The management of Access permits and data privacy It has become a major headache for both organizations and advanced users. Between GDPR, LOPDGDD, cybersecurity frameworks, and ecosystems like Microsoft 365, simply "putting in a few controls" isn't enough: a systematic, measurable, and auditable approach is needed to demonstrate that things are being done correctly and to detect failures in time.
This permissions and privacy audit manual is intended for the pro user who wants to go a step further: security officers, system administrators, internal auditors, consultants or any professional who has to review how personal data is handled, what access each user has and how that whole process is documented from beginning to end.
Legal framework and concept of privacy audit
Before getting down to business with tools and commands, it is essential to clarify what we mean by privacy audit and the standards it relies onIt's not just about reviewing technical security aspects, but about verifying whether the organization respects people's rights and legal obligations regarding their data.
A privacy audit is a systematic and structured procedure which analyzes how an entity collects, uses, stores, shares, and deletes personal data. Its mission is twofold: on the one hand, to verify the degree of compliance with regulations (mainly GDPR and LOPDGDD in the Spanish and European context) and, on the other hand, to identify gaps, inconsistencies, and risks that could lead to incidents or sanctions.
In the European Union, the General Data Protection Regulation (GDPR) and the Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDDThese regulations establish the framework: principles, legal basis, data subject rights, duty of security, impact assessments, obligation to notify breaches, etc. Although these regulations do not literally mandate periodic privacy audits, their implementation is Highly recommended as proof of diligence and as a mechanism to regularly review the measures implemented.
From a technical point of view, the privacy audit aligns with Article 32 of the GDPR, which speaks of the need to regularly verify, evaluate and assess The effectiveness of the technical and organizational security measures. In other words: it is not enough to implement controls; it is necessary to periodically verify that they work and remain appropriate to the risk.
The practical result of a good privacy audit is a clear diagnosis of whether the organization is compliant, where it is lacking, and what concrete actions must be implemented to strengthen the protection of personal data and the systems that process it.
Strategic importance of auditing permissions and privacy
When people talk about privacy audits, they often only think about "paperwork," but the real impact lies in how the data is managed. access permissions, user privileges, and controls over systemsIn fact, many serious incidents stem from excessive or poorly managed access.
From an organizational standpoint, a well-planned audit allows to measure the effectiveness of security measuresThis includes both technical aspects (encryption, access controls, activity logs, backups, etc.) and organizational aspects (internal policies, training, incident management, contracts with third parties, etc.). It's time to check if everything written in the policies is actually being applied in daily practice.
From a legal perspective, this process helps to verify that the processing of personal data complies with the GDPR principles (legality, fairness, transparency, minimization, accuracy, retention limitation, integrity and confidentiality, and proactive accountability). A robust audit becomes valuable evidence in the event of inspections or claims, and can make the difference in the amount of a penalty.
Furthermore, auditing is a very powerful tool for the early detection of problemsThese include: excessive access, poorly classified data, outdated technical measures, providers without sufficient guarantees, gaps in the management of data subject rights, etc. The sooner these flaws are detected, the easier they are to correct and the less damage they cause.
Finally, the audit process itself often has a positive effect on internal culture: by involving staff from different areas, it increases the awareness of privacy and securityand helps to ensure that they are not seen as "things for the IT department or the DPO," but as responsibilities shared by the entire organization.
Types of privacy audits: internal and external
In practice, organizations often combine different audit approaches to better cover the risk map. The most common distinction is between internal audit and external auditEach one has pros and cons that should be clearly understood.
Internal auditing is the one carried out with organization's own resourcesIt is usually carried out by internal audit teams, security officers, or data protection specialists. Its main advantage is that it is faster and more cost-effective: the context, systems, and processes are known, and it can be repeated more frequently.
The weak point of this model is that it may lack certain independence and objectivityUltimately, those conducting the audits often belong to the same organization as those being audited, and this can influence the depth of the analysis or the severity of the conclusions. Furthermore, internal staff sometimes take certain risks or practices for granted and cease to question them.
External auditing, on the other hand, involves hiring professionals or specialized firms in privacy, cybersecurity, or management systems (for example, experts in ISO 27001 or sector-specific schemes). The major advantage is that they typically bring a more impartial perspective, experience in other organizations, and well-established methodologies, resulting in more rigorous and comparable reports.
The drawback lies in the cost and the need for explain the internal context to third partiesthe systems and particularities of the business. Even so, in organizations of a certain size or with high-risk operations, these external audits are usually practically essential to have a realistic assessment of the level of compliance.
Key phases of a privacy audit
Regardless of who performs it, a rigorous privacy audit follows a series of steps well-defined phasesAdapting these stages to one's own context is fundamental, but the general scheme usually remains the same.
The first phase is the review and compilation of documentationThis is where all relevant documents are gathered: Record of Processing Activities, privacy policies, information clauses, contracts with data processors, internal security rules, incident management procedures, protocols for exercising rights, etc. Technical evidence is also collected (configurations, network diagrams, password policies, previous reports, etc.).
In parallel, a detailed audit planningThe scope (which treatments, systems, or areas are being audited), specific objectives, methodology, timeline, necessary resources, and people to be interviewed are all important. At this stage, it is common to conduct preliminary interviews with key personnel to clarify any doubts and understand how the documents are being applied in practice.
The next phase is the compliance analysisHere, the information gathered (documentary and field data) is compared with the requirements of the GDPR, the LOPDGDD, the guidelines of the supervisory authority, and, where applicable, other relevant standards (such as ISO 27001 or the National Security Framework). The risk of data processing, the technical and organizational measures, the legal basis for each processing activity, the quality of information provided to users, rights management, and the relationship with suppliers and partners are assessed, among other aspects.
With all that information, the audit reportThis report includes the diagnosis, observed evidence, detected nonconformities or deficiencies, and recommendations for improvement. Ideally, it should not only identify problems but also prioritize actions based on risk and feasibility, to facilitate management's decision-making and resource allocation.
Finally, the phase of presentation of results and action planThe report is sent to the Data Controller, or to the Data Protection Officer if senior management already exists. Based on this, an implementation plan of measures and safeguards is defined: what will be corrected, within what timeframes, who is responsible, and how each task will be monitored until its completion.
Minimum content of the privacy audit report
A useful privacy audit report is not merely a checklist, but a document that offers a clear and hierarchical vision of the situation. Even so, there are blocks of content that should not be missing.
First, a description of the current situation of the organization Regarding data protection: the type of activities, categories of data processed, affected groups, systems involved, and the level of sensitivity of the information. This serves to contextualize everything that follows.
It should also include a detailed review of the Treatment Activities Registryverifying that it is complete, up-to-date, and aligned with reality. This includes checking that it specifies the purposes, legal bases, data categories and recipients, retention periods, overall security measures, and whether there are international transfers.
Another key block is the risk analysis and security measuresIt is reviewed whether there is a risk analysis methodology, how it has been applied, what risks have been identified and what technical and organizational measures have been defined to mitigate them (access controls, encryption, network and communications security, backups, continuity, training, controls over suppliers, etc.).
The report should also verify the need to perform Data Protection Impact Assessments (DPIAs) For high-risk data processing, review existing data processing activities and verify that the established safeguards are being implemented. Also, check whether the organization is required to appoint a Data Protection Officer and, if so, whether it has actually done so and has sufficient resources and autonomy.
An analysis of the treatment systems, both automated and manualThe review covers the lawfulness of data processing, the adequacy of information clauses, and compliance with GDPR principles. Internal protocols for managing rights requests (access, rectification, erasure, objection, restriction of processing, and data portability) and for notifying and managing security breaches are also reviewed.
Technical audits: ISMS, ISO 27001, ENS and security measures
Privacy and information security go hand in hand. That's why many privacy audits rely on Information security management systems (ISMS) based on standards such as ISO 27001 or frameworks such as the National Security Scheme (ENS) in the Spanish public sector.
A well-implemented ISMS is based on a logic of layered risk managementwith varying levels of security that protect everything from the physical infrastructure to applications and data. Within this framework, general technical measures are reviewed: password policies, logical access controls, network segmentation, perimeter protection, encryption in transit and at rest, device security, monitoring, backups, and business continuity plans.
The audit also checks what is done if an ISMS already exists in the company: how the risk analysisHow often are they reviewed, how are decisions on acceptance or treatment of risks documented, when is a Data Protection Impact Assessment activated, and how are both visions (security and privacy) integrated into a common tool or methodology.
Organizational security measures are equally important: mechanisms are reviewed classification and use of information, rules on internal and external data exchange, awareness and training programs, controls on authorizations and periodic reviews of permits, management of suppliers and subcontractors, and protocols for managing incidents and security-related tasks.
The purely technical part includes issues such as virtualization, cryptography, secure system configuration, communications security (for example, use of HTTPS, TLS, Wi-Fi protected with WPA2 or WPA3), pseudonymization, anonymization, event monitoring, backups and periodic restore testing, as well as business continuity and disaster recovery plans.
Auditing AI components and algorithmic treatments
With the expansion of artificial intelligence systems in data analysis, scoring, decision automation, and service personalization, privacy audits must now include a specific review of the AI components that process personal dataThis area concentrates top-level legal, ethical, and reputational risks.
This part begins with a clear definition of the AI ​​componentWhat does AI do, what data does it operate on, what decisions or recommendations does it generate, and who does it affect? ​​It is essential to transparently identify the component (so that it is not an invisible "black box" for the user) and clearly state its purpose: why AI is used, what value does it add, and what implications does it have for people?
The audit should also review the data management and preparation that feed into the model: data origin, legal bases for each use, minimization measures, cleaning and labeling processes, bias control, and update procedures. It is verified whether the principles of accuracy, purpose limitation, and minimization are respected, as well as the rights of data subjects against automated decisions.
Another critical block is the verification and validation of the AI ​​componentThis involves analyzing how the model has been tested, what metrics are used, whether periodic validations are performed to detect degradations in its behavior, whether there are human reviews of sensitive decisions, and how the tests and results are documented.
In many cases it will be necessary to perform a Data Protection Impact Assessment specific to AIGiven the data-intensive nature of data processing, the opacity of some algorithms, and the high risk to people's rights and freedoms, the audit must ensure that these Data Protection Impact Assessments (DPIAs) exist, are complete, and are updated when models change or their uses expand.
Role of the auditor and user-centric security measures
The auditor, internal or external, becomes the figure who It evaluates and compares reality with security and privacy standards.Their task is not just to review documents, but to verify on the ground how personal data is protected: who accesses it, with what credentials, from where, for what purpose, and under what controls.
This analysis includes both purely technical aspects (access controls, password management, network security, encryption, retention policies) and verification that the organization complies with the information and consent obligationsand with attention to the rights of individuals (access, rectification, erasure, etc.). It also reviews how requests to exercise rights are handled and what traceability exists regarding the responses.
From the perspective of the pro user, it is key to establish and verify measures such as the use of strong and unique passwordsThe systematic deployment of two-factor authentication, the constant updating of systems and applications, the use of secure Wi-Fi networks, and browsing exclusively through connections cifradas and the use of up-to-date antivirus and antimalware solutions.
The audit should also analyze the Privacy control on social networks and cloud services, the use of encrypted backups, data sharing practices and the level of staff training in matters such as phishing, malicious emails, social engineering and risks when sharing information online.
In addition to security controls, the organization must have a updated data inventory specifying where they reside, who has access to them, and who is responsible for their safekeeping. This inventory is critical for meeting legal obligations, identifying vulnerabilities, demonstrating accountability, and supporting both internal audits and stakeholder requests.
Review of access, privileges, and user lifecycle management
One of the points that makes the biggest difference in practice is the auditing of the user permissions and access privileges to systems and data. The case of OneMain Financial and the multimillion-dollar fine from the New York regulator for failures in access controls is a clear reminder of what is at stake.
The periodic review of access (User Access Review or UAR) consists of analyzing which users have credentials, what resources they can access and with what level of privilegesand eliminate anything unnecessary or inappropriate. This applies to employees, administrators, suppliers, technology partners, and any third party with access to critical data or systems.
An effective User Access Registry (UAR) must answer basic questions: who has access to what, with what specific permissions, whether they have a legitimate justification for that access, and what changes need to be made. This process is essential for protecting data and assets, complying with security frameworks and industry regulations, improving risk management (especially of insider threats), and, incidentally, reducing licensing costs by eliminating access and accounts that are no longer in use.
The first step is usually inventory tools, systems and users: list all the applicationsDatabases, cloud services, and networks, as well as all users (internal, external, service accounts, inactive accounts) and their roles or privileges, are reviewed. From there, the accounts of departing employees and third parties are reviewed, immediately revoking any remaining active access and adjusting the offboarding process to prevent this from happening again.
The audit should also detect the so-called shadow administrator accountsThese are nominally non-administrator users who, in practice, have highly sensitive privileges granted directly. They are a perfect target for attackers and often go undetected. The typical recommendation is to revoke their unnecessary privileges or integrate them into formally managed and monitored administrative groups.
Another common risk is the inadvertent accumulation of privileges When people change positions or departments, the audit specifically reviews those who have changed roles, comparing their current access with the actual needs of the new position and removing anything that was only necessary in previous roles.
In the final step, the permissions of the other users are analyzed to ensure that each one complies with the principle of need to know and of least privilegeAccess should be limited to the strictly necessary information, and only with the essential capabilities (view, edit, delete, etc.). In some cases, permanent access can be converted into temporary access, for example, through one-time passwords or time-limited privilege escalations.
Automation, best practices, and audit logs in Microsoft 365
To prevent access control and activity auditing from becoming an impossible task, it is essential to rely on automation tools and centralized platformsThis reduces human error, improves traceability, and makes it easier to have complete reports available at any time.
Specialized solutions allow track all users, including inactive and non-personal accountsManage roles, groups and permissions, monitor vendor access, detect shadow applications used with corporate credentials, and generate automated reports on who has access to what and why.
In Microsoft 365 environments, the unified audit log It is enabled by default in most organizations. Even so, when configuring a new tenant, it is advisable to check the audit status, since this log stores user and administrator activity for a period that is typically 180 days, but can be adjusted through retention policies and licenses.
A global administrator can enable or disable auditing from the Microsoft Purview portal or via PowerShell, provided they have the appropriate role in Exchange Online. Status checks are performed using commands such as Get-AdminAuditLogConfigChecking the value of the UnifiedAuditLogIngestionEnabled property. A True value indicates that auditing is running; False, that it is disabled.
Activation via the graphical interface involves accessing the Purview portal, locating the Audit solution, and following the banner that prompts you to start logging user and administrator activity. The change may take up to an hour to take effect. Using PowerShell, simply run Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true to enable it, or the same command with $false to disable it, then checking the status again to verify that the command has been applied.
An interesting detail is that the Changes in the audit status itself are also auditedIn other words, when someone enables or disables unified logging, an entry is generated in the Exchange administrator audit logs indicating who made the change, from which IP address, and when. These events can be found using Search-UnifiedAuditLog, filtering by Set-AdminAuditLogConfig operations, and checking the value of UnifiedAuditLogIngestionEnabled in the AuditData property.
Frequency, training and culture of continuous improvement
A typical mistake is to treat privacy and permissions auditing as a a one-off exercise to "get by"In reality, the technological environment, threats, and regulations change so rapidly that any snapshot becomes obsolete in a short time.
Therefore, it is advisable to establish a consistent review schedule: periodic access reviews (e.g., quarterly for administrators and privileged accounts), annual or biannual privacy audits, and immediate updates when new systems are incorporated, AI projects are launched, or relevant changes in data processing are faced.
Staff training is another critical element. Integrating the access management and permissions review In the employee onboarding and offboarding processes, it helps human resources, IT, and team leaders coordinate: before someone joins, it is decided which tools they should access and with what permissions; when someone leaves, the revocation of all their accounts and access is scheduled at the appropriate time.
Furthermore, involving the key business people in the reviews (not just for IT) improves the quality of decisions: area managers know better than anyone who needs what data and for how long. Automation can provide them with dashboards and lists to approve, deny, or adjust access without having to delve into the technical configuration.
In the long run, organizations that approach permissions and privacy auditing as an ongoing, cross-cutting practice achieve not only reduce legal and cybersecurity risksbut also to build a culture of ethics and responsibility in data handling. This translates into greater trust from clients, users, and regulators, and a much stronger position to deal with incidents or regulatory changes in an increasingly demanding digital ecosystem.
