GDPR
GDPR is a law enforced by national supervisory authorities (DPAs).
VulnVerify provides the security testing and evidence your auditor asks for; the SOC 2 report, ISO 27001 certificate or PCI DSS assessment itself is issued by your CPA firm, certification body or assessor.
Who issues it and what you end up with
- Issued by
- EU regulation enforced by national supervisory authorities (DPAs). No mandatory certificate.
- Summary
- Article 32 requires security “appropriate to the risk” and, in 32(1)(d), a process for regularly testing, assessing and evaluating the effectiveness of security measures. No frequency is set; “regularly” is risk-based. Article 5(2) requires the controller to be able to demonstrate compliance, which is why dated testing records matter.
- Version
- Regulation (EU) 2016/679
Where scanning and penetration testing appear
Each control the page maps, with what it asks and whether a scan or a penetration test is required by it, supports it or is not named in it.
| Control | What it asks | Scan | Pentest | Note |
|---|---|---|---|---|
| Art. 32(1)(d)Security of processing — regular testing of effectiveness | A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing. | Supports | Supports | Primary |
| Art. 32(1)(b)Ongoing confidentiality, integrity, availability and resilience | The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services. | Supports | Supports | Secondary |
| Art. 32(2)Risk-based level of security | The appropriate level of security takes account of the risks presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. | Supports | Supports | Secondary |
| Art. 5(2)Accountability | The controller is responsible for, and must be able to demonstrate compliance with, the data-protection principles. | Supports | Supports | Secondary |
Minimum frequencies
The minimums the text sets, or that it sets none, and how weekly scanning compares.
- Scans
- GDPR sets no scan frequency. VulnVerify scans weekly (every 7 days).
- Penetration tests
- The regulation sets no frequency.
What VulnVerify provides and what you still need
Control by control: the evidence VulnVerify produces, and what still comes from you, your auditor or another provider.
What VulnVerify provides
- Art. 32(1)(d) Scheduled scans plus periodic penetration tests as the “process”; dated reports and remediation records as its output.
- Art. 32(1)(b) Findings that threaten confidentiality/integrity/availability, with remediation.
- Art. 32(2) Severity and exploitability context per finding.
- Art. 5(2) Exportable, dated evidence pack.
What you still need
- Art. 32(1)(d) The documented process, risk assessment, and organisational measures.
Questions about GDPR
Does GDPR require penetration testing?
Not by name. Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of security measures; penetration tests and scans are the usual way to run and evidence that process.
What do NIS2 and DORA require?
NIS2 Article 21(2) requires vulnerability handling and disclosure and policies to assess the effectiveness of security measures, without fixed frequencies. DORA requires a testing programme with tests by independent parties and at least yearly testing of systems supporting critical or important functions; threat-led penetration testing every three years applies only to designated entities and is not something VulnVerify offers.
Can VulnVerify issue my SOC 2 report or ISO certificate?
No. Those come from a licensed CPA firm and an accredited certification body respectively. VulnVerify supplies the technical testing and evidence they review.
Sources
The texts this page reads from.
- Regulation (EU) 2016/679, Articles 5(2) and 32
Your first report is free
Verify your domain and the first scan report is free. For a penetration test, contact sales.