[rnnr]

So how do they know if the response with the data a user requests, are all we've got about them, and if indeed where stored the proper way?

[pjc50]

Generally they don't, until something happens that reveals the contrary. Like the Cambridge Analytica fiasco.

[icebraining]

As far as I know, you pay for an audit yourself, and then you send them the results.

[merinowool]

How difficult would be to pay auditor to close their eyes? Do you need another audit?

[icebraining]

Sorry, I don't know the details.