Data Privacy Compliance
Anweshna reads privacy policies, breach notifications, and data-processing agreements for the specific compliance gaps regulators actually act on.
What it screens for
- DPA enforcement notices — the penalty amount and the issuing authority.
- Data breach exposure — the record count involved and whether notification obligations were met.
- Missing DPIAs — a named high-risk processing activity with no data protection impact assessment on file.
- Cross-border transfer gaps — transfers made without SCCs or an adequacy decision, and the destination country involved.
- Consent and DPO gaps — consent mechanisms that don't cover the affected user base, and a legally required DPO that was never appointed.
Why it's tracked as its own category
Data Privacy carries a 1% weight in the M&A ruleset — the Banking ruleset instead folds it into a combined Cybersecurity & Data Privacy category, since banking regulators tend to treat breach notification and data protection together. On its own here, Data Privacy stays non-blocking, but a live enforcement notice or an unreported breach is exactly the kind of finding that needs its own line rather than being absorbed into a general compliance narrative.
Data Privacy Compliance FAQ
What does Anweshna screen for in Data Privacy Compliance?
Anweshna screens deal documents for DPA enforcement notices, data breach exposure, and missing DPIAs, among other signals. See the full list of signals above.
Is Data Privacy Compliance a blocking risk category?
Data Privacy Compliance carries a 1% weight in Anweshna's composite score. It is a tracked, non-blocking category — it contributes to the overall risk posture but does not independently halt a deal.