← Years 9–10 Data & Information

Auditing the data an existing system collects

A list of every item of data a system collects, both typed in by the user and gathered passively (permissions, cookies, location), with the reason for collecting each item.

Part of: 9-10 Digital Technologies: Data privacy and the Australian Privacy Principles — Module 19, ACARA Digital Technologies Years 9–10 — Privacy Principles and Digital Footprints — Module 32

Understanding Auditing the data an existing system collects in Years 9–10 Data & Information

What it does: The entry splits the audit into data entered by the user and data gathered in the background. Each audit row pairs one data item with its purpose, which is the core of a data audit. Every permission is a possible source of data. An audit lists them all, and a missing reason is a warning sign. Cookies and trackers can quietly record what users do, so they belong in the audit as passive data.

Common mistakes: GPS location is not typed in by the user. The app gets it passively through a permission, so the source should be 'permission'. A data audit must record a reason for every item. The cookie row has no reason, so it needs one, such as 'save login'.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Auditing the data an existing system collects to a class →

This module's key terms are also in a printable crossword (Modules 83–132) and word search (Modules 6–132).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A student is auditing a school canteen app. Which list is the better start to a data audit?
Only the name and email the student typed into the sign-up formName (typed in), location (GPS permission), device ID (collected passively), each with a reason
Matches
Audit: name, email, password
↓
It only lists the items and gives no reason for collecting each one. It also misses passive data such as location and cookies.
Applying
Meanings
Term
data audit
Meaning
A list of every item of data a system collects, both typed in by the user and gathered passively (permissions, cookies, location), with the reason for collecting each item.
Practice
Data audit: RunMate fitness app
Testing
Gaps
item: email | source: | reason: login
Check Answer
Spots
3name | typed | greet user
4GPS | typed | forecast

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Star Fox' badge — Frozen Master, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A student is auditing a school canteen app. Which list is the better start to a data audit?
A. Name (typed in), location (GPS permission), device ID (collected passively), each with a reason ✓
B. Only the name and email the student typed into the sign-up form
A data audit lists every item collected, including data gathered passively through permissions, not just what the user types in.
2. Which statement about a data audit is correct?
A. It only counts how many users the system has
B. It records the reason for collecting each data item ✓
A data audit pairs each item of data with the reason it is collected. That lets you spot data with no good reason.
3. A weather app asks for permission to use your location, camera and contacts. In a data audit, what should you do with the camera and contacts permissions?
A. List them as data the app can access and ask what the reason is for each ✓
B. Leave them out because the app is only about weather
Every permission is a possible source of data. An audit lists them all, and a missing reason is a warning sign.
4. Which of these is data collected passively?
A. A tracking cookie that records which pages you visit ✓
B. The username you type into a sign-up form
Passive data is gathered without the user typing it in. Cookies, trackers and location are common examples.
5. Which row from a data audit table is complete?
A. Location | collected by GPS permission | (no reason given)
B. Location | collected by GPS permission | shows nearby shops ✓
A complete audit row names the data item, how it is collected and the reason. A blank reason needs follow-up.

Match the Pairs

Permission: Location | Reason: show nearby canteens → An audit entry for data collected passively through an app permission, with the reason it is collected
Cookie: _ads_id | Reason: ??? → A tracker found in the audit that has no recorded reason, so it should be questioned or removed
A data audit lists data the user types in as well as data collected passively → Typed: name, email | Passive: location, cookies
Every item in a data audit is listed with the reason it is collected → Item: birthdate | Reason: check age limit
Audit: name, email, password → It only lists the items and gives no reason for collecting each one. It also misses passive data such as location and cookies.
Audit of app: only fields in the sign-up form → It leaves out data collected passively, such as app permissions, cookies and trackers, so the audit is incomplete.

Key Term

data audit
A list of every item of data a system collects, both typed in by the user and gathered passively (permissions, cookies, location), with the reason for collecting each item.

Fill in the Blanks

1. item: email | source: typed | reason: login
Hint: Type the word for data that the user enters themselves into a form.
2. permission: location | reason: find shops
Hint: Type the kind of data a maps permission gathers about where the phone is.
3. item: ad id | source: cookie | reason: ads
Hint: Type the name of the small browser file that passively stores a tracking ID.
4. item: age | source: typed | reason: age rule
Hint: Type the audit field name that records why the item is collected.
5. item: contacts | source: permission reason: find friends who use the app
Hint: Type the passive source where the user taps Allow when an app asks for access.

Spot the Error

Question 1
A AUDIT Weather app
B email | typed | log in
C name | typed | greet user
D GPS | typed | forecast
Line D — GPS location is not typed in by the user. The app gets it passively through a permission, so the source should be 'permission'.
Question 2
A AUDIT Quiz game
B username | typed | leaderboard
C cookie | passive |
D age | typed | set difficulty
Line C — A data audit must record a reason for every item. The cookie row has no reason, so it needs one, such as 'save login'.
Question 3
A AUDIT Shop website
B tracker | typed | show ads
C email | typed | send receipt
Line B — A tracker collects data without the user typing anything. Its source should be 'passive', not 'typed'.
Question 4
A SET audit TO empty list
B FOR each app permission
C ADD item, reason TO list
D END FOR
Line C — The list was created with the name audit, so the items must be added to audit. 'list' has not been created.
Question 5
A SET audit TO empty list
B FOR each cookie on the site
C ADD cookie TO audit
D END FOR
Line C — Each audit entry needs the reason for collecting the cookie as well as the cookie itself. It should be ADD cookie, reason TO audit.

Student with a class code? Join your class →