More than most people realise.
THE OBVIOUS
Contact form submissions Order details and delivery addresses Account registrations Email signups
THE LESS OBVIOUS
Analytics data, including approximate location and device Server access logs, containing IP addresses Cookies set by embedded content Chat widget conversations Comment submissions Anything a plugin records
WHY IT MATTERS
Your privacy notice should describe what you actually collect, and that includes the things you did not deliberately configure.
A social media embed collecting visitor data is something you are responsible for disclosing.
WHAT TO AUDIT
Every form on the site Every plugin that records anything Every third-party script Analytics configuration Server logs and how long they are kept
THE PRACTICAL EXERCISE
List every place data enters your site, and what happens to it.
Most businesses have never done this and find several things they had forgotten.
WHAT TO DO WITH THE LIST
It becomes the basis of your privacy notice, and it identifies things you could stop collecting.
