Privado
Open-source static code scanner that finds personal data flows in Java/Python code and auto-generates GDPR/CCPA compliance reports.
🔗 Visit Privado
Description
If your company handles personal data — names, emails, payment info — proving to regulators (or to your own legal team) exactly where that data flows through your codebase is normally a slow, manual audit. Privado automates that by scanning your source code directly and mapping out every place personal data enters, moves through, and exits your application, without ever sending your code anywhere.
Privado is an open-source static code analysis (SAST-style) tool that discovers data flows and identifies over 110 categories of personal data elements in source code. It builds a knowledge graph of the codebase during scanning, runs entirely locally or inside CI/CD pipelines (code never leaves the machine), and outputs findings as JSON. Beyond flagging data security risks, it generates ready-made compliance reports — GDPR, CCPA, and Google Play Store Data Safety Reports — directly from what it finds in the code. Java and Python support is generally available, with JavaScript/TypeScript support planned. It's licensed under GNU LGPLv3.
💬 Our review
The short version: Privado is a strong pick if you need to demonstrate GDPR/CCPA compliance or fill out a Play Store Data Safety form and want the answer generated from your actual code rather than a manually maintained spreadsheet — and it costs nothing to try since it's fully open-source.
Compared to commercial data-mapping/privacy-compliance platforms like OneTrust or Osano, which typically run into the tens of thousands of dollars a year and rely heavily on questionnaires and manual data inventories, Privado's code-level, automated approach is both cheaper (free) and arguably more accurate for the specific question of 'where does personal data flow in this codebase.' It won't replace a full privacy program — those commercial tools also handle consent management, vendor risk, and DSAR workflows that Privado doesn't touch — and with 653 GitHub stars and language support currently limited to Java and Python, it's best suited to backend-heavy teams rather than full-stack privacy coverage today. For an engineering team that wants a fast, free, local-first way to find personal data in code and auto-generate a first-draft compliance report, Privado is a solid choice; teams needing a full privacy-ops suite should look at a dedicated commercial platform instead.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Gratuit, open-source, sans palier payant
Pros
Gratuit et open-source
Scan 100% local, code jamais transmis
Rapports GDPR/CCPA/Play Store auto-générés
110+ types de données personnelles détectés
Cons
Java/Python uniquement en GA
Pas de gestion du consentement ni DSAR
Nécessite intégration CI/CD