1. Identify exposed processing
We identify the systems that process personal data and are reachable from the internet: websites, portals, applications, APIs, registration and login pages.
GDPR · Article 32 · Security of processing · From €490
GDPR Art. 32: prove the technical verification of your security measures
Article 32 asks for technical and organisational measures appropriate to the risk, and for a process to regularly test and evaluate their effectiveness. A documented technical verification is the most concrete proof that this work has been done, and the most useful thing to show your DPO and any auditor.
What Article 32 actually says
The article requires controllers and processors to ensure a level of security appropriate to the risk. Among the criteria it lists are the pseudonymisation and encryption of personal data, the ability to ensure confidentiality, integrity, availability and resilience, the ability to restore availability after an incident and, precisely, a process for regularly testing, assessing and evaluating the effectiveness of the measures.
That last point is the one a penetration test or a vulnerability assessment demonstrates directly: not that the measures exist on paper, but that they hold against someone trying to break them.
From risk to proof: how the verification connects to the article
A four-step path that keeps the verification consistent with the risk analysis.
2. Verify the declared measures
We check authentication, access control between users, session protection, input validation and configuration. These are the measures the risk analysis says are necessary.
3. Document the outcome
The report states what was tested, with which method, which vulnerabilities were confirmed and what impact they could have on personal data.
4. Fix and repeat
Fixes are re-verified. The process is repeated at intervals consistent with the risk and after significant changes.
Why a vulnerability becomes a privacy issue
A flaw in a website or application is not only a technical problem. If it allows access to other users' personal data, it can become a personal data breach to be assessed under Articles 33 and 34, which require notification to the supervisory authority within 72 hours of becoming aware of it, where the conditions are met.
That is why a technical verification is not only about fixing: it tells you in advance which data could be exposed, so you can decide with judgement. It is a topic to share with the DPO before it reaches development.
What you get from the verification
Effectiveness testing
We verify whether the declared measures really hold against the most common application vulnerabilities, with reproducible proof.
Map of data exposure
For each vulnerability we indicate which personal data could be reached and with what level of impact.
Evidence for accountability
The report and the signed attestation are useful documentation for the controller's accountability and for discussions with the DPO.
Fix priorities
A fix order based on the risk to the people concerned, not only on technical severity, with a final re-verification.
What the verification does not prove
A penetration test is not a GDPR compliance assessment. It does not replace the record of processing, the data protection impact assessment (DPIA) where required, the legal bases, the notices or the handling of data subjects' rights.
It proves a specific and important part: the effectiveness of the technical measures on exposed systems. It belongs within the wider accountability framework the controller builds.
How to prepare the verification for the DPO
The DPO is the natural reader of the report. A few choices make the work easier for both of you.
The perimeter on processing
Tell us which applications process personal data. The verification focuses there, and the report states it.
Test accounts
If the application has several roles or users, we need distinct test accounts, so that the control between users can be verified.
The channel for results
Define in advance who receives the results and within what time, so the DPO is informed of relevant vulnerabilities.
The re-verification
The final proof shows the state after the fixes: it is the document the DPO files next to the initial assessment.
How much it costs
The Single perimeter plan costs €490 one-off, VAT excluded, for one external domain or application with its subdomains. More domains are quoted on request; the Enterprise and NIS2 plan starts at €4,900. The full price list is on the home page.
Frequently asked questions on GDPR and technical security
Is a penetration test mandatory under the GDPR?
The GDPR does not prescribe a specific test, but it requires regularly testing, assessing and evaluating the effectiveness of the measures (Art. 32(1)(d)). A documented test is one of the most solid ways to do it.
Can the report be used with the DPO?
Yes. It documents what was tested, when, with which outcome and which corrective actions: useful material for discussions with the DPO and for accountability documentation.
What data is handled during the test?
We limit data access to what is strictly needed to demonstrate an exposure and agree the methods in writing. The test runs only on the authorized perimeter.
Does a vulnerability we find have to be notified?
The verification does not replace the controller's own assessments. If a vulnerability has already led to unauthorised access to personal data, the notification assessment under Articles 33 and 34 must be made straight away, with the DPO. We flag it to you as soon as we find it.
How much does it cost?
The single perimeter costs €490 one-off, VAT excluded. For more domains the price is quoted on request; the Enterprise and NIS2 plan starts at €4,900.
How often should it be repeated?
At least once a year and after significant changes to the processing or the applications. For high-risk processing a tighter cadence is advisable, to be agreed with the DPO.
Need technical proof for your DPO or an audit?
Send us one domain: within 24 hours we tell you in writing whether the €490 verification fits and on which perimeter.
Read your perimeter for free