Privacy Tools Guide

Small businesses often skip privacy audits because they seem like an enterprise concern. They’re not. A single data breach at a small company can cost $50,000–$500,000 in recovery costs, regulatory fines, and lost customers. Most breaches exploit simple, fixable problems.

This checklist is organized into eight areas. Work through each section, mark what’s done, and create a remediation task for anything that isn’t.

1. Data Inventory

You can’t protect data you don’t know you have. Start by mapping what personal data your business collects and where it lives.

Questions to answer:

Action: Create a data register

A simple spreadsheet works:

Data Type Where Stored Who Has Access Retention Period Shared With
Customer emails Mailchimp Marketing team 3 years Mailchimp (processor)
Payment card numbers Stripe Nobody (Stripe holds) N/A Stripe
Employee records Google Drive HR only 7 years Payroll provider

The goal is to identify data you’re keeping unnecessarily — delete it, or stop collecting it.

2. Access Controls

Employees should only access data they need for their role. Audit this now.

Checklist:

Quick audit:

# If using Google Workspace — export user list and review
# Google Admin Console > Users > Export users

# Check for inactive accounts (Google Admin > Reports > User activity)

For AWS/cloud infrastructure:

# List IAM users with console access
aws iam list-users --query 'Users[*].[UserName,CreateDate]' --output table

# Find users with no recent activity
aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d | \
  awk -F',' '$5 < "2025-01-01" {print $1, $5}'

3. Third-Party Vendor Review

Every SaaS tool you use is a potential breach vector. Review your vendor list.

Checklist:

Common tools to audit:

For GDPR compliance, every vendor in this list that processes EU personal data needs a signed DPA. Most provide them on request or in their terms.

4. Website Privacy

Checklist:

Check what’s loading on your site:

# Check for third-party scripts with curl
curl -s https://yourwebsite.com | grep -oE 'src="[^"]*"' | grep -v "yourwebsite.com"

# Or use a headless browser check
npx playwright chromium --screenshot https://yourwebsite.com screenshot.png

IP anonymization in Google Analytics (gtag.js):

gtag('config', 'GA_MEASUREMENT_ID', {
  'anonymize_ip': true,
  'storage': 'none',
  'client_storage': 'none'
});

5. Email Security

Checklist:

Verify email authentication:

# Check SPF
dig +short TXT yourdomain.com | grep spf

# Check DMARC
dig +short TXT _dmarc.yourdomain.com

# Check DKIM (replace 'default' with your selector)
dig +short TXT default._domainkey.yourdomain.com

Expected results:

6. Device and Endpoint Security

Checklist:

Check FileVault status:

fdesetup status

Check BitLocker:

manage-bde -status

7. Incident Response Plan

Checklist:

A minimal incident response document should cover:

  1. How to identify a potential breach
  2. Who to notify internally (CEO, legal, IT)
  3. How to assess what was exposed and to whom
  4. Regulatory notification timelines
  5. Customer communication templates

8. Employee Awareness

Technical controls fail when employees don’t understand basic threats.

Checklist:

Phishing simulation tools (for testing employee awareness):

Audit Schedule

Activity Frequency
Review user access lists Quarterly
Check for new third-party tools Monthly
Verify MFA is enabled for all accounts Quarterly
Review and update privacy policy Annually
Run phishing simulation Twice yearly
Test backup restoration Annually
Full privacy audit (this checklist) Annually

Built by theluckystrike — More at zovo.one

Explore Our Developer Guides

© 2026 theluckystrike Developer Guides