Data Privacy Awareness Checker
A data privacy awareness checker tests handling decisions through scenarios rather than definitions: a customer asks to delete their data, marketing wants to buy an email list, a password appears in a URL. You choose a response and learn why it is right or wrong, which sticks better than memorising a policy.
Last reviewed by the Radiatus Cloud team
Question 1 of 5
Is it acceptable to store customer credit card numbers in a shared Excel spreadsheet?
Need this done properly for your business?
Radiatus delivers secure cloud, DevOps & compliance engineering.
How it works
Each scenario describes a realistic situation involving personal data and offers a few responses. Pick one and the tool tells you whether it was correct and explains the reasoning, then moves to the next. It is short and self-paced, aimed at building the instinct to pause on a privacy decision rather than at covering every clause of a regulation.
The kinds of decisions it covers
- A deletion request: verify identity before acting, because deletion requests are themselves an attack vector if anyone can trigger them.
- Buying a marketing list: usually unlawful, because you lack the consent to contact those people under GDPR and similar laws.
- Credentials in a URL: report it, because query strings are logged in cleartext by proxies, servers and browser history.
- Storing sensitive data in shared spreadsheets, over-collecting data, and sharing data with third parties without a basis.
Why scenario-based training works
People forget policy documents but remember decisions they got wrong. A quiz that puts you in the moment, marketing is pushing to buy a list and it looks like easy leads, teaches the reflex to check consent better than a paragraph in a handbook. The explanations tie each answer back to the underlying principle, so the lesson transfers to situations the quiz did not cover.
Scope
It is awareness training, not legal advice or a compliance record. The scenarios illustrate common principles, purpose limitation, lawful basis, data minimisation, identity verification, but your obligations depend on your jurisdiction and role. Use it to raise everyday awareness across a team, and back it with real policy and, where needed, a privacy professional.
Related tools
- Cyber Risk Scenario Trainer — Work through eight security incident scenarios, choose the best response from shuffled options, and get an explanation of why the alternatives are worse. Containment-first decision practice.
- Social Engineering Quiz — A new tool extracted from the codebase.
- GDPR Checklist — Interactive checklist to track your GDPR compliance progress.
- PII Classification Assistant — A new tool extracted from the codebase.
Frequently Asked Questions
Why must I verify identity before honouring a deletion request?
Because the request itself can be an attack. If anyone can trigger deletion of someone else's data by asking, an attacker can erase a victim's account or records. Verifying identity first is required to prevent unauthorised deletion.
Is buying an email list allowed?
Usually not. Under GDPR and similar laws you need a lawful basis, typically consent, to contact people, and a purchased list does not carry consent for you to email them. The quiz flags this as the wrong choice for that reason.
Why is a password in a URL a problem?
Query strings are logged in cleartext by web servers, proxies and browser history, and are sent in the Referer header to other sites. Any secret in a URL is effectively exposed, so it should be reported and the design changed.
Is this a compliance certificate?
No. It is awareness training to build good instincts across a team. It is not legal advice and does not record compliance. Pair it with your real policies and, for specific obligations, a privacy professional.
Who is it for?
Anyone who handles personal data as part of their work, not just privacy specialists. The scenarios cover everyday decisions that support, sales, marketing and engineering staff face, where the wrong reflex causes most privacy incidents.
Privacy & Security
Testing done locally.
About This Tool
This tool runs entirely in your browser. No data is sent to any server, ensuring complete privacy. Simply use the interface above to get started — no registration or login required.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.
Related Tools
Cyber Risk Scenario Trainer
EducationWork through eight security incident scenarios, choose the best response from shuffled options, and get an explanation of why the alternatives are worse. Containment-first decision practice.
Social Engineering Quiz
UtilityA new tool extracted from the codebase.
GDPR Checklist
ComplianceInteractive checklist to track your GDPR compliance progress.