How to conduct a data privacy audit, step by step