Ask HN: How do you test your software for privacy compliance requirements?

As users and consumers ourselves, we want the software we use to protect our privacy. We hope that the people who create software have the same sense of obligation. Assuming that you DO test applications for privacy reasons: How do you determine what parts of a system, and what data, need testing? (E.g., just the UI? Also PEN testing to the back end?) Do tools help? If so, which ones? What do they accomplish? How do you measure the results? What are the deliverables for privacy testing results? Do you rely on any tools fro help you know whether you have succeeded, such as for demonstrating HIPAA or GDPR compliance? What else should be done as part of privacy testing? What do you wish you hadn’t learned the hard way? In other words: What avoidable errors do you see testers make? If you DON’T explicitly test the software to test it for data privacy, why not? (Besides the obvious “It isn’t relevant because I’m writing a game” or whatnot.) Who makes that decision?