Privacy audit
We check how your website or product actually handles personal data: what data is collected (and whether it matches what the policy says), where it goes, whether there is clear consent, whether users can request or delete their data. We find discrepancies and risks and give a prioritized plan. Honestly upfront: we are not lawyers — this is a technical and substantive privacy review, not a legal opinion and not a guarantee of legal compliance or protection from fines; the legal assessment is given by a lawyer.
Privacy audit — overview
A privacy audit is a one-time review of how a website or product actually handles personal data, from a practical and user-trust perspective: what data is collected via forms, analytics, third-party scripts and pixels, and whether this matches what the privacy policy declares; how and when consent is requested; to whom and where data is sent (analytics, advertising, payment and third-party services); whether users have clear ways to request, correct or delete their data and withdraw consent; whether the policy itself is complete and truthful; whether basic personal-data requirements of 152-FZ and GDPR are addressed. Honestly and importantly: we are not lawyers and not a certifier — this is a technical and substantive privacy review, NOT a legal opinion, NOT a certification and NOT a guarantee of legal compliance or protection from fines and claims. We will point out technical non-conformities and potential risks (for example, analytics collects data before consent, the policy promises something that is not actually in place), but the legal qualification for your situation and the final assessment are given only by a lawyer or DPO — our report helps them. It is a snapshot in time: services, scripts and requirements change; part of the data flows is detected with third-party scanners and gives an approximate, not absolute, picture. And it is an assessment, not implementation: writing the privacy policy, setting up consent and reworking forms are separate work, by us or by your team. An important boundary: this is a practical audit of privacy and personal-data handling; a broad formal compliance audit against all requirements is an adjacent service (a compliance audit), and a narrow check of only cookies and the banner is separate (a cookie/CMP audit). If the site is very simple and personal data is barely collected (no forms, analytics or third-party scripts), there is almost nothing to assess and you most likely do not need the audit. Picture this: instead of "our data handling is probably fine" you learn that ad pixels fire before consent, a form collects extra data "just in case", the policy mentions services that no longer exist, and there is nowhere for a user to delete their data — and you see what to fix first and what to ask a lawyer. The base price starts from 16,000 ₽; it depends on the size of the product and the number of data-collection services.
Problems we solve
- You are not sure what you actually collect and whether it matches the policy.
- You work with EU or RF users and fear data violations.
- You do not know where data goes via analytics, ads and third-party services.
- There is no clear way for a user to request or delete their data.
What's included in the Privacy audit service
- What data is collected (forms, analytics, third-party scripts, pixels)
- Whether actual collection matches the privacy policy
- How and when consent is requested; collection before consent
- To whom and where data is sent (analytics, ads, payments, third parties)
- User rights: request, correction, deletion, consent withdrawal
- Completeness and truthfulness of the policy; basic 152-FZ and GDPR requirements
- A prioritized list of non-conformities and risks
- What to fix technically and what to ask a lawyer
What you get
- A clear picture of what data is collected and where it really goes
- Visibility of where reality diverges from the privacy policy
- Priorities: what to fix technically first
- Clarity on what is technical and what is a question for a lawyer or DPO
How the work goes: steps
- We clarify the product, markets (RF/EU), data-collection services and collect access (without access to the CMS, analytics and code only a partial external review is possible — we agree on this in advance)
- We review forms, analytics, third-party scripts, consent, the policy and user rights
- We prepare a list of non-conformities and recommendations and review it with you
Why PDV Expert
- Fixed price and timeline — no surprises on the invoice.
- Report and recommendations in plain language — clear without a technical background.
- In touch at every step and answering questions about the result.
FAQ
Is this a legal opinion and a guarantee against fines?
No. We are not lawyers: this is a technical and substantive privacy review, not a legal opinion, not a certification and not a guarantee of legal compliance or protection from fines. We find technical non-conformities and risks, while the legal qualification for your situation is given by a lawyer or DPO.
How is this different from a compliance audit and a cookie audit?
A compliance audit is a broad formal review against all requirements. A cookie/CMP audit is a narrow check of only cookies and the banner. This audit is a practical review of personal-data handling overall: what is collected, where it goes, whether it matches the policy. They complement each other, but they are different services.
Will you write the policy and set up consent?
No, that is separate work. The audit gives diagnosis: a list of non-conformities and recommendations. Writing the privacy policy, setting up consent collection and reworking forms are done separately or by your team (legal texts with a lawyer).
About the provider
The «Privacy audit» service is provided by PDV Expert — a team specialising in «Diagnostics & monitoring». We work under contract and deliver a written report with recommendations.