RCM
Core audit coverage
CHECKLIST · GDPR AUDITGDPR audit checklist.
GDPR audit checklist.
The evidence to prepare.
A useful GDPR audit checklist does more than ask whether a document exists. It tests whether documentation reflects operational reality, whether decisions are traceable and whether stated controls are actually used.
A credible GDPR audit defines its scope, links every processing activity to a purpose and lawful basis, reviews transparency, contracts, transfers, security and operational procedures, then converts gaps into owned and prioritised remediation actions.
Prioritised findings
Downloadable checklist
Scope and governance
Entities and activities
List the entities, products, locations, teams and systems included in the audit.
Accountability
Identify business, IT, security, HR, marketing, legal and executive owners.
Existing evidence
Gather previous audits, DPIAs, incidents, regulator correspondence and remediation plans.
Processing, lawful bases and transparency
Inventory
Compare the record of processing with actual applications, files, forms and working practices.
Lawful bases
Document the lawful basis for each purpose rather than defaulting automatically to consent.
Notices
Review information provided to customers, candidates, employees, users and prospects.
Vendors, transfers and security
Processors
Review roles, instructions, contracts, subprocessors and end-of-contract deletion or return.
Transfers
Identify hosting, support and remote access outside the EEA, then document the mechanism and assessment.
Security
Connect organisational and technical measures to risk, including access, backups, encryption, logging and continuity.
Rights, breaches and remediation
Rights requests
Test intake, identity verification, internal search, decision, response and deadline evidence.
Breaches
Review the incident register, escalation, risk assessment and notification preparation.
Action plan
Assign priority, owner, deadline, dependencies and closure evidence to every finding.
IMPLEMENTATION GUIDE
Move from checklist to a documented decision
Define an audit scope that can be completed
A GDPR audit may cover one legal entity, a product, a function such as HR, a digital channel or the entire privacy programme. Scope should identify the systems, time period, countries, groups of individuals and vendors reviewed. Without those boundaries, price and timing become uncertain and findings tend to remain too generic.
The engagement should also state interviewees, samples, rating criteria and exclusions. A documentary GDPR audit can test whether records, notices, contracts and operational evidence are consistent. It does not automatically include penetration testing, security certification or a legal opinion covering every regulatory regime relevant to the organisation.
Build a controlled evidence room
Create a simple structure linking each control to dated evidence: records of processing, notices, forms, contracts, retention decisions, access reports, incident tickets, rights-request exercises and committee minutes. A policy that is not applied is insufficient; the review should compare written commitments with systems and observed working practices.
Evidence should be proportionate and protected. The audit does not require unlimited disclosure of personal data. Define temporary access, confidentiality, copy retention and authorised reviewers before collection, especially where the material contains employee, health or security information.
Turn findings into a funded roadmap
Each finding should identify the observed fact, supporting evidence, risk, relevant requirement and recommended action. Priority should reflect potential impact, likelihood, regulatory urgency, technical dependencies and effort. A collection of document templates without an owner, deadline and acceptance criterion is not an operational remediation plan.
After the closing meeting, leadership decides which risks to address and assigns owners and budgets. Closure evidence should be agreed in advance and then checked. Follow-up testing can confirm implementation, but it cannot create permanent assurance because processing, vendors, technology and applicable guidance continue to change.
PDF · PRACTICAL RESOURCE
Get the PDF version
Receive the structured PDF version for your audit preparation.
FAQ
Frequently asked questions
Is a GDPR audit mandatory?+
Not in every case, but controllers and processors must be able to demonstrate and monitor compliance.
How long does a GDPR audit take?+
It depends on scope, processing complexity, legal entities, vendors and the availability of evidence.
What is the difference between an audit and remediation?+
The audit establishes findings. Remediation implements and documents the chosen corrective actions.
Does a GDPR audit include penetration testing?+
Not normally. Deep technical testing requires a qualified cybersecurity specialist.
What should the final report include?+
Scope, methodology, findings, risk levels, recommendations, priorities, owners and limitations.
This guide provides a general framework and does not replace an assessment of your circumstances or reserved legal advice.
RCM
View GDPR audit pricing →Need a scoped GDPR audit?
RCM reviews the evidence and delivers a prioritised, decision-ready roadmap.