Measurement shows data going to a party that the published privacy statement does not mention, or the statement asserts something the traffic contradicts, such as that no personal data is processed or that all recipients are inside the EEA.
Why it is a separate entry
The statement is the one place a person can check what happens to their data. If it is wrong, informed consent is impossible by construction, and every other control rests on nothing.
How it arises
statement not updated when the measurement setup changed
tags added by a team that does not maintain the statement
Not to be confused with
This is not about whether the processing was lawful. It is about the gap between the measurement and the party's own account of it.
How to establish it
Set difference: recipients observed in the capture minus recipients named in the privacy statement of the same date is non-empty. Both sources belong to the party; the researcher only does the arithmetic.
method document-comparisonQoD 97
Requirements on the measurement
use the statement as it stood on the measurement date, from an archive
search the whole statement and any cookie overview, not just the recipients list
What would refute it
by handThe recipient is named elsewhere in the statement or in a linked cookie overview.finding falls
by handThe statement was updated outside the measured window.finding falls
Where this plugs into existing processes
The one question that surfaces itName every party that receives data, then let me check that against the traffic.
In a DPIA, verify this
Compare the measured recipients against the recipients named in the published privacy statement of the same date.
As a procurement clause
Every party receiving personal data is named in the published statement, verified against a capture on delivery.
With a complaint, hand over
A capture of recipients plus the archived statement of that date, and the set difference between them.
Reproduction
METHOD.md · by hand · no dedicated reproduction exists yet; follow the general method and the indicator above
Third parties that can confirm it: wayback, urlscan.io
Legal framing
eu-gdpr-6-1-a
Objections, and the answer
“The statement is generic on purpose.”
Article 13 requires the recipients or categories of recipients. A statement that omits a category entirely is not generic but incomplete.
What this does not establish
harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
unlawfulness; that is for a supervisory authority or a court
intent; a fault is usually a build decision, not a plan
absence: not finding it in one capture is not evidence that it is not there
DPE Catalogue. DPE-2026-0010: Undisclosed recipient. Schema 2.0, entry status active. Retrieved from https://totaledigitalewaarborging.nl/register/DPE-2026-0010
Measurement
When you publish a finding, cite the method version alongside the entry: “DPE-2026-0010, established under DPE Measurement Method 1.0”
Identifiers are permanent and are never
reused. An entry that is deprecated keeps its number and its address, with the reason attached, because
references to it exist elsewhere.