GDPR mapping
This page maps the GDPR articles a scanner can evidence onto the vulkro-sf checks for a Salesforce deployment that processes EU residents' personal data.
vulkro-sf compliance report --framework gdpr ./force-app
vulkro-sf compliance ropa ./force-app -o ropa.md
ropa seeds an Article 30 Record of Processing Activities from the personal data the scan found. Exit code 1 means at least one activity carries an open risk. For web app, API, cookie and consent evidence, see the general GDPR page.
Articles covered
| Article | Title | Checks that feed it |
|---|---|---|
| Art. 5(1)(c) | Data minimisation | pii-map (sensitive fields per object), apex (sensitive fields returned without a CRUD/FLS check) |
| Art. 5(1)(f) | Integrity and confidentiality | security-settings (requireHttps, password policy), profiles-permsets (over-privilege), apex (crypto misuse) |
| Art. 25 | Data protection by design and by default | apex (CRUD/FLS on read and write paths: WITH SECURITY_ENFORCED, isAccessible(), Security.stripInaccessible) |
| Art. 30 | Records of Processing Activities | pii-map (categories of personal data), connected-apps (third-party recipients and scopes) |
| Art. 32 | Security of Processing | The full scan |
| Art. 33 | Breach notification preparation | antipatterns AP-007 (Apex class with no test), plus audit-trail checks (see HIPAA 164.312(b)) |
| Art. 35 | Data Protection Impact Assessment | AgentExchange Security Review readiness report (input for the DPIA technical-risk section) |
vulkro-sf antipatterns AP-049 flags personal-data writes so you can confirm your erasure process covers them.
Cross-border transfers
The Connected Apps check lists each app with its publisher, OAuth scopes and callback host. Named Credentials list outbound callout URLs. Together they are the recipient list a transfer record needs. The legal classification (country, transfer mechanism, processor or controller) is yours. vulkro-sf compliance baa-verify flags integrations with no recorded DPA.
Not covered
Lawful basis (Art. 6), consent (Art. 7), data subject rights (Art. 12 to 22), notices (Art. 13 and 14), processor contracts (Art. 28), DPO duties (Art. 37 to 39) and retention policy need legal and process work. A scanner does not produce them.
See also: Compliance overview, Compliance mapping