A legally compliant data protection audit for a website involves the systematic review of all aspects relevant to data protection: cookies and trackers used, consent management, the privacy policy, transfers to third countries, and technical security measures. The aim is to highlight existing data protection risks and identify specific areas requiring action. The following sections explain what such an audit must include, which legal principles apply, and how to proceed systematically.
What must a data protection audit for a website include?
A data protection audit for a website must cover all areas in which personal data is collected, processed or transferred. This includes cookies and trackers, consent management, the privacy policy, external services and transfers to third countries, as well as technical server security. Only a comprehensive review of all these areas provides a meaningful picture of the actual data protection situation.
Specifically, a website data protection audit should cover the following points:
- Cookies and trackers: Which cookies are set, when are they set, and are they technically necessary cookies or those requiring consent?
- External services and scripts: Which third-party services, such as analytics, advertising networks or embedded content, are loaded? Is personal data transferred in the process?
- Consent banners and consent management: Is a consent management tool used? Are services requiring consent only loaded after active consent has been given?
- Privacy policy: Is the privacy policy complete, up to date and does it correspond to the services actually used?
- Transfers to third countries: Is data transferred to countries outside the European Economic Area, and if so, on what legal basis?
- Technical server security: Are HTTPS and a valid TLS/SSL certificate used? Are security-relevant HTTP headers set correctly?
- Subpages: Are not only the homepage but also relevant subpages checked, as trackers and services are often only integrated on specific pages?
It is particularly important that the audit does not merely provide a snapshot of the homepage. Many services relevant to data protection are integrated exclusively on product, contact or blog pages and remain undetected during a superficial review.
Find key insights into external services in the blog post ‘How do I identify and monitor third-party providers as a GDPR risk on my website?’.
What are the legal bases for a website data protection audit?
The key legal basis for a website data protection audit in Germany and the EU is the General Data Protection Regulation (GDPR), supplemented by the Telecommunications and Digital Services Data Protection Act (TDDDG), which builds on the previous provisions of the TTDSG.
Together, these laws govern the conditions under which cookies may be set, data collected and users informed.
The following legal requirements are particularly relevant for the practical assessment of a website:
GDPR, Articles 5 and 6: Personal data may only be processed on the basis of a valid legal basis. For most tracking services, this is the user’s consent.
GDPR, Articles 13 and 14: Data subjects must be informed transparently and comprehensively about data processing. The privacy policy must detail all services used and the purposes of processing.
TDDDG: Cookies and similar technologies that are not technically necessary may only be set following explicit consent. This applies in particular to analytics and marketing tools such as Google Analytics or Meta Pixel.
GDPR, Chapter V: Data transfers to third countries outside the EEA are only permitted under certain conditions, such as on the basis of adequacy decisions or standard contractual clauses.
For websites that are also operated in an international context, additional national data protection laws may apply. A thorough data protection audit should therefore always be assessed in the context of the specific target audience and the server location. This article is not a substitute for legal advice from qualified data protection officers or solicitors.
What is the step-by-step process for a website data protection audit?
A structured website data protection audit follows a clear process: preparation, technical analysis, content review, risk assessment and documentation. Each of these steps provides information necessary for a comprehensive overview of a website’s data protection situation.
Step 1: Preparation and assessment
To begin with, you should clarify which websites are to be audited, who is responsible for data processing, and which services are currently in use. Have the URL of the homepage and the privacy policy to hand. For password-protected areas such as customer portals or intranets, the relevant login details are required.
Step 2: Technical analysis of the website
At the heart of the audit lies the technical examination of the website. This involves checking which cookies and trackers are loaded, whether a consent management tool is in place, and whether services requiring consent actually become active only after consent has been given. At the same time, external scripts, third-party connections and transfers to third countries are recorded. Server security – namely HTTPS encryption and HTTP security headers – is also part of the technical review.
Step 3: Review of the privacy policy
The privacy policy must fully list all services actually used and all purposes of processing. The audit verifies whether the services found on the website are also listed in the privacy policy. Missing or out-of-date entries pose a specific data protection risk and must be updated.
Step 4: Risk assessment and documentation
All vulnerabilities identified are assessed and prioritised according to severity. The results of the audit are recorded in a structured report, which details the identified issues, their legal classification and specific recommendations for action. This report serves as the basis for rectification and as documentary evidence for internal or external audits.
When should a data protection audit be carried out for a website?
A data protection audit for a website should be carried out at least once a year, but also whenever the website or the services used undergo significant changes. Websites are dynamic systems in which plugins, tracking codes or embedded content can be added or changed at any time without this being immediately apparent.
Specific reasons for carrying out a further audit include:
- Relaunch or technical overhaul of the website
- Introduction of new marketing or analytics tools
- Change of hosting provider or content management system
- Changes in the legal landscape or new decisions by supervisory authorities
- Complaints from users or reports of data protection breaches
- Onboarding of new clients through external data protection officers or agencies
For organisations managing multiple websites, continuous monitoring is recommended rather than one-off checks. Otherwise, changes to a website may go unnoticed and lead to new data protection risks that are only detected during a subsequent manual review.
How can automated tools support a data protection audit?
Automated tools can significantly speed up a website data protection audit and make it more consistent by systematically identifying cookies, trackers, external services and security vulnerabilities without the need to manually open every subpage. This can significantly reduce the time required for a full audit, typically from several hours to just a few minutes per website.
Automated GDPR website checks use so-called ‘instrumented browsers’, which access a website in the same way as a real user. In doing so, they can identify which cookies are set before and after consent is given, which external services are loaded, and whether the consent banner is configured correctly. In addition, such tools check server security and cross-reference the services found with the privacy policy.
It is important to note that, whilst automated scans generally provide a solid basis for risk identification, they cannot replace a comprehensive legal assessment. They typically cover technically identifiable issues, but not all possible legal considerations, which require an individual assessment by experts. Nevertheless, they are an indispensable tool for data protection officers, law firms and agencies in making audits scalable and traceable.
What are the most common mistakes companies make during data protection audits?
The most common mistake in website data protection audits is limiting the scope to the homepage. Many services relevant to data protection are integrated exclusively on subpages and thus remain undetected. Other typical mistakes relate to the up-to-date status of the privacy policy, the configuration of the consent banner and the lack of documentation of the audit.
Specifically, the most common vulnerabilities include:
- Checking only the home page: Trackers, embedded videos or contact forms using external services are often found on sub-pages or product pages, not on the home page.
- Outdated privacy policy: New services are integrated, but the privacy policy is not updated. There is no reconciliation between the services used and the text of the privacy policy.
- Faulty consent management: A consent banner is present, but cookies or trackers are loaded before consent is given. This is one of the most common and, at the same time, most serious errors.
- Ignoring transfers to third countries: Services such as Google Analytics, Cloudflare or similar US-based providers transfer data to third countries. Without an appropriate legal basis and documentation, this creates a data protection risk.
- No evidence of the audit: An audit without written documentation is worthless in the event of a dispute. Without a report and recommendations for action, it is impossible to prove that an audit took place.
A one-off audit instead of continuous monitoring: Websites are constantly changing. Those who only carry out an audit once a year may overlook new data protection issues for months on end.
It is particularly important for external data protection officers and agencies that manage many websites to establish a structured and repeatable audit process. This is the only way to identify data protection risks at an early stage and track them with proper documentation. The Privacy Policy Generator can help to keep data protection texts up to date and ensure they match the services actually found.
How decareto supports you with data protection audits for websites
Here at decareto, we have developed a SaaS platform that addresses precisely the challenges described in this article. Our software automatically scans websites for data protection vulnerabilities and generates structured audit reports that can be shared directly with clients or customers.
Specifically, decareto helps you with the following:
- Full website scans in minutes: We automatically check the homepage, subpages, cookies, trackers, consent banners and transfers to third countries, even in password-protected areas.
- AI-powered analysis: Our software analyses websites consistently and prioritises identified issues by severity, so you know where action is needed.
- Continuous monitoring: Hundreds of websites can be monitored on an ongoing basis. You receive automatic notifications of any changes before new risks go unnoticed.
- Dynamic privacy policy generator: Based on the scan results, we create tailor-made privacy policies in up to 24 languages that always correspond to the services actually used.
- White-label reports: External service providers can deliver reports under their own logo – ideal for law firms, agencies and external data protection officers.
Significantly reduce the audit workload: With decareto, the workload for web audits can typically be reduced by up to 90% compared to manual checks.
See for yourself: Try it for free now and scan your first website today.
