Conduct a Data Sovereignty Audit
This lesson is a structured practice session. You have spent eight lessons building the conceptual and technical framework for data sovereignty. Now you apply it comprehensively to your own situation. A data sovereignty audit is a systematic examination of your current data posture: what data you generate and share, who has it, what protections are in place, where the gaps are, and what you will do about them. This is not a theoretical exercise — you will produce an actual, personal action plan by the end. The audit has six phases, each building on the last.
What This Audit Covers
A thorough data sovereignty audit examines six dimensions of your data life. Data production: what personal data you generate daily and the primary channels through which it flows to third parties. Threat model: who the realistic adversaries are for your current life context, what they could do with your data, and what level of protection is proportionate. Account and credential security: whether your credentials are protected against the most common attack vectors. Browser and network hygiene: whether your browsing behavior and network traffic are exposing you to commercial and network-level surveillance. Digital footprint: what your public profile looks like and whether it accurately represents you. Data rights posture: whether you are aware of the data held about you by the organizations that most affect your life and whether you have exercised your relevant legal rights. The output is not a grade — there is no passing score. The output is a personal action plan: a prioritized list of specific, time-bound steps you will take to improve your data sovereignty posture in ways that match your threat model and are sustainable for your life.
The goal of this audit is clarity, not guilt. Most people will find significant gaps — that is expected and normal. The surveillance economy is designed to extract maximum data with minimal friction, and it is very good at its job. Discovering gaps is the first step to addressing them. Approach this as reconnaissance, not self-criticism.
The Full Data Sovereignty Audit
- Work through all six phases. Document your findings for each phase — this document becomes your action plan.
- --- PHASE 1: DATA PRODUCTION MAP (20 minutes) ---
- List every digital service or device you interact with on a typical day. For each, identify: what category of data it collects (location, behavioral, content, biometric, social, financial), whether you are aware of what it does with that data, and whether you have ever reviewed its privacy settings or policy.
- Then answer: which three services collect the most sensitive data about you? Which three have settings you have never reviewed?
- --- PHASE 2: THREAT MODEL (15 minutes) ---
- Answer the four threat-model questions for your current life:
- a) What are your top three data categories to protect and why?
- b) Who are the two most realistic adversaries for your specific situation right now? (Be specific: an abusive ex-partner, a prospective employer, a government agency, a data broker selling to insurers, cybercriminals targeting credentials — pick the ones actually relevant to your life.)
- c) What are the two most likely ways your data could be compromised or misused?
- d) What protection burden is sustainable for you? Be honest.
- --- PHASE 3: CREDENTIAL AND ACCOUNT SECURITY AUDIT (20 minutes) ---
- Conduct this honestly.
- Count: How many distinct passwords do you use across all your accounts? (If fewer than the number of accounts, you are reusing.)
- Check: Do you have two-factor authentication enabled on your email account? On your primary social accounts? On any financial accounts?
- Review: When did you last update the password on your email account — the master key to your digital identity?
- Assess: Have you ever checked whether any of your email addresses or passwords have appeared in a known data breach? (Visit haveibeenpwned.com to check.)
- Document: your current state, and the specific changes you will make.
- --- PHASE 4: BROWSER AND NETWORK AUDIT (15 minutes) ---
- Answer:
- a) What browser do you use by default, and does it block third-party tracking cookies by default?
- b) Do you have an ad and tracker blocker installed? If yes, which one?
- c) Do you use a VPN? If yes, is it a reputable paid service or a free service? Have you checked its privacy policy?
- d) What search engine do you use by default — does it track your search queries?
- e) Review the browser extensions you have installed. Do any have permissions to read all web page data? Do you know what they do?
- For each gap you identify, write the specific tool change you will make.
- --- PHASE 5: DIGITAL FOOTPRINT AUDIT (20 minutes) ---
- Conduct the search audit from Lesson 7:
- a) Search your full name in at least two search engines. Document the first ten results: accurate? Positive or negative? Indexed content you thought was private?
- b) Check your name on Spokeo.com and Whitepages.com. What information appears? Is it accurate?
- c) Review the privacy settings on your two most-used social platforms. How much of your profile, post history, and friend list is currently visible to the public?
- d) Identify one piece of content in your active footprint that you would prefer employers not see. What is your plan for addressing it?
- --- PHASE 6: DATA RIGHTS POSTURE (15 minutes) ---
- a) Identify the two organizations that hold the most important data about you outside of commercial services (school, healthcare provider, government agency, employer if applicable).
- b) What legal rights do you have over data each holds? (Use what you learned in Lesson 6 about FERPA, HIPAA, GDPR/CCPA if applicable.)
- c) Have you ever made a data access or correction request to any organization? If not, choose one organization and write the specific request you would make.
- d) Identify one data broker profile on your name and look up the opt-out instructions. Write down the steps to submit the opt-out.
- --- ACTION PLAN ---
- Using your findings across all six phases, write a prioritized action plan:
- - Priority 1 (do this week): List three specific, concrete actions with exact steps — not 'improve passwords' but 'install Bitwarden, generate unique passwords for Gmail, bank account, and school portal, enable 2FA on Gmail using Authy.'
- - Priority 2 (do this month): Three more improvements that are important but not urgent.
- - Priority 3 (do this year): Systemic improvements — footprint cleanup, data broker opt-outs, exercising a legal right.
- Share your action plan with a partner. Ask them: does this feel realistic and sustainable? What would they add based on your situation that you missed?
Reflecting on What the Audit Reveals
Most people who complete this audit find a version of the same thing: they are more exposed than they thought, in ways that are largely addressable with modest effort. The gap between most people's current data posture and an adequate one is not enormous — it is a password manager, a browser extension, a few permission changes, and some footprint awareness. What creates the gap is not laziness or ignorance but default settings designed by companies to maximize data extraction and the absence of education about what those defaults mean. The audit also typically reveals something about values: what you actually care about protecting, and where you are genuinely comfortable with the tradeoff. This is useful self-knowledge. Data sovereignty is not about achieving perfect privacy — it is about making deliberate, informed choices about your data rather than passive, unconsidered ones. The audit converts passive exposure into active, considered decisions. That is the beginning of sovereignty.
During Phase 3 of the audit, you discover that you are reusing the same password for your email, your school portal, and a gaming platform that was breached two years ago. In order of priority, what is the correct sequence of actions?
A data sovereignty audit conducted once and then forgotten provides diminishing value as your digital life changes, as new services are adopted, and as your threat model evolves. Build a lightweight annual audit cadence into your calendar — even a one-hour review each year of the six phases above will keep your posture current without requiring ongoing high effort.