Personal data sent to an analytics or tracking tool
Gaphigh severity · reads .ts .tsx .js .jsx .mjs .cjs .pyBeta
Analytics vendors keep what you send them. Personal data there needs a lawful basis and a processing agreement. When Lintsure finds this, it marks it as a Gap: the code itself shows the problem.
What it looks like
A line Lintsure flags in its own test app:
// src/more.ts
posthog.identify(user.id, { email: user.email });How to fix it
Send an internal user ID instead of the email or name, and list the tool as a processor.
Through a coding agent, Lintsure suggests the change and waits. Nothing is edited until you approve it.
Controls it relates to
- GDPRArt. 5(1)(c)Data minimisation
- GDPRArt. 28Processors
- SOC 2P6.1Disclosure to third parties
- ISO 27001A.5.34Privacy and protection of PII
What the framework asks
GDPR Art. 5: Core principles
Use data fairly and openly, only for clear purposes, collect the minimum, keep it accurate, don't keep it longer than needed, and keep it secure.
Evidence a reviewer may ask for: A retention schedule and a note on why each field is collected.
GDPR Art. 25: Privacy by design and default
Build privacy in from the start, and make the most private setting the default.
Evidence a reviewer may ask for: Design notes showing privacy choices.
GDPR Art. 28: Processors
Vendors that handle personal data for you need a contract with specific data protection terms.
Evidence a reviewer may ask for: Signed processing agreements with each vendor.
SOC 2 P-series: Privacy criteria (optional)
If privacy is in scope: notice, choice, collection limits, use, retention, disclosure and quality of personal data.
Evidence a reviewer may ask for: Privacy notice and data flow records.
ISO 27001 A.5.34: Privacy and protection of personal data
Meet the privacy laws and contracts that apply to personal data you hold.
Evidence a reviewer may ask for: Privacy compliance records.
Summaries are our own reading of the public texts, not the official wording.
Read more: How to keep personal data out of your logs
Check your code for this
Runs on your machine. Your code is never uploaded.
npx lintsure scanThis rule is in Beta: its mapping to framework controls is waiting for review by a qualified compliance professional. Lintsure is a readiness tool, not an audit or legal advice. A finding, or the lack of one, doesn't make you compliant. Disclaimer