Privacy audit readiness