Look at data privacy holistically
Map the data
Match practices to promises
Regularly update data-collection policies
Evaluate vendors