Is your privacy policy GDPR-ready? Find out article by article.
Upload your privacy or security policy and PolicyPilot checks it against every key GDPR article — lawful basis, notices, data subject rights, processors, breaches, DPIAs, transfers — telling you for each whether the text covers it, half covers it, contradicts it, or says nothing, and quoting the sentence it based that on.
The same engine covers 305 controls across 10 frameworks — US privacy law (CCPA/CPRA, COPPA, GLBA), PCI DSS for card payments, SOC 2, ISO 27001, HIPAA, NIST CSF 2.0 and Nigeria's Data Protection Act — so one policy review answers several audits.
The scoring is deterministic and explainable. A language model, when one is configured, reviews the harder calls and writes remediation language, but it can only move a verdict one step and only with a supporting quote. Without a model, the product still works.
Paste or upload a policy (PDF, Word or text) and get a control-by-control report in seconds — or browse the framework library first.
GDPR
39Regulation · European Union / EEA
CCPA/CPRA
21Regulation · United States
SOC 2
41Attestation · United States
ISO 27001
53Certification · International
PCI DSS 4.0.1
39Industry standard · Global
HIPAA
28Regulation · United States
GLBA
19Regulation · United States
COPPA
9Regulation · United States
NIST CSF 2.0
35Framework · United States
NDPA 2023
21Regulation · Nigeria
How the scoring works
Each control declares its required elements as groups of synonyms. A control counts as covered only when every group is satisfied — so "we encrypt data" does not satisfy an encryption control that also needs a statement about at-rest versus in-transit. It comes back partial, and the report names the missing half.
Two coverage numbers are reported: a plain count, and one weighted by severity. Eleven low-severity controls covered and one critical control missing is not 92% compliant in any sense an auditor would accept.
One artefact, many frameworks
Controls share a topic vocabulary, so the crosswalk is computed rather than hand-maintained. These topics each appear in three or more frameworks — evidence gathered once answers all of them.