For scaling businesses, privacy is often on the radar, and they want to get it right, but it’s not always clear what “getting it right” actually looks like in practice, or where to even begin.
A good place to start is understanding where you are today, and that’s where a Privacy Audit comes in.
After conducting hundreds of Privacy Audits for some of the world’s most exciting scale‑ups, Trust Keith has seen the patterns first‑hand: what works, what sticks, and what makes privacy an embedded part of how great businesses operate.
In this blog, we’re sharing those lessons, along with practical advice on how your business can get privacy right without slowing down your growth.
A Privacy Audit is an evaluation of your current data protection programme and posture.
It gives you a clear, structured view of how your programme is really performing, and helps you understand where the risks are, what’s working well, and where to focus next.
At Trust Keith, our audits are built around 48 weighted controls covering everything from governance, policies, and training to breach response, vendor management, and data mapping. These controls are grounded in the ICO’s Accountability Framework, ISO 27001 principles, and insights from hundreds of real-world compliance reviews.
Your results are summarised into a single score out of 800, which gives you a clear indication of how strong your privacy programme is at a glance.
With the audit you’ll see a breakdown of where your organisation is performing well, where the gaps are, and which areas need the most attention.
After carrying out hundred of audits, we’ve seen the same issues appear again and again:
Staff often don’t know what a breach looks like, how serious it might be, or who to report it to. If something went wrong today, would your team know what to do?
The solution: Establish a documented breach response process that’s easy to follow and tailored to your organisation. Include guidance on what qualifies as a breach, who to notify, how to assess the risk, and when to escalate.
2. Most privacy programs aren’t risk-driven
Many companies treat “data protection” as a single line item in their business risk register - or worse, have no risk register at all. The result is reactive, box-ticking compliance.
The solution: build a dedicated privacy risk register, break down your specific privacy risks, and prioritise program activities based on what poses the greatest threat to your business.
3. No clear ownership
In many businesses, privacy is either treated as a side responsibility or something that “everyone owns”, which often means no one really does. Without clear ownership, things slip through the cracks, and there’s no one driving progress or taking accountability.
The solution: Assign someone with the right knowledge and authority to lead on privacy. It doesn’t need to be a full-time role, but without someone driving it forward, privacy will always stay at the bottom of the list.
4. Policies that don’t reflect reality
Privacy notices and internal policies are often outdated or copied from templates that don’t reflect how the business actually uses data.
The solution: Treat your policies as living documents. Review them regularly and whenever you change your tooling, processes, or data flows.
5. Training is a one-time event
It’s common for employees to take awareness training courses when they join, if at all, and then never again. But tools, processes, and risks evolve. Training needs to keep up.
The solution: Make training regular and engaging. Refresh it at least annually, and make sure it’s relevant to how your teams actually work.
6. Lack of visibility over personal data
Few companies can clearly say what data they collect, where it’s stored, how long they retain it, and who they share it with. This makes even simple data protection requests painful to handle.
The solution: Keep an up-to-date data map that shows what personal data you collect, where it lives, who you share it with, and how long you keep it. It’s a practical way to stay on top of requests, reviews, and risks.
These issues are often symptoms of a wider problem: privacy isn’t integrated into day-to-day operations. It’s seen as separate, until it’s too late.
The reality is, data privacy is a cultural problem with a cultural solution. It’s not just about having the right policies or completing a checklist, it’s about embedding privacy into how your team thinks, works, and makes decisions.
That doesn’t mean turning everyone into a compliance expert. It means giving people the clarity, training, and processes they need to handle data responsibly in the flow of their actual work.
So where should you start?
Too often, companies tackle privacy as a one-off project, triggered by a due diligence request or a compliance scare. They produce a flurry of policies, maybe even score well on an audit… and then do nothing for 12 months.
That approach doesn’t work. Sustainable privacy means making it part of the business rhythm.
Here are a few simple ways to make it stick:
Privacy isn’t static. Laws change. Customer expectations evolve. And internal risk grows as your business scales.
The best companies aren’t the ones that get everything right immediately. They’re the ones that are aware of their gaps, take action, and make privacy a repeatable part of how they operate.
That starts with understanding where you are now, and what matters most next.
At Trust Keith, we’ve helped hundreds of businesses assess and strengthen their data protection programmes, often starting with a simple conversation.
We’ll help you make sense of where things stand, how our audit works, and how it can help you get on track to getting privacy right.