Enable JavaScript to use the checker. Or send us the notice and we check it for you.
Eighteen elements: the twelve required by Article 13(1) and (2), the two that Article 14 adds for data obtained from other sources (categories of data and source), plus four quality items: the date of the last update, the reference to the cookie policy, the readability required by Article 12 (sentence length) and warning signs (references to Directive 95/46/EC or pre-GDPR national acts, repealed since 2018, and unfilled template placeholders). Four context questions establish what is mandatory for you: DPO, legitimate interest, transfers outside the EEA, automated decisions.
A verdict, the number of mandatory elements found, the list of missing ones with a model text for each, the list of those to check (for instance a legitimate interest invoked but not described), recommendations and readability statistics. The report can be printed, copied or downloaded as Word, so it reaches whoever rewrites the notice.
The legislation was checked on 22 October 2026.
The check is lexical: it may miss an unusual wording or treat as found an element mentioned only in passing. It does not judge whether the chosen basis is right, whether the period is reasonable or whether all recipients are listed. That needs someone who knows the processing operations; we do it together.
Article 13 GDPR, for data collected from the person: the identity and contact details of the controller, the DPO's contact details (if any), the purposes and legal basis, the legitimate interests pursued (where that is the basis), the recipients, transfers outside the EEA and the safeguards, the retention period or criteria, the data subject's rights, the right to withdraw consent, the right to lodge a complaint with the supervisory authority, whether providing the data is mandatory and the consequences of not providing it, the existence of automated decisions and profiling. Article 14, for data obtained from other sources, adds the categories of data and their source.
No. It looks for words and phrases associated with each element, so it confirms that the element appears, not that it is correct or complete. A notice that mentions “legitimate interest” without naming it passes the check but not an inspection; that is why elements where quality matters are marked “to check”. You can also paste a privacy policy from a website: it works the same way.
Incomplete or missing information (Article 13) appears constantly in the sanctions published by the ANSPDCP, usually alongside other breaches: forms without a notice, policies that do not state the retention period or the rights, CCTV without information. Our monthly fine reviews show the recent cases.
Yes, on the Romanian version of the tool, which uses the matching Romanian patterns and also handles texts without diacritics or with the old ş and ţ.
We start from the record of processing, write the notices for each category of people (employees, customers, visitors, candidates) and link them to the cookie policy and the forms on your site.