Block bulk external exports of personal data

Covers: GDPR / UK GDPR, art. 32 (security of processing)

Use in VulnifyOpens in monitor mode by default. Nothing is created until you click Apply.

What it does

Blocks exports of more than 1,000 records from resources you classify as customer personal data (CUSTOMER_PII) sent to an external destination. Vulnify’s risk engine may also return REVIEW or BLOCK for bulk personal-data exports on its own, even without this policy (for example, large internal exports), so not every REVIEW or BLOCK on these exports comes from this template.

Notes

Matching depends mainly on the resource labels you apply in Vulnify, plus optional content checks for some common identifiers (such as CPF numbers or email addresses); it is not a reliable detector of personal data. Test in monitor mode first.

Default mode in this template: ENFORCE. The “Use in Vulnify” link preselects monitor mode; you can switch to enforce before applying.

Policy

Policy JSON (API)

{
  "name": "gdpr-block-bulk-personal-data-export",
  "description": "Blocks exports of more than 1,000 records from resources you classify as customer personal data (CUSTOMER_PII) sent to an external destination. Vulnify’s risk engine may also return REVIEW or BLOCK for bulk personal-data exports on its own, even without this policy (for example, large internal exports), so not every REVIEW or BLOCK on these exports comes from this template.",
  "enabled": true,
  "action": "EXPORT",
  "resource": "CUSTOMER_PII",
  "condition": {
    "allOf": [
      {
        "destination": "EXTERNAL"
      },
      {
        "minRecords": 1001
      }
    ]
  },
  "decision": "BLOCK",
  "mode": "ENFORCE"
}

Policy YAML (CLI policy file)

apiVersion: vulnify.io/v1
kind: Policy
metadata:
  name: gdpr-block-bulk-personal-data-export
spec:
  description: "Blocks exports of more than 1,000 records from resources you classify as customer personal data (CUSTOMER_PII) sent to an external destination. Vulnify’s risk engine may also return REVIEW or BLOCK for bulk personal-data exports on its own, even without this policy (for example, large internal exports), so not every REVIEW or BLOCK on these exports comes from this template."
  enabled: true
  action: EXPORT
  resource: CUSTOMER_PII
  condition:
    allOf:
      - destination: EXTERNAL
      - minRecords: 1001
  decision: BLOCK
  mode: ENFORCE

Example test cases

Case	Input	Expected decision
bulk export to external email	`{"agent":"example-agent","action":"EXPORT_DATA","resource":"customers-db","destination":"EXTERNAL_EMAIL","recordsAffected":2500}`	BLOCK

Try this template on your own agents, in monitor mode first.

Use in Vulnify

Not legal advice. These templates are starting points to help you design internal controls for AI agents. They are not legal advice and do not make your organization compliant with LGPD, GDPR, HIPAA or any other law or regulation. Review them with your own legal and compliance team before relying on them. Templates are provided “as is”, without warranty. Whether a rule matches depends on how you classify your resources and on the data your agents send; test in monitor mode before enforcing.

License: the templates are dedicated to the public domain under CC0 1.0. “Vulnify” is a trademark; the CC0 dedication does not cover the Vulnify name or logo.