Organization should provide transparent privacy notices
High
Cross-cloud
General
manual-gdpr-privacy-notice
How to fix it
Provide clear, concise, and transparent privacy notices to data subjects at the point of data collection. Include identity of controller, purposes, lawful basis, retention periods, and data subject rights per Articles 13-14.
How to verify
- Verify privacy notice exists and is publicly accessible
- Confirm all required Article 13/14 information is included
- Verify notice is provided at point of collection
Compliance frameworks
Is your environment compliant with this rule?
CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.
Related Cross-cloud rules
- Block storage volumes must be encrypted
- Cache service security hardening
- Cache services must enforce TLS encryption in transit
- Container registry security hardening
- Database authentication must use managed identities
- Databases must not be publicly accessible
- IAM password policy must require minimum length of 14
- Key management service security hardening