Data may be retrieved from databases using various types of code, functions and programs. To insure that the code, functions and programs comply with privacy requirements and regulations, the code and programs may be audited. In one example, an activity log may be queried to identify code that was executed to retrieve and display database information. A system may then determine whether an unauthorized entity was able to retrieve and/or view the database information. If so, the code or program may be labeled as non-compliant. Alternatively or additionally, a system may parse data retrieval code to determine whether privacy protection code is included therein. If not, the code may be deemed non-compliant. Reports may be generated identifying the non-compliant data retrieval code or function and, in some arrangements, specifying compliance statistics.