02 — Case study · Automation + data workflows
Personal Data Discovery & Privacy Testing Platform
An automated privacy testing workflow that turns network traffic into structured privacy assessment outputs.
Python · Flet · Pandas · Excel Automation · HAR · Charles Proxy
Before · manual
~16 hrs
After · automated
<2 min
Requests
- GET /api/profile
- POST /consent
- GET /static/app.js
Parameters
- email · sha256
- device_id · plain
- session · cookie
RoPA mapping
- email → Art.30 ✓
- device_id → review
- session → Art.30 ✓
Illustrative representation based on the real system — not a production screenshot.
Manual baseline
~16 hours
Automated
under 2 minutes
01Overview
An automated privacy testing workflow that turns captured network traffic into structured assessment outputs. Capture once — the pipeline extracts parameters, discovers personal data, maps it against RoPA records and generates the report. Built to replace a slow manual pass with a repeatable automated one.
02The Problem
Testing meant capturing traffic by hand, combing through parameters, cookies and headers, comparing findings against RoPA records and assembling reports in spreadsheets. A single pass could take roughly sixteen hours of specialist time — and every step depended on manual diligence, so results varied and nothing was reusable.
03What I Built
Built a workflow that captures traffic, generates HAR and network artifacts, extracts parameters and maps discovered data elements against RoPA records. Implemented privacy validation, assessment reporting and automated RoPA updates — from proxy capture through a desktop UI to finished workbooks.
- Capture
- Network traffic capture with HAR / network-log generation.
- Extract
- Parameters, cookies, headers and request/response details.
- Discover
- Personal-data discovery across extracted elements.
- Map & validate
- RoPA mapping, privacy validation, assessment reporting.
- Close the loop
- Automated RoPA updates so findings can be carried forward without manual spreadsheet updates.
04How It Works
- 01Website
- 02Traffic Capture
- 03HAR / Network Logs
- 04Parameter Extraction
- 05Personal Data Discovery
- 06RoPA Mapping
- 07Validation
- 08Assessment Reporting
05Architecture
Capture at the proxy layer, analyse in Python, deliver through a desktop app and workbooks assessors already use.
06Impact
Before
~16-hour manual pass across collection, review and RoPA comparison.
After
Under 2 minutes, automated.
Delivery shifted from a 5–6 member activity to a single-resource, automation-enabled model.
07Technology
Python · Flet · Pandas · Excel Automation · HAR · Charles Proxy
Flet for a portable UI assessors run themselves; Pandas for fast analysis over thousands of requests; Excel automation so outputs land where compliance workflows already live.
08Engineering Notes
- The biggest win came from removing handoffs — one artifact from capture to report, not five tools stitched by email.
- Extraction has to be paranoid: encoded payloads, nested JSON and duplicate keys all hide personal data.
- Meeting assessors where they are (Excel) mattered as much as the automation itself.