GDPR's Article 32 is a risk-based security obligation, not a fixed technical checklist — and among the measures it lists, as appropriate to the risk, is a process for regularly testing, assessing and evaluating their effectiveness. Here's what the article actually says, and how Vooki Pro's scans and reports support that testing duty for web applications and APIs.
Controllers and processors must implement "appropriate technical and organisational measures to ensure a level of security appropriate to the risk," judged against the state of the art, implementation cost, and the nature, scope, context and purposes of the processing. This is risk-based by design, not a prescriptive standard.
Lists, among the measures to implement as appropriate to the risk, "a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing." The article text itself does not name penetration testing, vulnerability scanning, or any specific method or cadence — those are implementation choices.
Summary of GDPR (Regulation (EU) 2016/679) Article 32. The regulation sets the testing duty; linking it to vulnerability scanning and penetration testing is common security practice, not wording from Article 32 itself.
Scheduled, recurring scans can support the "regularly testing" process described in 32(1)(d) for your web applications and APIs — a repeatable, dated scan history is better evidence of an ongoing process than a one-off scan. Findings and retest results document what was tested, what was found, and what the detector found when each fix was retested.
Article 32 covers the security of processing broadly — encryption, pseudonymisation, resilience, and the ability to restore availability after an incident, alongside the testing duty. A DAST scan can support the regular-testing measure for your web/API layer specifically; it says nothing about your encryption-at-rest posture or disaster-recovery capability.
Exporting a scan as a GDPR-mapped report (HTML or PDF, via the Export menu or the CLI's compliance_framework: gdpr config) applies Vooki Pro's own reference mapping, not an official GDPR control mapping. Findings are mapped mainly to Article 32 (security of processing), with some to Article 25 (data protection by design and by default) and Article 5(1)(f) (integrity and confidentiality). The report also lists Article 33 (personal data breach notification) and Article 35 (data protection impact assessment), but no finding is mapped to them — a vulnerability finding does not by itself establish a personal data breach, trigger an Article 33 notification, or complete a DPIA. It is useful as part of the evidence for the regular-testing measure.
See the scheduling docs for recurring scans · or browse other frameworks
EUR-Lex — Regulation (EU) 2016/679 (GDPR), official text
Vooki Pro documentation: Reports & Compliance · Scheduled Scans · CLI & CI/CD
Last reviewed 23 October 2026.
No credit card required — submit a trial request; the team reviews it, then sends your trial license and installation instructions.