Skip to content

Phone Number Data Type Declaration Mismatch

Phone Number Data Type Declaration Mismatch

Description

It has been identified that the Phone Number data type declaration in your privacy policy does not accurately match the actual usage of phone numbers within your system, potentially exposing user phone numbers to unauthorized access or misuse.

Recommendation

To mitigate the vulnerability of mismatched data type declarations in the privacy policy for phone numbers, it is important to regularly review and update the policy to ensure that it accurately reflects how phone numbers are being used and stored. This includes verifying that the data type declaration for phone numbers aligns with the actual practices and systems in place for handling this sensitive information. Additionally, implementing regular audits and training for staff on data privacy best practices can help to prevent any discrepancies between policy and practice.

Standards

  • OWASP_MASVS_L1:
  • OWASP_MASVS_L2:
  • OWASP_MASVS_RESILIENCE:
  • CWE_TOP_25:
  • GDPR:
    • ART_5
    • ART_6
    • ART_7
    • ART_9
    • ART_11
    • ART_13
    • ART_15
    • ART_16
    • ART_17
    • ART_32
  • CCPA:
    • CCPA_1798_100
    • CCPA_1798_105
    • CCPA_1798_110
    • CCPA_1798_115
    • CCPA_1798_120
    • CCPA_1798_125
    • CCPA_1798_130
    • CCPA_1798_135
    • CCPA_1798_140
    • CCPA_1798_150
  • PCI_STANDARDS:
  • OWASP_MASVS_v2_1:
    • MASVS_PRIVACY_1
    • MASVS_PRIVACY_2
    • MASVS_PRIVACY_3
    • MASVS_PRIVACY_4
  • OWASP_ASVS_L1:
  • OWASP_ASVS_L2:
  • OWASP_ASVS_L3:
  • SOC2_CONTROLS:
    • CC_2_3
    • CC_5_3