{"id":5299,"date":"2026-11-13T13:35:42","date_gmt":"2026-11-13T13:35:42","guid":{"rendered":"https:\/\/sawaryn.com\/?p=5299"},"modified":"2026-11-13T13:41:14","modified_gmt":"2026-11-13T13:41:14","slug":"post-implementation-website-privacy-audit","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/post-implementation-website-privacy-audit\/","title":{"rendered":"Post-implementation website audit. Check whether your privacy policy matches what actually runs on the website"},"content":{"rendered":"

You have published a new privacy policy, the cookie banner works, and the notices have been updated. GDPR compliance is now taken care of \u2014 or at least that is what the post-implementation report suggests. But then someone opens your online store in a clean browser session and discovers that one tool described in the policy does not exist on the website, while three others are operating even though they are not mentioned in either the policy or the record of processing activities.<\/p>\n

This is not a hypothetical situation. It is a pattern that regularly emerges several weeks after a GDPR implementation has been completed. The management board believes that the documentation is complete. Meanwhile, the website takes on a life of its own \u2014 marketing installs new plugins, the provider updates integrations, and no one informs the person responsible for data protection.<\/p>\n

This article explains what a post-implementation website audit<\/strong> is, why a privacy policy<\/a> alone is not enough to demonstrate GDPR compliance, and how to check in a few steps whether the declarations in your documents match what actually runs on your website. You will also learn about the risks arising from discrepancies between your documentation and the actual state of affairs \u2014 and what to do about them before the President of the Polish Data Protection Authority does it for you.<\/p>\n

Key concepts you need to know<\/h2>\n

Before we move on to the assessment method, it is worth clarifying a few terms. This is not about theory \u2014 it is about making sure you know exactly what you are checking and why.<\/p>\n\n\n\n\n\n\n\n\n\n\n
Concept<\/th>\nWhat it means in the context of your website<\/th>\n<\/tr>\n<\/thead>\n
Post-implementation audit<\/strong><\/td>\nA technical and documentation review conducted several weeks after GDPR recommendations have been implemented \u2014 it checks whether the changes are actually working and whether any new discrepancies have emerged<\/td>\n<\/tr>\n
Record of processing activities<\/a><\/strong> (Article 30 GDPR)<\/td>\nA document in which the controller describes every operation involving personal data: its purpose, legal basis, categories of data, and recipients. The obligation applies to every controller, regardless of company size<\/td>\n<\/tr>\n
Consent mode<\/strong><\/td>\nThe technical configuration of analytics and advertising tools that determines whether scripts run before the user gives consent or only after consent has been given<\/td>\n<\/tr>\n
Consent management mechanism (cookie banner<\/a>)<\/strong><\/td>\nThe interface through which users give or refuse consent to cookies \u2014 it must comply with the requirements of Article 7(3) GDPR and Article 399 of the Electronic Communications Law<\/td>\n<\/tr>\n
Information obligation<\/strong> (Article 13 GDPR)<\/td>\nThe information that the controller must provide to a person when collecting their data: the controller\u2019s identity, the purpose of processing, the legal basis, the retention period, and the person\u2019s rights<\/td>\n<\/tr>\n
Data processing agreement<\/a><\/strong> (Article 28 GDPR)<\/td>\nAn agreement between the controller and a provider (e.g. the website provider) that processes data on the controller\u2019s behalf \u2014 it governs the scope, purpose, and conditions of processing<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Why implementing GDPR does not put the matter to rest<\/h2>\n

Implementing a privacy policy, launching a cookie banner, and updating notices is the starting point \u2014 not the end point. The accountability principle under Article 5(2) GDPR requires you to be able to demonstrate compliance at all times, not only on the day the documents are published.<\/p>\n

The problem is that a website changes faster than its documentation. Marketing adds a tracking pixel. Accounting integrates a new invoicing tool. The website provider updates a review collection plugin that enables automatic purchase review invitations by default. Each of these changes is a new processing activity \u2014 with its own purpose, legal basis, and potentially an obligation to obtain consent for electronic communications (Article 398 of the Electronic Communications Law).<\/p>\n

Discrepancies can go both ways<\/h3>\n

This is the most important observation from post-implementation reviews. Discrepancies between the documentation and reality are not one-directional:<\/p>\n\n\n\n\n\n\n
Direction of the discrepancy<\/th>\nWhat it involves<\/th>\nProvisions breached<\/th>\n<\/tr>\n<\/thead>\n
A tool described in the policy but not operating on the website<\/td>\nThe company declares processing that it does not carry out \u2014 misleading users about the scope of operations performed on their data<\/td>\nArticle 5(1)(a) GDPR (fairness), Article 12(1) GDPR (transparency)<\/td>\n<\/tr>\n
A tool operating on the website but not included in the policy or the record<\/td>\nProcessing takes place without a documented legal basis \u2014 the controller is unable to demonstrate it<\/td>\nArticle 6 GDPR (no legal basis), Article 13 GDPR (no information), Article 30 GDPR (no entry in the record), Article 24 GDPR (lack of accountability)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

An audit conducted solely \u201con paper” \u2014 that is, one limited to reading the policy \u2014 will not detect either type of discrepancy. To identify them, you need to open the website and compare what happens there with what the documentation says.<\/p>\n

Three common sources of discrepancies<\/h3>\n
    \n
  1. Plugins with features enabled by default.<\/strong> A post-purchase review collection plugin may automatically send emails inviting customers to leave a review \u2014 and it may do so from the moment it is installed, before anyone consciously decides to activate the feature. This is a separate processing activity and, if invitations are sent by email, it is also subject to Article 398 of the Electronic Communications Law.<\/li>\n
  2. Integrations added by other departments.<\/strong> An accounting and invoicing integration, a new analytics tool, or a marketing pixel \u2014 each processes personal data and must be entered in the record of processing activities, described in the policy, and checked to determine whether a data processing agreement is in place with the provider.<\/li>\n
  3. The consent management provider omitted from the documentation.<\/strong> The paradox is that the very tool intended to ensure GDPR compliance is itself omitted from the record of processing activities and the privacy policy. The consent management provider is the one most often forgotten \u2014 because it is \u201cthe compliance tool”.<\/li>\n<\/ol>\n

    Contact us<\/a> if you would like to check whether your website has any such discrepancies.<\/p>\n

    How to conduct a post-implementation website audit step by step<\/h2>\n

    A post-implementation review does not require specialist software. It requires a method. Below is the recommended sequence of steps \u2014 from opening your browser to analysing the policy\u2019s content.<\/p>\n

    Step 1: use a clean session and observe what happens before consent<\/h3>\n
      \n
    1. Open your browser in private mode or clear the website data (cookies, cache, and local data).<\/li>\n
    2. Visit the website \u2014 do not click anything on the cookie banner<\/strong>.<\/li>\n
    3. Open the developer tools (F12 in most browsers).<\/li>\n
    4. Go to Application \u2192 Storage \u2192 Cookies<\/strong> and list all cookies stored before you interact with the banner.<\/li>\n
    5. Go to the Network<\/strong> tab and check which network requests have been sent \u2014 look for analytics, advertising, and third-party domains.<\/li>\n
    6. Classify every cookie and request: is it technical (essential for the website to function), or does it require consent?<\/li>\n<\/ol>\n

      If you see analytics or advertising cookies, or requests to advertising providers\u2019 domains before giving consent, that is a warning sign. It does not automatically mean there has been a breach, but it requires clarification: what is the legal basis for storing the data, and has the user been informed about it?<\/p>\n

      Step 2: check the consent mode configuration<\/h3>\n

      Check the values of the consent mode parameters in the website code:<\/p>\n\n\n\n\n\n\n\n\n
      Parameter<\/th>\nCorrect default value (before consent)<\/th>\n<\/tr>\n<\/thead>\n
      analytics_storage<\/code><\/td>\ndenied<\/code><\/td>\n<\/tr>\n
      ad_storage<\/code><\/td>\ndenied<\/code><\/td>\n<\/tr>\n
      ad_user_data<\/code><\/td>\ndenied<\/code><\/td>\n<\/tr>\n
      ad_personalization<\/code><\/td>\ndenied<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      If any of these parameters has a default value of granted<\/code>, analytics or advertising tools run before the user gives consent.<\/p>\n

      Step 3: assess the first layer of the banner<\/h3>\n

      Open the cookie banner and check which options the user sees on the first screen:<\/p>\n\n\n\n\n\n\n\n
      Element<\/th>\nCorrect state<\/th>\nIncorrect state<\/th>\n<\/tr>\n<\/thead>\n
      \u201cAllow all” button<\/td>\nPresent<\/td>\n\u2014<\/td>\n<\/tr>\n
      \u201cReject all” button<\/td>\nPresent and visually equivalent<\/strong> to \u201callow”<\/td>\nMissing or hidden in the second layer<\/td>\n<\/tr>\n
      \u201cCustomise” \/ \u201csettings” button<\/td>\nOptional<\/td>\nDoes not by itself replace \u201creject”<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      A \u201ccustomise \/ allow all” layout without an equivalent reject button is a pattern identified as unlawful in EDPB Guidelines 03\/2022. Article 7(3) GDPR requires withdrawing consent to be as easy as giving it. The CJEU judgment in C-673\/17 Planet49<\/em> confirmed that consent requires active, specific action, while the judgment in C-61\/19 Orange Rom\u00e2nia<\/em> held that consent is not freely given when the user must actively object to processing (Decisions of the President of the Polish Data Protection Authority \u2013 list<\/a>).<\/p>\n

      This is a change the website provider can implement at the configuration level \u2014 it does not require a new project or an additional budget.<\/p>\n

      Step 4: cross-check the policy against the website<\/h3>\n

      This is where you combine the technical findings with the documentation. Prepare two lists:<\/p>\n

        \n
      1. Tools described in the policy but not found on the website<\/strong> \u2014 each such tool represents a declaration of processing that the company does not carry out.<\/li>\n
      2. Tools found on the website but not included in the policy or the record of processing activities<\/strong> \u2014 each such tool represents processing without a documented legal basis.<\/li>\n<\/ol>\n

        A systems register that includes only positive entries (\u201cwe have this, it works”) will not detect the first type of discrepancy. It is therefore worth deliberately adding negative entries marked \u201cnot found” \u2014 this allows the register to account for the documentation rather than merely list the current state.<\/p>\n

        Step 5: verify privacy notices<\/h3>\n

        Go through all forms on the website (contact, newsletter, and registration forms) and check the notices displayed below them:<\/p>\n

          \n
        1. Have the controller\u2019s details been completed, or is there still a placeholder such as \u201c(personal data controller\u2019s details…)”?<\/li>\n
        2. Does the notice contain the complete set of information required under Article 13 GDPR: the controller\u2019s identity, the purpose of processing, the legal basis, the retention period, and the person\u2019s rights?<\/li>\n
        3. Does the newsletter form separate the two layers of consent: consent to the electronic communication channel (Article 398 of the Electronic Communications Law) and the legal basis for processing personal data under the GDPR?<\/li>\n<\/ol>\n

          An incomplete placeholder can survive several consecutive reviews \u2014 because no one reads a notice they inserted themselves.<\/p>\n

          Step 6: analyse the content of the privacy policy<\/h3>\n

          Analyse the policy\u2019s content last \u2014 so that you compare it with the established facts, not the other way around. Check:<\/p>\n

            \n
          1. Whether the policy is labelled \u201cdraft” \u2014 if so, it is binding on data subjects while describing itself as unfinished.<\/li>\n
          2. Whether the publication date has been completed.<\/li>\n
          3. Whether it refers to Article 173 of the Telecommunications Law (repealed) instead of Article 399 of the Electronic Communications Law \u2014 a reference to a repealed provision is an immediate sign that the document is outdated.<\/li>\n
          4. Whether it refers to documents that no one has prepared: a Transfer Impact Assessment (TIA), a risk assessment, or a Data Protection Impact Assessment (DPIA). A TIA and a DPIA are two separate documents \u2014 a TIA examines the effectiveness of transfer safeguards in the context of the third country\u2019s laws, while a DPIA assesses the effects of processing under Article 35 GDPR. A policy that refers to both must have both in place.<\/li>\n<\/ol>\n

            The most common shortcomings identified in post-implementation reviews<\/h2>\n

            Experience from reviewing e-commerce websites<\/a> reveals a recurring pattern. The table below groups shortcomings by priority \u2014 from those requiring immediate action to those that require the facts to be established.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
            Priority<\/th>\nShortcoming<\/th>\nWho fixes it<\/th>\nEffort required<\/th>\n<\/tr>\n<\/thead>\n
            Urgent<\/td>\nNo equivalent reject button on the first layer of the banner<\/td>\nWebsite provider<\/td>\nConfiguration change<\/td>\n<\/tr>\n
            Urgent<\/td>\nIncomplete placeholder for the controller\u2019s details in the notice below a form<\/td>\nWebsite provider<\/td>\nContent completion<\/td>\n<\/tr>\n
            Urgent<\/td>\nPolicy labelled \u201cdraft” without a publication date<\/td>\nWebsite provider \/ company<\/td>\nRemove the label and add the date<\/td>\n<\/tr>\n
            Urgent<\/td>\nReference to Article 173 of the Telecommunications Law instead of Article 399 of the Electronic Communications Law<\/td>\nLegal adviser<\/td>\nUpdate the policy\u2019s content<\/td>\n<\/tr>\n
            Urgent<\/td>\nThe policy refers to a TIA, risk assessment, or DPIA that does not exist<\/td>\nCompany + legal adviser<\/td>\nPrepare the documents or remove the references<\/td>\n<\/tr>\n
            Medium<\/td>\nTools are operating but not included in the policy or the record<\/td>\nCompany + legal adviser<\/td>\nAdd an entry to the record and update the policy<\/td>\n<\/tr>\n
            Medium<\/td>\nA tool is described in the policy but not found on the website<\/td>\nCompany + legal adviser<\/td>\nRemove it from the policy or implement it<\/td>\n<\/tr>\n
            To be determined<\/td>\nReview plugin with automatic invitations \u2014 feature status unknown<\/td>\nCompany (internal verification)<\/td>\nCheck the configuration<\/td>\n<\/tr>\n
            To be determined<\/td>\nEncryption of data at rest, backup testing, access rights review<\/td>\nCompany (IT)<\/td>\nConfirm implementation<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

            Note the entries marked \u201cto be determined”. An external review cannot tell you anything about encryption of data at rest or backup testing \u2014 these elements require confirmation from the IT team. It is better to state this explicitly than to let anyone believe that the report covers everything.<\/p>\n

            One conclusion recurs in every review: most urgent shortcomings can be fixed through simple changes by the website provider<\/strong>. They require no effort from the company other than issuing an instruction. A list of shortcomings does not necessarily mean a new project and a new budget.<\/p>\n

            The systems register \u2014 a tool that brings order to the entire process<\/h2>\n

            The review itself is a one-off assessment. To ensure that the results are not lost and that the next review has a point of reference, you need a register of systems<\/a> and tools operating on the website.<\/p>\n

            The register should contain at least four columns:<\/p>\n\n\n\n\n\n\n\n\n
            Tool \/ component (provider, country of establishment)<\/th>\nFunction on the website<\/th>\nProvider\u2019s legal role and categories of data<\/th>\nStatus and comments<\/th>\n<\/tr>\n<\/thead>\n
            Consent management mechanism (provider X, Germany)<\/td>\nCollecting and managing cookie consent<\/td>\nProcessor; data: cookie identifiers, IP address, user choices<\/td>\nCompliant \u2014 requires a data processing agreement<\/td>\n<\/tr>\n
            Analytics tool (provider Y, USA)<\/td>\nWebsite traffic analysis<\/td>\nIndependent controller or joint controller; data: identifiers, activity data<\/td>\nCompliant \u2014 transfer based on Decision (EU) 2023\/1795, provided that the importer is certified<\/td>\n<\/tr>\n
            Marketing pixel (provider Z, USA)<\/td>\nRemarketing and conversions<\/td>\nIndependent controller; data: identifiers, activity data<\/td>\nNot found on the website \u2014 negative entry<\/td>\n<\/tr>\n
            Accounting and invoicing integration (provider W, Poland)<\/td>\nInvoice generation, customer data synchronisation<\/td>\nProcessor; data: first name, surname, address, tax identification number, transaction data<\/td>\nOperating but not included in the policy \u2014 requires an entry in the record of processing activities and an update to the policy<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

            Negative entries (a tool described in the policy but not found on the website) are a deliberate documentation decision. They allow the register to account for the documentation rather than merely list the current state. An item assessed as compliant should also include a maintenance recommendation \u2014 otherwise, after a year, no one will remember that it was checked and found to be satisfactory.<\/p>\n

            Data transfers outside the EEA<\/h3>\n

            For every tool whose provider is established outside the European Economic Area, check the basis for the transfer<\/a>. As of the publication date of this article, Commission Implementing Decision (EU) 2023\/1795 establishing an adequate level of protection under the EU-US Data Privacy Framework remains formally in force (Decision (EU) 2023\/1795 \u2013 Polish text on EUR-Lex<\/a>). It covers only US organisations certified under the DPF. Proceedings challenging the decision are pending before the EU courts (Proceedings document C_202506610<\/a>), but as of the publication date, no final judgment annulling it has been issued.<\/p>\n

            Contingency plan: Standard Contractual Clauses (SCCs) under Article 46 GDPR, combined with an assessment of the laws and practices of the recipient country (Transfer Impact Assessment \u2014 TIA) and supplementary technical measures (encryption, pseudonymisation). The SCCs may not be modified, but they may be incorporated into a broader agreement containing additional clauses, provided that those clauses do not conflict with them.<\/p>\n