Tracking pixels fire before users say yes
Why it mattersSharing data with ad tools without consent is a top enforcement target in Europe and the US.
The fixSet up your consent tool properly and respect browser privacy signals.
02
For startups handling personal data
Data protection audit. Handle customer data the right way.
I follow your users’ data through your product, tools and team, check it against the privacy laws in your markets, and show you exactly what to fix.
The short version
- What it is
- A check of how your product, tools and team handle personal data, against the privacy laws in your markets.
- Made for
- Any startup that collects user or customer data, especially before big deals.
- You get
- A data map, a ranked fix-list, document redlines and a readout call.
- Takes
- Typically 3–6 weeks, for a fixed fee.
Is this for you?
If any of these
sound familiar, yes.
Two or more? Then this audit will likely pay for itself in the next deal.
- 01A customer’s security review asks for documents you don’t have.
- 02You are launching in Europe, the UK, the US or India with a privacy policy written for one country.
- 03You added AI features that use customer data.
- 04Your privacy policy came from a template and nobody checked it against the product.
- 05You handle health, financial, location, biometric or children’s data.
- 06A user request, complaint or data leak showed your process doesn’t really work.
What I check
Six things I check.
In plain English.
Open any one to see what I look at and what I’ll ask you for. You don’t need to prepare any of it in advance.
01Map your data
I follow your users’ data from sign-up to deletion: product, analytics, support, sales and HR tools.
What I look at
- What personal data do you collect, and from whom?
- Where is it stored, in which countries, and for how long?
- Which tracking tools, pixels and SDKs collect data for you?
- Do you hold sensitive data, children’s data or precise location?
What I’ll ask you for
- Product flows and database structure
- The tracking tools in your website and app
- Where your cloud data is hosted
You get
A data map you can keep up to date.
02Work out which laws apply
Which privacy laws apply depends on where your users are and your role for each type of data. I work that out market by market.
What I look at
- When do you decide how data is used, and when do you just process it for customers?
- Which countries’ laws apply because you have users or sell there?
- Do you cross the thresholds for US state privacy laws?
- Do you need a local representative, a privacy officer or a grievance officer?
What I’ll ask you for
- Where your users and revenue come from
- Your customer contracts
- How you market and target users
You get
A one-page table: which laws apply, where and why.
03Privacy policy and consent
Your privacy policy has to match what your product really does, and your consent screens have to work in every market.
What I look at
- Do you have a valid legal reason for each use of data?
- Does your privacy policy mention your AI and analytics uses?
- Does your cookie banner work for Europe, the UK and the US?
- Is your consent clear and easy to withdraw, as India’s DPDP Act requires?
What I’ll ask you for
- Privacy policy, cookie banner and consent records
- Email and SMS sign-up flows
- Any past privacy assessments
You get
A list of gaps, plus redlines for your policy and banner.
04Vendors and data abroad
Your vendors are part of your risk. I check your contracts with them and the rules on sending data to other countries.
What I look at
- Does every vendor that touches personal data have a proper contract?
- Is your public list of vendors up to date?
- Which data leaves Europe, the UK or India, and on what legal basis?
- Can you actually deliver what your own customer contract promises?
What I’ll ask you for
- Your vendor list and their data agreements
- Any transfer agreements and assessments
- Your customer data processing agreement
You get
A vendor table with contract fixes, ranked by risk.
05User requests, deletion and data leaks
Policies only count if your team can follow them. I test whether you can handle requests and incidents on time.
What I look at
- Can you find, export and delete one user’s data across every system in time?
- Do you delete old data, or keep everything forever?
- Who decides if a leak must be reported, and how fast? (72 hours in Europe, 6 hours to CERT-In in India)
- Do you honour ‘do not sell or share’ requests and browser privacy signals?
What I’ll ask you for
- Past user requests and how you answered
- Your data retention rules
- Your incident plan and any past incidents
You get
Tested processes, a retention schedule and a breach reporting chart.
06Risk checks and ownership
I check which features need a formal privacy risk assessment and set up the records customers and regulators ask for.
What I look at
- Which features need a privacy impact assessment?
- Is privacy checked before launch, or after?
- Who owns privacy, and do founders review it?
- Has the team had privacy training?
What I’ll ask you for
- Existing assessments and launch reviews
- Policies and training records
- Security certifications like SOC 2 or ISO 27001
You get
A privacy check for launches and a ready evidence pack.
How it works
About four weeks.
Very little of your time.
A typical timeline. Bigger products or more markets take longer. A deal deadline can make it faster.
- Day 1
Intro call
- You walk me through the product and users
- We agree the markets and systems in scope
- You get a fixed price in writing
Your time: 30 minutes
- Week 1
I map your data
- A short questionnaire and one shared folder
- Calls with engineering, product, growth and support
- I scan your cookies, trackers and vendors
Your time: 4–5 calls of 45 minutes
- Weeks 2–3
I find the gaps
- Which laws apply, market by market
- I review your policy, consent, contracts and transfers
- We test a user request and an incident together
Your time: A few quick answers and one test session
- Week 4
You get the answers
- Report with a ranked fix-list
- A readout call with your founders
- An evidence checklist for customers
Your time: One 90-minute call
- After
We fix it (optional)
- I draft your policy, contracts and assessments
- I help fix consent and request flows
- Regular privacy check-ins
Your time: As needed
Common problems
What I usually find.
And how we fix it.
Problems that come up in startup after startup, sorted by how urgent they are. Your list will depend on your product.
“Delete my data” only deletes it from one place
Why it mattersCopies stay in analytics, CRM, support tools and backups.
The fixMap every system with user data and automate deletion.
Data sent abroad without the right paperwork
Why it mattersEurope, the UK and many others restrict this, and customers will ask.
The fixPut the standard transfer contracts in place and record a short assessment.
Privacy policy doesn’t mention AI or analytics
Why it mattersA policy that doesn’t match reality can count as misleading users.
The fixRewrite it from your data map, with a short summary up top.
No plan for who to tell after a data leak
Why it mattersDeadlines differ: 72 hours in Europe, 6 hours to CERT-In, and they vary across US states.
The fixA one-page chart of who to notify, by when, and who decides.
Vendor list out of date
Why it mattersCustomer contracts usually require notice before you add a new vendor.
The fixPublish a list and update it whenever you buy a new tool.
What you get
Six things
you keep using.
- Your data mapWhat data you collect, why, where it goes and how long you keep it.
- Which laws applyA one-page table of the privacy laws in your markets and what they need.
- The reportEvery gap, in plain English, ranked by how much it matters.
- Document redlinesChanges to your privacy policy, cookie banner, contracts and internal policies.
- Process checkHow your user requests, deletion and incident processes performed, plus fixes.
- Evidence packWhat to send when customers or auditors ask how you handle data.
What to bring
Whatever you have.
Don’t have half of these? That’s normal, and often why you need the audit. Bring what exists.
- A product walkthrough
- Your privacy policy and cookie banner
- A list of the tools and vendors you use
- Any contracts, policies or past incidents, if you have them
Laws covered
You don’t need to know these.
That’s my job.
For the curious: the laws I check against most often, by market. I only cover the ones that apply to you. Each links to a plain summary in the law library.
European Union
- GDPR
- ePrivacy (cookies & marketing)
- Data Act
- NIS2 (if in scope)
Legal reasons for using data, risk assessments, data abroad and cookies.
United Kingdom
- UK GDPR & Data (Use and Access) Act
- PECR (cookies & marketing)
Data transfers, the new legitimate-interest rules and complaints handling.
United States
Thresholds, opt-outs, sensitive data and vendor contract terms.
India (home ground)
- DPDP Act & Rules 2025
- CERT-In Directions
- RBI rules for payments data
Clear consent, children’s data, 6-hour incident reporting and the deadlines.
Asia-Pacific & Middle East
Sending data abroad, local storage, registration and breach deadlines.
Americas
Privacy officers, impact assessments and data transfers.
FAQs
Straight answers.
No legalese.
We have SOC 2 or ISO 27001. Isn’t that enough?
No. Those cover security. Privacy laws also ask why you use data, what you tell users, how you handle requests and where data goes. Security certificates don’t check those.
Which law do you check against?
The ones that apply to you. We agree your markets on the intro call. Europe’s GDPR, US state laws and India’s DPDP Act are the most common mix.
Will this get us ready for India’s DPDP Act?
It gives you a clear plan and the order to do things in, so you are ready before the main duties apply in May 2027.
Do you scan our systems?
I check your cookies, trackers and settings and test your processes with your team. Deep technical or security testing is done with a specialist firm.
Can you be our privacy officer after this?
Ongoing advice is available after the audit. Whether you need a formal privacy officer, and who it should be, depends on your situation. We can talk it through.
How much does it cost?
A fixed fee, agreed after the intro call. It depends on how many products, markets and systems you have, and how much help you want with fixes.
The fine print
We agree the markets and scope on the intro call. This is a legal review, not a certification or a security test. Laws and deadlines change, so findings reflect the law on the date of the review.