How to use this toolkit
Run the audit per product, business unit, or data pipeline. A useful scope is “one user data source from collection through every downstream use.” For each source, collect screenshots, policy versions, CMP exports, contract clauses, database fields, vendor records, and deletion/withdrawal logs. Then score the source, map lawful bases, and convert the highest-risk gaps into remediation tasks.
90 minutesMinimum time to assess one simple first-party consent flow.
4 evidence typesNotice, affirmative choice or opt-out, processing record, and withdrawal/rights handling.
≤69Score that should trigger immediate remediation before adding new processing purposes.
30/60/90Recommended cadence for high, medium, and lower-risk remediation actions.
Audit sequence
- Inventory the source. Name the system, collection point, data categories, subjects, geography, vendor role, and downstream uses.
- Capture the consent chain. Save proof of notice text, consent or opt-out UI, timestamps, preference changes, vendor handoffs, and deletion/retention rules.
- Map legal basis. For each processing purpose, document the GDPR Article 6 basis, any Article 9 condition, and whether CCPA sale/share, targeted advertising, or sensitive-personal-information rules apply.
- Score the source. Use the weighted scorecard. Any red item with no evidence is treated as a gap even if the total score is acceptable.
- Prioritize remediation. Address high-risk gaps first: no lawful basis, bundled consent, missing opt-out, vendor resale ambiguity, children’s data, sensitive data, and inability to honor withdrawal.
Consent-chain audit checklist
Use this checklist to verify whether each source has a defensible consent/provenance chain. Mark each item as Pass, Partial, Fail, or N/A, and attach evidence. “We believe” is not evidence; use dated artifacts.
Scroll the table sideways to see every column.
| Audit area | Control test | Evidence to attach | Status |
|---|---|---|---|
| Purpose clarity | Every collection purpose is specific, understandable, and separated from unrelated purposes. | Privacy notice section; CMP text; form screenshots; version date. | ☐ Pass ☐ Partial ☐ Fail |
| Affirmative consent quality | Where consent is the basis, it is freely given, specific, informed, unambiguous, and not pre-ticked or bundled with terms. | Consent UI; default-state screenshot; consent log schema; A/B variants. | ☐ Pass ☐ Partial ☐ Fail |
| Granularity | Marketing, analytics, profiling, data sharing, AI/model training, and sensitive data uses can be accepted or rejected independently when legally required. | Preference center export; category taxonomy; purpose IDs. | ☐ Pass ☐ Partial ☐ Fail |
| Lawful-basis fit | The chosen basis is appropriate before processing starts; the organization is not switching bases after the fact to rescue a weak consent flow. | RoPA entry; DPIA/LIA; legal-basis memo; approval date. | ☐ Pass ☐ Partial ☐ Fail |
| CCPA sale/share handling | Sale/share and cross-context behavioral advertising uses have clear opt-out paths and honor Global Privacy Control where applicable. | Do Not Sell/Share link; GPC test; consent-platform configuration. | ☐ Pass ☐ Partial ☐ Fail |
| Sensitive data controls | Sensitive personal information or GDPR special-category data is minimized, specially justified, and limited to disclosed purposes. | Data dictionary; Article 9 condition; “limit use” handling; access controls. | ☐ Pass ☐ Partial ☐ Fail |
| Vendor chain | Every processor, service provider, contractor, third party, broker, enrichment provider, or model vendor is classified with permitted uses and onward-transfer limits. | DPA/MSA; vendor inventory; subprocessor list; data-flow diagram. | ☐ Pass ☐ Partial ☐ Fail |
| Withdrawal and opt-out | Withdrawal is as easy as consent, preference changes are propagated downstream, and suppression is logged. | Preference-center flow; suppression queue; webhook logs; SLA. | ☐ Pass ☐ Partial ☐ Fail |
| Retention and deletion | Retention periods match disclosed purposes, deletion is technically enforceable, and vendor copies are included. | Retention schedule; deletion job logs; backup policy; vendor deletion attestations. | ☐ Pass ☐ Partial ☐ Fail |
| Proof bundle | The company can reproduce the notice, user choice, purpose, data categories, vendor path, and revocation state for a named record. | Record-level audit export; consent ledger; immutable event log. | ☐ Pass ☐ Partial ☐ Fail |
Data-source consent scorecard
Score each source from 0 to 100. Use 0 when evidence is missing. A source is not “green” if it has any critical fail in lawful basis, sensitive data, child data, sale/share opt-out, or vendor resale restrictions.
Scroll the table sideways to see every column.
| Dimension | Weight | Green standard | Score |
|---|---|---|---|
| Collection notice and purpose specificity | 15 | Specific purposes, readable language, current notice version, no hidden secondary use. | __/15 |
| Consent or opt-out mechanism quality | 15 | Unbundled consent where required; clear opt-out for sale/share; GPC honored when applicable. | __/15 |
| Lawful-basis documentation | 15 | Purpose-level GDPR basis, necessity test, LIA/DPIA where appropriate, and no retroactive basis switching. | __/15 |
| Consent evidence and auditability | 15 | Record-level timestamp, UI/version, source, user state, jurisdiction, and change history. | __/15 |
| Vendor and onward-transfer controls | 15 | Role classification, contractual purpose limits, subprocessor visibility, resale/share prohibitions. | __/15 |
| Withdrawal, rights, and suppression | 10 | Withdrawal/opt-out propagates downstream promptly and is visible in operational systems. | __/10 |
| Retention, minimization, and deletion | 10 | Retention tied to purpose, data minimized, deletion technically verified across internal and vendor stores. | __/10 |
| Sensitive, child, and high-risk processing | 5 | Extra conditions, opt-in where required, age/guardian handling, and enhanced access controls. | __/5 |
Scroll the table sideways to see every column.
| Total score | Decision | Required action |
|---|---|---|
| 85–100 | Operationally defensible | Keep evidence current; retest after product, vendor, or policy changes. |
| 70–84 | Usable with monitored gaps | Fix medium gaps within 60 days; do not expand processing until critical controls pass. |
| 0–69 | High exposure | Pause new collection/use for the affected purpose until lawful basis, opt-out, or evidence gaps are resolved. |
Lawful-basis mapping template
Map legal basis at the purpose level, not at the product level. The same dataset may use contract for account administration, consent for marketing emails, legitimate interests for limited fraud prevention, and legal obligation for tax retention. If the purpose changes, rerun the mapping before processing.
Scroll the table sideways to see every column.
| Field | What to enter | Quality bar |
|---|---|---|
| Data source / system | Exact collection point, vendor, import, enrichment source, or database. | Named enough that engineering can find it. |
| Personal data categories | Identifiers, contact data, device data, behavioral data, sensitive data, inferred traits, etc. | Matches data dictionary and event schema. |
| Processing purpose | One concrete use, e.g. “send weekly product newsletter,” not “marketing.” | Specific, current, and disclosed. |
| GDPR Article 6 basis | Consent, contract, legal obligation, vital interests, public task, legitimate interests, or recognized legitimate interest where applicable. | Chosen before processing; necessity documented. |
| Article 9 / sensitive condition | If special-category data is involved, add the separate condition or “N/A.” | Separate from Article 6 basis. |
| CCPA/CPRA treatment | Sale/share? targeted advertising? sensitive personal information? service provider or third party? | Opt-out/limit-use handling documented. |
| Notice and user choice | Policy section, CMP purpose ID, form copy, opt-out link, preference center path. | Includes version/date and screenshot. |
| Recipient/vendor chain | Internal teams and external recipients, including onward-transfer restrictions. | Contracts support the stated purpose. |
| Retention and deletion | Retention period, deletion trigger, backup handling, vendor deletion process. | Technically enforceable and tested. |
| Owner and review date | Named business owner, legal reviewer, and next review date. | Review after every material change. |
Common basis-selection errors to flag
- Consent used as a catch-all. Consent is fragile when refusal has negative consequences, purposes are bundled, or withdrawal cannot be honored.
- Contract stretched too far. Contract applies only when processing is necessary to provide the requested service or pre-contract steps for that individual.
- Legitimate interests without balancing. Document purpose, necessity, reasonable expectations, safeguards, and opt-out where relevant.
- CCPA opt-out treated like GDPR consent. CCPA often centers on disclosure, consumer rights, opt-out of sale/share, sensitive-data limits, and contracts with service providers/contractors.
- Vendor purpose drift. A vendor classified as a service provider or processor cannot quietly reuse data for its own incompatible purposes.
Prioritized remediation action list
Convert every failed or partial control into a remediation ticket. Use the table below to decide urgency. “High” means the organization should stop expanding or monetizing the affected data use until the control is fixed or counsel accepts the risk in writing.
Scroll the table sideways to see every column.
| Priority | Trigger | Owner | Completion criteria |
|---|---|---|---|
| High — 0–30 days | No documented Article 6 basis; missing CCPA sale/share opt-out; sensitive data without special controls; child data without age/guardian logic; vendor resale ambiguity; withdrawal cannot propagate. | Legal + product + data engineering | Processing paused or limited; lawful-basis memo approved; UI/control shipped; evidence captured; vendor contract amended or vendor disabled. |
| High — 0–30 days | Consent records do not include source, timestamp, purpose, notice version, jurisdiction, or revocation state. | Engineering + data governance | Consent ledger or event schema stores required proof fields; historical gaps labeled; exports tested. |
| Medium — 31–60 days | Notice language is vague; preference center categories are too broad; retention rules are policy-only but not enforceable. | Legal + product ops | Updated notice/purpose taxonomy live; retention jobs scheduled; screenshots archived. |
| Medium — 31–60 days | Vendor inventory is incomplete or subprocessor list is stale. | Procurement + security | Vendor roles classified; DPAs updated; subprocessor review cadence established. |
| Lower — 61–90 days | Evidence exists but is scattered across tickets, screenshots, CMS versions, contracts, and analytics tools. | Data governance | Single proof bundle per source; source owner assigned; quarterly review reminders created. |
| Lower — 61–90 days | Controls pass but lack automated monitoring. | Engineering | Automated checks for CMP changes, vendor exports, deletion job failures, and opt-out propagation alerts. |
Executive summary template
Use this one-page format to brief leadership after the self-audit.
Scroll the table sideways to see every column.
| Question | Answer |
|---|---|
| Scope reviewed | Systems, data sources, geography, data-subject groups, and business purposes included. |
| Overall rating | Green / Amber / Red, with total score and any critical fails. |
| Top three risks | Risk, affected source, regulatory/customer impact, and immediate action. |
| Controls already working | Strong consent evidence, preference center, vendor restrictions, deletion, or audit export capabilities. |
| 30-day plan | High-risk remediation tasks with owners and acceptance criteria. |
| Decision needed | Budget, product trade-off, vendor replacement, legal review, or data-use pause. |
Reference notes
This toolkit is aligned with publicly available regulatory guidance and official legal texts as of July 2026. Confirm local applicability with counsel before relying on it for a formal opinion.
- EDPB Guidelines 05/2020 on consent under Regulation 2016/679.
- GDPR Articles 4(11), 6, 7, 9, 13–14, 17, 21, 30, and 32.
- ICO lawful-basis guidance, including consent, contract, legitimate interests, and legal obligation guidance.
- California Consumer Privacy Act / CPRA resources from the California Attorney General and California Privacy Protection Agency, including opt-out, sensitive-personal-information, and Global Privacy Control guidance.