GDPR Compliance Testing

GDPR and QA Testing #

The General Data Protection Regulation (GDPR) is an EU regulation that governs how organizations collect, process, store, and delete personal data. While GDPR is an EU law, it applies to any organization that processes data of EU residents — meaning most global web applications must comply.

For QA engineers, GDPR creates specific testable requirements. Unlike general security testing, GDPR testing focuses on user rights, consent management, and data lifecycle verification.

Key GDPR Rights to Test #

Right to Information (Transparency) #

Users must be informed about data collection before it happens:

• Privacy policy is accessible from every page
• Cookie consent banner appears on first visit
• Clear language explains what data is collected and why
• Third-party data sharing is disclosed
• Data retention periods are stated

Right of Access (DSAR) #

Users can request all data a company holds about them:

• User can submit a data access request through the application
• Response includes all personal data within 30 days
• Data is provided in a machine-readable format (JSON, CSV)
• Data includes: profile info, activity logs, payment history, communications
• The identity of the requester is verified before data is released

Right to Rectification #

Users can correct inaccurate personal data:

• Users can edit their profile information
• Changes propagate to all systems (not just the UI)
• Corrected data is reflected in exports and reports

Right to Erasure (Right to Be Forgotten) #

Users can request deletion of all their personal data:

• Deletion request mechanism exists in the application
• All personal data is deleted from primary storage
• Data is removed from backups within a reasonable timeframe
• Data is deleted from third-party systems (analytics, CRM, email)
• Anonymized data (cannot identify the user) may be retained
• Content created by the user in shared spaces is handled appropriately

Right to Data Portability #

Users can export their data in a common format:

• Export is available in JSON, CSV, or similar machine-readable format
• Export includes all personal data
• Export can be downloaded by the user
• Export does not include other users’ personal data

Right to Object #

Users can opt out of certain data processing:

• Marketing email opt-out is respected
• Analytics tracking can be disabled
• Data profiling for automated decisions can be opted out of

Cookie Consent Testing #

Requirements #

Testing Cookie Consent #

1. Open the site in a fresh incognito window
2. Before interacting with the banner, check cookies: DevTools > Application > Cookies
3. Only essential cookies should be present (none from analytics/marketing)
4. Click “Reject All” — verify no tracking cookies are set
5. Clear cookies and reload
6. Click “Accept All” — verify analytics and marketing cookies are now set
7. Find and use the “Cookie Settings” or “Privacy Settings” link
8. Change consent — verify cookies are added/removed accordingly

Exercise: GDPR Compliance Audit #

Perform a GDPR compliance audit of a web application.

Part 1: Cookie Consent #

Part 2: Data Access Request #

Part 3: Right to Erasure #

Part 4: Privacy Controls #

GDPR Testing in CI/CD #

Automate basic compliance checks:

test('no tracking scripts before consent', async ({ page, context }) => {
  // Clear all cookies and storage
  await context.clearCookies();

  await page.goto('/');

  // Before interacting with consent, check for tracking cookies
  const cookies = await context.cookies();
  const trackingCookies = cookies.filter(c =>
    c.name.startsWith('_ga') ||
    c.name.startsWith('_fbp') ||
    c.name.startsWith('_gcl')
  );

  expect(trackingCookies).toHaveLength(0);
});

test('site functions after rejecting cookies', async ({ page }) => {
  await page.goto('/');
  await page.click('[data-testid="reject-all-cookies"]');
  await page.goto('/products');
  await expect(page.locator('h1')).toBeVisible();
});

Key Takeaways #

• GDPR creates specific, testable requirements that QA engineers must verify
• Cookie consent must offer genuine choice — no tracking before consent and equal reject/accept options
• Data Subject Access Requests must return all personal data within 30 days in a machine-readable format
• Right to Erasure must delete data from all systems including third-party integrations
• Test the full data lifecycle: collection, storage, access, modification, export, and deletion
• Automate basic compliance checks in CI/CD to prevent regressions