An independent privacy audit of your organisation
A documentary review of how you collect, process and transfer personal data, scored against six published criteria. You receive a PDF report you can share with customers, partners or regulators.
How we assess
A documentary review against fixed criteria. It is not a penetration test or a code audit. We assess what you publish, what you tell us, and what can be tested publicly from your domain.
Transparency
Privacy policy completeness, plain-language readability, layered notices, and how easy it is to reach you with a data subject request.
Lawfulness
Legal bases declared per processing activity, quality of the consent mechanism, ePrivacy compliance and soft opt-in handling.
Data flows
Completeness of the sub-processor list, third-country transfers, transfer impact assessments and Standard Contractual Clauses.
User rights
A documented process for Articles 12 to 22, response times, how to reach you, and the workflow you actually use internally.
Security baseline
HTTPS configuration, security headers, security.txt, breach notification procedure, declared standards and evidence of penetration tests.
Jurisdictional exposure
Hosting region, ownership structure, cross-border data flows and exposure to foreign access laws such as FISA 702 and the CLOUD Act.
What you get
A multi-page PDF report, sent to the email address on your application.
Report contents
- Executive summary: what was reviewed, the overall conclusion and the main findings.
- Six criterion scores: each from 0 to 10, graded pass, concerns or fail.
- Detailed findings: written commentary per criterion, in plain language.
- Recommendations: concrete next steps for your roadmap.
- Document inventory: every source we reviewed, listed for traceability.
- Made in Europe supplement: an optional section on sovereignty, if you opt in.
Verification record
Each PDF contains a unique link to dazr.eu/audit-reports/<id>. That page confirms the audit was issued for your organisation on the audit date, and nothing more. Anyone you share the PDF with can use it to check that the report is genuine.
Organisations that pass can also embed the Dazr audit badge.
How it works
From application to a PDF in your inbox.
1. You apply
Fill in the application: legal entity, privacy governance, data flows, security baseline and signatory. Upload supporting documents such as your privacy policy, record of processing activities or sub-processor list. Uploads are encrypted at rest.
2. We review
The Dazr team reviews the documents against the six criteria and checks public sources such as DNS, headers, robots.txt and security.txt. Typical turnaround is 15 to 25 business days.
3. We ask if needed
If something is missing or unclear, we ask follow-up questions in the applicant portal. You can reply or upload more documents there. Every update also goes to your email.
4. You get the PDF
The final report is emailed to you as a PDF. After delivery we delete the application, the documents and the conversation. Only the verification record remains.
How we handle your data
- Everything you submit is encrypted at rest with AES-GCM.
- Documents are stored in a private bucket that only the Dazr audit team can access.
- Conversations stay inside the encrypted applicant portal.
When we deliver the final PDF, we delete everything: the application, every uploaded document and the full conversation. The PDF in your inbox is your record. Only a small verification record stays on dazr.eu, so others can confirm the audit is genuine. We do not host the report, keep your documents or list you in a directory.
Ready to apply?
Most applications take 30 to 45 minutes. Your draft is saved in your browser, so you can come back later.
Disclaimer. The Dazr Privacy Audit is a private documentary review carried out by Dazr based on materials supplied by your organisation, plus public-source verification. It does not constitute legal advice, GDPR Article 42 certification, ISO certification, conformity assessment, or any regulatory approval. Findings are Dazr's good-faith editorial opinion as of the audit date. Material misstatements by the applicant void the report and may result in public correction.