Ideally, a privacy audit should be conducted by a Data Protection Officer (DPO) or a qualified privacy professional. If your organization lacks in-house expertise, consider hiring an external consultant who specializes in data protection and email marketing.