Scan rule · RSC-PRV-012
Privacy policy: mandatory details not found
Fetches the privacy policy and looks for the controller, data subject rights, the right to complain and the retention period.
Why this matters
Article 13 GDPR lists what must be disclosed at the time of collection. In practice the retention period (Art. 13(2)(a)) is missing most often — many generators leave exactly this point open because it is project-specific.
This rule is a hint with low severity too. The mandatory information can be phrased in very different ways; our pattern matching finds the common variants, not every one.
Assessing purposes and legal bases in detail would require reading comprehension rather than pattern matching. That belongs in an audit, not in an automated scan — so we deliberately do not check it here.
Scan tier
How to fix it
Add the missing mandatory information under Article 13 GDPR.