Six disclosures that GDPR Articles 13 and 14 require were missing from the privacy.md of a two-person SaaS shipping to EU users: no legal basis, no retention period, no route to a supervisory authority, no Article 46 safeguard, five of the six data subject rights never named, and [Your Company] still sitting in paragraph three.
That file is not unusual. It is the file most small teams have: someone asked an assistant for a privacy policy in the first week of the company, pasted the answer into the repository, and shipped. It reads well, with headings that sound right — Information We Collect, How We Use Information, Sharing, Security. It is also the first document a supervisory authority asks for when a user complains.
GDPR Privacy Notice Lint is a VS Code extension and a free web page that read that file the way the article text reads it: as a list of disclosures that are either present or absent. Sixteen rules, each carrying its article number. Open the notice, run the command, and every missing disclosure lands in the Problems panel on a line you can click.
Run it against the policy shipped as the dirty fixture and it returns 17 findings: 11 errors and 6 warnings. No controller is named as a legal entity and no address or mailbox is given, both required by Article 13(1)(a). There is no legal basis anywhere in the file, which Article 13(1)(c) requires for every purpose. Retention says the company keeps data "as long as necessary", which is not the period Article 13(2)(a) asks for. The rights section offers account access and a contact form; rectification, erasure, restriction, portability and objection are absent, so five of the six rights under Articles 15 to 21 are missing, and nobody is told they may withdraw consent or complain to a supervisory authority under Article 77.
The warnings are the ones a reader skims past. No data protection officer contact, and no statement that none was designated. No mention that data leave the EEA, and no Article 46 safeguard for the partners who "help us operate our website". Nothing about automated decision-making. And the header: last updated 3 March 2021, which the date rule reports as 2020 days old, past the 730-day mark. The clean fixture returns 0 findings, so green means something.
Ask a chatbot to review the same file and it will rewrite the prose. It will not count the six rights, because counting is not what it is doing, and it cannot compare the date in your header to today. Sixteen deterministic rules give the same answer twice, with an article number and a line number attached.
Why now: infringements of Articles 12 to 14 sit in the higher tier of Article 83(5), up to €20 million or 4% of total worldwide annual turnover, whichever is higher. And the clock is not yours. Once a person asks about their data, Article 12(3) gives you one month to answer, counted from the day the mail arrives — and the first thing that answer gets measured against is the notice you published.
Checking the file open in your editor is free, forever: all 16 rules, every finding, no key, no run limit. The licensed command cuts on a different axis — scope and ownership. It sweeps every notice in the workspace in one pass and writes a dated evidence report you keep, $29 once, one key per person or CI seat, 7-day full refund. A law firm reading one notice against Articles 13 and 14 bills about €250 an hour, for one version of one file.
It is a checklist, not a lawyer. It cannot tell you whether the legal basis you chose is the right one. It can tell you, in about a second, that you never wrote one down.
Free in your browser (the same rules): https://getreadystack.com/tools/gdpr-privacy-notice-lint
Licence ($29, once, 7-day refund): https://buy.polar.sh/polar_cl_sHFWy5cMZEnka87rCDg3F8t1bTkKSKQZcbXaQ1qRwVS
Top comments (0)