A supplier has sent you a privacy policy. It describes the information its mobile app collects and says how that information is used. Your review still leaves a practical question unanswered: what evidence would let you rely on those statements for the way your organisation intends to use the app?
For DPOs and information governance teams, the useful next step is to turn each material gap into a specific request. A missing answer should remain visible until someone can resolve it or decide that the proposed use cannot proceed.
Start with a claim you can examine
Take the exact policy wording and record its URL, capture date and scope. Note the app, version, platform and configuration you are assessing. Check whether the statement covers the mobile app, its connected service or the supplier’s website.
Then describe the intended use. Uploading public leaflets raises different questions from processing identifiable case notes. Business context belongs in application risk decisions: the importance of a gap depends on the information and people affected.
This context also changes across sectors. Review the evidence against the actual workflow, whether the app supports an NHS service, a council service or a financial-services business service.
The ICO’s accountability guidance explains that organisations must both comply with the UK GDPR and be able to demonstrate compliance. Keeping a policy is only one part of that evidence. The guidance is currently under review following the Data (Use and Access) Act, so use the ICO’s current wording when applying it.
Separate an unanswered question from an adverse finding
Use three distinct descriptions in your review:
- Supported within the assessed scope: the evidence you have is consistent with the claim.
- Potential conflict: a finding appears inconsistent with the wording and needs investigation.
- Not evidenced: the available material does not establish the answer.
These distinctions prevent an uncertainty from becoming either an automatic pass or an accusation. An overall score should not close an unresolved question about a material data flow.
Be precise about what a technical finding establishes. Identifying a software component raises questions about its role; it does not, by itself, prove which personal information it receives. Equally, a test that did not observe a transfer only describes what happened under the conditions tested.
Ask for evidence that could change the decision
A broad request to “confirm GDPR compliance” often produces another broad assurance. Give the supplier the claim, the gap and the intended use, then ask for something reviewable.
| Question | Evidence to request |
|---|---|
| Which information reaches the analytics service, and when? | A field-level description, the service’s purpose, relevant configuration and a test showing the selected workflow. |
| Does disabling analytics stop collection and transmission? | Documentation of what the setting controls, plus results for both settings in the relevant app version. |
| What happens when an uploaded document is deleted? | Retention and deletion rules covering the active service, backups and any other recipients, with evidence of how those rules operate. |
Agree a response date with a named supplier contact. Ask them to identify exclusions and the versions their answer covers. A document that describes a different edition or a default configuration may not answer your question.
OWASP’s MASVS privacy control on data minimisation calls for apps to limit access to sensitive data and resources. Use that as a technical review prompt: which information is necessary for this function, and what evidence explains any additional access?
Hypothetical example of an unresolved analytics claim
An information governance team is reviewing a fictional mobile document scanner for staff handling case files. Its policy says analytics are used to improve the service. An assessment identifies an analytics component, but the team cannot establish whether document contents, filenames or only usage events reach it.
This is an evidence gap. The team asks for the transmitted fields, destinations and retention periods, along with the behaviour when analytics are disabled. It also asks which settings apply to the organisation’s proposed subscription.
While awaiting answers, the team restricts evaluation to synthetic documents containing no personal data. That creates room to investigate without treating the pilot as permission to upload real case files. If the supplier only repeats the policy statement, the original question remains open.
This fictional scenario illustrates a review method; it is not a MobSTR customer result or an allegation about a real app.
Close the question with a reasoned outcome
Compare the response with the original gap. Record what it establishes, what remains unknown and whether the intended use needs a restriction or further review. Refer significant unresolved concerns to the appropriate privacy, security and service owners.
Keep the supplier response alongside the policy extract and assessment scope in your organisation’s review record. The ICO describes accountability as ongoing: review your measures and update them where necessary.
Put claim-level evidence into the review
InterroPol helps teams examine individual privacy-policy claims alongside available MobSTR technical evidence, with explanations of supported, potentially conflicting and unresolved findings. It gives supplier conversations a clearer starting point; the organisation still needs to judge whether the evidence is sufficient for its use.