Direct answer
What a scanner checks — and what it cannot decide.
The plugin and engineering review record observable signals. Processing grounds, documents, notification, and the final legal view remain with the controller and legal adviser.
Three layers
What is visible, reviewed, and decided by the controller.
01
Automatically observable
Forms, cookies, scripts, endpoints, policy links, selected settings, and network destinations.
02
Manual engineering review
CRM/mail, first-write location, backups, access, retention, deletion, and conditional flows.
03
Controller decision
Purposes, grounds, texts, notification, internal documents, and threat model.
Topics
Six questions without mixing contexts.
Primary sources
Reviewed on 24 August 2026.
These links lead to current official texts and regulator surfaces. We do not turn a statutory summary into universal legal advice.
Tell us what the site needs.
A goal, the current difficulty, and an optional website address are enough. Do not send passwords, keys, or private exports.