Advisory & assurance
GDPR Audits
Evaluate your processes to ensure full compliance with GDPR regulations. We work from evidence — systems, contracts, logs and interviews — and leave you with a record of processing that reflects what the organisation actually does.
The problem
Most organisations can describe their compliance. Few can evidence it.
Article 5(2) GDPR makes the controller responsible for demonstrating compliance, not merely achieving it. In practice this is where enforcement bites: a privacy notice that does not match the processing, a record of processing written once and never updated, a retention policy nobody implemented, a processor whose sub-processors were never reviewed.
An audit that only reads your policies will confirm your policies. We read the policies, then look at the systems, the contracts, the access lists, the export jobs and the backups — and report the gap between the two.
Scope
What a full audit examines
A standard scope covers the following areas. Each can be narrowed or extended in the statement of work.
Records of processing
Article 30 records built from data-flow mapping and system inventory, naming purposes, categories of data subject and data, recipients, transfers, retention periods and security measures.
Lawful basis & special categories
Article 6 basis for each operation, Article 9 condition where special-category data is involved, Article 10 analysis for criminal-offence data, and the legitimate-interests assessments that Recital 47 expects to be documented.
Transparency
Articles 12–14 review of privacy notices, layered notices, just-in-time disclosures and indirect-collection notices, tested against the processing we actually find.
Data subject rights
The operational capability behind Articles 15–22: can you find the data, redact third parties, apply exemptions, and respond inside one month with a defensible audit trail?
Retention & minimisation
Retention schedules tied to named systems and named owners, deletion that reaches backups and analytics copies, and an honest assessment of what you are keeping without a purpose.
International transfers
Transfer mapping, adequacy status, SCC module selection, Article 46 safeguards and transfer impact assessments reflecting third-country government-access risk.
Processors & sub-processors
Article 28 contract review, sub-processor chain mapping, authorisation and objection mechanics, audit rights, and whether the diligence you performed is proportionate to the risk.
Security of processing
Article 32 appropriateness review covering pseudonymisation, encryption, resilience, restoration and the testing regime — assessed against the risk to data subjects, not against a generic checklist.
Governance & accountability
DPO appointment and independence, training records, breach register, DPIA triggers, policy ownership, and whether decisions are logged where a supervisory authority would look for them.
Method
How the audit runs
Planning
Agree the criteria, the systems in scope, the entities covered, the evidence-handling rules and the people we need. Issue a document request list before fieldwork begins.
Fieldwork
Structured interviews with business, engineering, HR, marketing and procurement; document and contract review; system walkthroughs; and sampling of actual records rather than described ones.
Analysis
Findings rated by regulatory exposure and by risk to data subjects, with the reasoning stated so you can challenge it. Draft issued for factual accuracy review before it is finalised.
Report & roadmap
A findings report, an updated Article 30 record, and a remediation roadmap sequenced by risk reduction per unit of effort, with named owners and realistic dates.
Deliverables
- Audit findings report with rated gaps and evidence references
- Article 30 record of processing activities, in a maintainable format
- Data-flow and transfer maps
- Processor and sub-processor register with contract status
- Prioritised remediation roadmap with owners and target dates
- Executive summary suitable for a board or audit committee
What we need from you
- Accurate and complete information about processing activities
- Access to systems, contracts, policies and previous incident records
- An internal sponsor able to unblock access and make decisions
- Availability of the people who operate the processes, not only those who own them
- Prompt notice of changes that affect scope — new systems, acquisitions, jurisdictions
Limitations you should understand before engaging
An audit is a review, not a certification. A GDPR audit is performed against the agreed scope, evidence, systems, processes and legal or regulatory criteria identified for the engagement. It does not automatically constitute certification under Article 42 GDPR, approval by a supervisory authority, a guarantee of compliance, or a finding that every risk has been identified.
Clients must provide accurate and complete information about their processing activities, systems, vendors, locations, data subjects, retention practices, security controls and previous incidents. If information is missing, inaccurate, or withheld, the resulting assessment may be incomplete and the report will record that limitation. Recommendations are prioritised according to the information available at the time and should be reviewed as the organisation changes.
Where an audit raises a question that needs country-specific legal expertise, we bring the right specialist in from our own network, instruct them and pay them. You stay with one engagement, one engagement manager and one invoice, and we remain accountable for the work. The full position is set out in sections 6, 10 and 23 of our Terms of Service.
GDPR audits
Find out what you can actually evidence.
A scoping call costs nothing and will tell you whether a full audit is proportionate to your risk.