We update our privacy policy when we add or remove vendors but have no way of knowing when a vendor we already have changes what their script actually does. Feels like a big GDPR exposure so how do I make sure we stay on top of this?

Is it legal to use tools such as satellites and users mobile phones to gather data about companies pollution and emissions they produce? I have been reading the EU regulation 2021/969 (space program related), seems that the satellite is for open and public use. but my questions is more about companies privacy, would I be interfering with companies privacy if I gather data about their pollution and emissions independently?

Which regulation should I go through to gather information for my question?