Privacy compliance audit: tracking, notices and consent.

What is a GDPR audit?

A GDPR audit reviews how an organization's personal-data practices align with the GDPR requirements counsel identifies as applicable. Within diligence, a privacy compliance audit records public tracking, notices and consent journeys, then requests authorized evidence of the underlying data flows and operating controls.

A privacy compliance audit is a scoped review of privacy practices and supporting evidence, with legal conclusions and applicability questions referred to counsel.

The compliance due diligence hub places privacy alongside accessibility and consent. Meo records observations and evidence gaps; a public policy page or consent banner cannot establish compliance. Not legal advice.

Is GDPR compliance mandatory in the USA?

A US location does not by itself decide whether the GDPR applies. Its scope can reach organizations outside the EU when relevant activities involve offering goods or services to people in the EU or monitoring their behavior there. Counsel should assess the target's establishments, activities and data flows.

The official guidance on GDPR application explains the territorial scope. Record where the target operates, whom the service addresses and which tracking activities occur; route the applicability conclusion to counsel.

Does the USA have a GDPR equivalent?

For a US target, diligence should map the applicable state and sector privacy requirements rather than assume a direct GDPR equivalent. California's CCPA is a separate privacy framework with its own scope and obligations. Counsel should determine which requirements apply to the target and the information it handles.

The official CCPA guidance describes covered businesses and consumer rights. Ask counsel to identify applicable rules before converting a public observation into a compliance finding.

Is GDPR more strict than HIPAA?

GDPR and HIPAA have different scopes, protected information and obligations, so a simple strictness ranking is not a useful diligence conclusion. HIPAA applies to covered entities and business associates; GDPR applicability follows a different scope analysis. Counsel should assess each framework against the actual workflow.

The official HIPAA scope guidance explains covered entities and business associates. A HIPAA risk assessment needs authorized access and appropriate arrangements for sensitive information; it cannot be replaced by a public website review.

Are tracking tags on sensitive pages a privacy risk?

Tracking tags on sensitive pages are a privacy review question because the data sent, destination and purpose may differ from what a visitor expects or a notice describes. A tag's presence alone does not establish a violation. Verify its behavior within an authorized scope and send legal questions to counsel.

The grid is illustrative, not a finding about a target. The tech stack and technical debt assessment maps visible dependencies; the AI due diligence guide requests evidence for data use and model dependencies where an AI capability is claimed.

How does the privacy audit follow the evidence?

The privacy audit starts with agreed pages, journeys and data questions, then separates public observations from internal evidence requests. It records the source of each finding, identifies missing records and assigns legal questions to counsel before agreeing remediation work.

1. Agree the entities, customer journeys, data categories and counsel contacts in scope.
2. Record public notices, consent choices and visible tracking behavior with their observation dates.
3. Request authorized tag configuration, data-flow records, vendor agreements, consent records and handling procedures.
4. Ask counsel to determine applicable obligations and assess potential legal issues.
5. Assign agreed changes to owners with evidence that will confirm the fix.

Use the private equity due diligence checklist to carry unresolved access requests into the wider review. The TCPA compliance audit follows consent into calling, texting and opt-out records, with legal questions sent to counsel. Avoid collecting sensitive customer information simply to demonstrate a concern.

What does the privacy compliance audit deliver?

The audit delivers a dated evidence register, open questions and proposed remediation work with owners and counsel flags. It keeps a public observation separate from a verified internal practice and identifies which legal decisions require counsel before the sponsor accepts the plan.

See the sample diligence deliverables for the evidence and register format. The post-merger IT integration plan can carry agreed data and vendor dependencies into post-close work. Not legal advice; legal questions go to counsel.